From nobody Mon Apr 13 13:15:57 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B54292D73B5 for ; Sat, 7 Mar 2026 15:12:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772896358; cv=none; b=jbp0Q1q+uIck4WjEQxPsjmeUa6PFyxq2JHYNMohj9H5NWVPc9UnryXgIKXg9xbz0/kJn1YGsMj4lBmKY11L+G6VnSdWdjWa1tbkYORwN/SrWf+DDLtasVQzXTeeiWDUEOP9w72o0nDy5RiRboGu5R+SSwMypZuRKQu/o05mJjv4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772896358; c=relaxed/simple; bh=e2T+lccA7MjukbLvSBjsowJPbeIBq9EDH3J+RYDvgj4=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=dK06SHNEHBXppSIbUnjQpCbWN91Hek5up1nDIMy9G4JTw5vaslNNrXubGERmOGmHVoNgIr5EjJYHToWPZVLdSM6K3ingFZ9ek6PbXXWDW81DTuSliFX4o3WxhKvlevWKMJuJdZeblUhiUMiSMaGCXXgAhQPrPOi9/V0uXXOG/dQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=B1VFekzz; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="B1VFekzz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9534BC2BC87; Sat, 7 Mar 2026 15:12:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772896358; bh=e2T+lccA7MjukbLvSBjsowJPbeIBq9EDH3J+RYDvgj4=; h=Date:From:To:Cc:Subject:References:From; b=B1VFekzzUa1QuJxQ7TP2u11Z5w5lsnY+0Rr8rrrLV77NP5fnqHJz04dzYTSSieL4r noslQkaZPe5J6PA9/2H0v+30EgMeFm+Qh8sRek3w6N0GzlMPwTds0Ulb4n/E5jC769 z/eJ+fysXGUBNs12T+CibQ0yy7mv5FpOUze8ungT4cBwJKma3vFQIUz6gqxuOIxTvH 8KoinkJteM3zBomNXsIgJJJ8+2ocPHtKjf9FjgXD92ZRteXetg2WQOzkm+i8f3sqJj RaHFl9nFXv3x5mlrJYsr7tvjEa7Z3ExgZ8sFqBpMU+pIcccD7pW4CWfDFyMQI4py8K 6yNx2hhgRfGLg== Received: from rostedt by gandalf with local (Exim 4.99.1) (envelope-from ) id 1vytKb-000000010NO-3elN; Sat, 07 Mar 2026 10:12:41 -0500 Message-ID: <20260307151241.729660358@kernel.org> User-Agent: quilt/0.69 Date: Sat, 07 Mar 2026 10:12:25 -0500 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Miaoqian Lin , Guenter Roeck Subject: [for-linus][PATCH 1/3] tracing: Add NULL pointer check to trigger_data_free() References: <20260307151224.447677123@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Guenter Roeck If trigger_data_alloc() fails and returns NULL, event_hist_trigger_parse() jumps to the out_free error path. While kfree() safely handles a NULL pointer, trigger_data_free() does not. This causes a NULL pointer dereference in trigger_data_free() when evaluating data->cmd_ops->set_filter. Fix the problem by adding a NULL pointer check to trigger_data_free(). The problem was found by an experimental code review agent based on gemini-3.1-pro while reviewing backports into v6.18.y. Cc: Miaoqian Lin Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Cc: Steven Rostedt (Google) Link: https://patch.msgid.link/20260305193339.2810953-1-linux@roeck-us.net Fixes: 0550069cc25f ("tracing: Properly process error handling in event_his= t_trigger_parse()") Assisted-by: Gemini:gemini-3.1-pro Signed-off-by: Guenter Roeck Signed-off-by: Steven Rostedt (Google) --- kernel/trace/trace_events_trigger.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_event= s_trigger.c index fecbd679d432..d5230b759a2d 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -50,6 +50,9 @@ static int trigger_kthread_fn(void *ignore) =20 void trigger_data_free(struct event_trigger_data *data) { + if (!data) + return; + if (data->cmd_ops->set_filter) data->cmd_ops->set_filter(NULL, data, NULL); =20 --=20 2.51.0 From nobody Mon Apr 13 13:15:57 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E2B95395D87; Sat, 7 Mar 2026 15:12:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772896359; cv=none; b=mtfLsUrDhtnIQ/B65SoNXV5Z33ziv+nHd+zeBNTTpsAZioAeR8pPKHaegWQ+PCeKT0XJpp4UMkjRcbaNOHKmE6ILWh5rw8GizvvAxjMifSbcbkwK3EKAzqcEnaCgya+NdRiPqi9xwNZZGkjl1UOTCajsRL3EPFEn5wur1Ra38LY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772896359; c=relaxed/simple; bh=WAy+8low3pplFgAVrxMFFzftkqpYzsxhPoP9RFA1wOg=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=BOVoslQjAsz3bZMXo9t7v1yHUEYCfHMM7VSbQv/nWr4D3UqgGXZ9kMR8yoqK8cXRUPURvBLfPcSeS7zYBlCj1cHYpZCmYAfxKR/bH2jQ1dLDDWY+1DPP+8cKD1chaKuBAqb9Pwj34Ps3clS0jHe9YcGShFI7eAwUJPYUPxHu4KE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TmWEfbYk; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TmWEfbYk" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BA136C2BCAF; Sat, 7 Mar 2026 15:12:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772896358; bh=WAy+8low3pplFgAVrxMFFzftkqpYzsxhPoP9RFA1wOg=; h=Date:From:To:Cc:Subject:References:From; b=TmWEfbYk5kXp+T06ZIjvWlf+KPf/bm8/wNHLbeNJeKLoxZ3yDxkRtQfApY0Yf2Q/9 lMYbk/BzMt0zRRJ+Y6JIHvbSgfqodEj4W1D+5yLOcwNuj2fZViQqtYVguo76IB4g1L M0bvt0m/MzKGnNODs/9kwjLrjTmfWhYZqnc44vmiK8euj6NRsVT2Q5lARN8257DtWY luYs0YdIHLbJaHcfgXTIVUnE7KVAstFu7gC3pYsSIR9Bmq5pxMJ1zLCBYA1/xbP28n Cw1O+W84dtyy9cnsn0Kl5TMQ5cQ+6ELuUo+wkIVStXJqmBwnqbM4TC5sWjh1zGXoo9 F/ge1MQQHu+2w== Received: from rostedt by gandalf with local (Exim 4.99.1) (envelope-from ) id 1vytKc-000000010Ns-08Vs; Sat, 07 Mar 2026 10:12:42 -0500 Message-ID: <20260307151241.888254981@kernel.org> User-Agent: quilt/0.69 Date: Sat, 07 Mar 2026 10:12:26 -0500 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Andrei-Alexandru Tachici Subject: [for-linus][PATCH 2/3] tracing: Fix enabling multiple events on the kernel command line and bootconfig References: <20260307151224.447677123@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Andrei-Alexandru Tachici Multiple events can be enabled on the kernel command line via a comma separator. But if the are specified one at a time, then only the last event is enabled. This is because the event names are saved in a temporary buffer, and each call by the init cmdline code will reset that buffer. This also affects names in the boot config file, as it may call the callback multiple times with an example of: kernel.trace_event =3D ":mod:rproc_qcom_common", ":mod:qrtr", ":mod:qcom_= aoss" Change the cmdline callback function to append a comma and the next value if the temporary buffer already has content. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/20260302-trace-events-allow-multiple-modules= -v1-1-ce4436e37fb8@oss.qualcomm.com Signed-off-by: Andrei-Alexandru Tachici Signed-off-by: Steven Rostedt (Google) --- kernel/trace/trace_events.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index b7343fdfd7b0..249d1cba72c0 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -4493,7 +4493,11 @@ static char bootup_event_buf[COMMAND_LINE_SIZE] __in= itdata; =20 static __init int setup_trace_event(char *str) { - strscpy(bootup_event_buf, str, COMMAND_LINE_SIZE); + if (bootup_event_buf[0] !=3D '\0') + strlcat(bootup_event_buf, ",", COMMAND_LINE_SIZE); + + strlcat(bootup_event_buf, str, COMMAND_LINE_SIZE); + trace_set_ring_buffer_expanded(NULL); disable_tracing_selftest("running event tracing"); =20 --=20 2.51.0 From nobody Mon Apr 13 13:15:57 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 342333A453F; Sat, 7 Mar 2026 15:12:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772896359; cv=none; b=ujjyKlUvmqXhvJy8t7TNnAyyHDKt10WcCSkpVw3iBCt+ZLjqaclcjR4TG85+5i26xed/ORRGEZVnfP99vA6WALcw8Ae4fxL3gHvP2j+PP5PYHr2tjm8pOXWKxRwttZLP093KIQttIVSdp9Y9RScBEuCAC6bQp8j8Wka/NDxqfNc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1772896359; c=relaxed/simple; bh=wLGbYtBu6WCu+zKFBx496dNl6JtNSkzUQ30UBesC5lY=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=a0FqBCBB5qhX77384xDdNxhmYrXiFp5gVg4ppNQABdEOoG884fca2k6tWjX/pIaX44URFlUqzuY9wM9y8bkBOSuADsA4Lrhq1lf7UGJ++EwUmKO5Ay/QshXxnU3dGp2fpsrIY+mEdPBfI5SAY+WRCP7gJX2hAg0+EcwXP7g1Zxs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=A0H3qlO7; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="A0H3qlO7" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F0869C2BCB1; Sat, 7 Mar 2026 15:12:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1772896359; bh=wLGbYtBu6WCu+zKFBx496dNl6JtNSkzUQ30UBesC5lY=; h=Date:From:To:Cc:Subject:References:From; b=A0H3qlO7TVP6x+XO5MD4G/CR0ylp7u85pF4U7+pEy0buw9z+OJczQm4cFqi7LHr2t uomTM21whMBt3YsFXvMWo/T9MNLcyDFjGIhJaWOlRdifCvLeT1L0CcXvZ5of9db7XR DJ/wNFenN5PGMgY1bOJBAsJoeIG8FSVnfy5/BIBEHDiIyOstkGsi1YOMCio5JVGy6i WXOCcsAIlJ29rdAzohfGwO+wmqm7gpomVG+D6NebsyJzlCSiTwgXdqPG5CRi3RfWo/ FeseEOjxZT6/9PdYHfmmtsWbtb++VkHq3iTkTjhpFAmDJ7rO8J92XFlmyBZcBxR9+s n2VJtXYaWPJVw== Received: from rostedt by gandalf with local (Exim 4.99.1) (envelope-from ) id 1vytKc-000000010OM-0o4Y; Sat, 07 Mar 2026 10:12:42 -0500 Message-ID: <20260307151242.050347117@kernel.org> User-Agent: quilt/0.69 Date: Sat, 07 Mar 2026 10:12:27 -0500 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Calvin Owens Subject: [for-linus][PATCH 3/3] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G References: <20260307151224.447677123@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Calvin Owens Some of the sizing logic through tracer_alloc_buffers() uses int internally, causing unexpected behavior if the user passes a value that does not fit in an int (on my x86 machine, the result is uselessly tiny buffers). Fix by plumbing the parameter's real type (unsigned long) through to the ring buffer allocation functions, which already use unsigned long. It has always been possible to create larger ring buffers via the sysfs interface: this only affects the cmdline parameter. Cc: stable@vger.kernel.org Cc: Masami Hiramatsu Cc: Mathieu Desnoyers Link: https://patch.msgid.link/bff42a4288aada08bdf74da3f5b67a2c28b761f8.177= 2852067.git.calvin@wbinvd.org Fixes: 73c5162aa362 ("tracing: keep ring buffer to minimum size till used") Signed-off-by: Calvin Owens Signed-off-by: Steven Rostedt (Google) --- kernel/trace/trace.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 1e7c032a72d2..ebd996f8710e 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -9350,7 +9350,7 @@ static void setup_trace_scratch(struct trace_array *t= r, } =20 static int -allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, in= t size) +allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, un= signed long size) { enum ring_buffer_flags rb_flags; struct trace_scratch *tscratch; @@ -9405,7 +9405,7 @@ static void free_trace_buffer(struct array_buffer *bu= f) } } =20 -static int allocate_trace_buffers(struct trace_array *tr, int size) +static int allocate_trace_buffers(struct trace_array *tr, unsigned long si= ze) { int ret; =20 @@ -10769,7 +10769,7 @@ __init static void enable_instances(void) =20 __init static int tracer_alloc_buffers(void) { - int ring_buf_size; + unsigned long ring_buf_size; int ret =3D -ENOMEM; =20 =20 --=20 2.51.0