From nobody Sat Jul 25 16:48:58 2026 Received: from relay.hostedemail.com (smtprelay0011.hostedemail.com [216.40.44.11]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3F90D385D96 for ; Wed, 15 Jul 2026 16:33:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=216.40.44.11 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784133197; cv=none; b=S2DMH7isMh77kHtyhVn/yBv0T9eKz75F383Mg/9ovEhljrCPeCZkTzAl8LMNBjlRogva8z1Dn2UODhW6T3TILFCi4fftcxdIIiTPTcpjYnIEM0eveu4PoOIUMOesUlskaDqx9twF/p7TJpPGLIhpGk0NuRrDNWKU8yyQvEiI7gI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784133197; c=relaxed/simple; bh=WWvaTt7vAexwS0OtUgx8XhUhSlULC6isBIqPdZI2kdA=; h=Date:From:To:Cc:Subject:Message-ID:MIME-Version:Content-Type; b=qz3cpXhyy63G1dKXK4LiSKvLZ6+rqm6ebssR9M71/DcGqlRaioKeLn62F5huqGhYsGhjE32mwe80TNrwtVJ785H4bsKm73GNLEPxadY8TQQEOCF+GFWN5SEKzH27g6e9XJAxhQIZZvu9f9uCfyISZZJPRuSZr6/a7//gmEcqbg4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=goodmis.org; spf=pass smtp.mailfrom=goodmis.org; arc=none smtp.client-ip=216.40.44.11 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=goodmis.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=goodmis.org Received: from omf03.hostedemail.com (lb01a-stub [10.200.18.249]) by unirelay07.hostedemail.com (Postfix) with ESMTP id 47FAB16020B; Wed, 15 Jul 2026 16:33:08 +0000 (UTC) Received: from [HIDDEN] (Authenticated sender: rostedt@goodmis.org) by omf03.hostedemail.com (Postfix) with ESMTPA id 952926000C; Wed, 15 Jul 2026 16:33:06 +0000 (UTC) Date: Wed, 15 Jul 2026 12:33:11 -0400 From: Steven Rostedt To: LKML Cc: Masami Hiramatsu , Mathieu Desnoyers , Vincent Donnefort , Fuad Tabba Subject: [for-linus] tracing: Fix for 7.2 Message-ID: <20260715123311.1ea3aeaa@gandalf.local.home> X-Mailer: Claws Mail 3.20.0git84 (GTK+ 2.24.33; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Stat-Signature: f85tnb5fgkfmh8r15rtpogs7xbx8xey1 X-Rspamd-Server: rspamout04 X-Rspamd-Queue-Id: 952926000C X-Session-Marker: 726F737465647440676F6F646D69732E6F7267 X-Session-ID: U2FsdGVkX1+ZFys4MC4q9WaiWSlgo40WbcqK+77REEM= X-HE-Tag: 1784133186-253364 X-HE-Meta: U2FsdGVkX18xfgtM71YntCeruQAhA6TdmC27ZOav6Q2fHY/zh29dncQqqoL6LFxETFuD06mv8vB8l5BbBsKsrCL83pYxpoXtxEvcQ6c8w/Y507+abWw9t9lspPCLdma4fftG4TP/SHEX+Kc0HPTU/xCmWeU5+hQ2aAp67D9KOAx5CoJ120vQ4d+xE3jYvggu0k5p6AGBTJ7/U+2wm5czBnhR15xXXd17BROE/bh67Wcpr0UYio5ulLZE67UquRj8wiZ8ILgRx24vtKWdNXUpnPjBAQkZtWPL/Vzm8LD0w+EktWabGzPw/pbRQyRA6EXzM8Xa+WUe61cEOavZu5gGhwZX9cL8mQTvBwswp9t/oUWU/PRHZbK1uUX3UcRHzVSrTnozL+2v+UNx6fsqDjKuuUGZOckyT01Fnzn6UcKO9roZV9EGPbBYLENbr624DZy0hQGBVY4j0g+/CTScgYFDIN02r4JW8BLZzKV6h/dADJItmMp1TAt+3L2B+Bt5C/fD Content-Type: text/plain; charset="utf-8" tracing fix for 7.2: - Move rb_desc->nr_page_va before updating dynamic array The rb_descr->page_va is a dynamic array counted by nr_page_va. But the updating of the page_va[] is done before the nr_page_va is incremented causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow. Move the increment of the counted by value before the array element is updated. git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git trace/fixes Head SHA1: 1d867ac69846d212a462d899603b4ac8664a9a78 Fuad Tabba (1): tracing/remotes: Fix page_va[] access before counter update in trace_= remote_alloc_buffer() ---- kernel/trace/trace_remote.c | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) --------------------------- commit 1d867ac69846d212a462d899603b4ac8664a9a78 Author: Fuad Tabba Date: Mon Jul 13 08:28:23 2026 +0100 tracing/remotes: Fix page_va[] access before counter update in trace_re= mote_alloc_buffer() =20 page_va[] is annotated __counted_by(nr_page_va), so nr_page_va must cover an index before that element is accessed. The allocation loop writes page_va[id] while nr_page_va is still id and increments it only afterwards, so every write is one element past the declared count. =20 The store is out of bounds with respect to the annotation: a build with CONFIG_UBSAN_BOUNDS on a toolchain that honours __counted_by (clang >=3D 20.1, gcc >=3D 15.1) flags it as an array-index overflow. =20 Increment nr_page_va before writing the element it now covers. A failed allocation then leaves the slot counted but NULL; the error path frees it with free_page(0), which is a no-op. =20 Link: https://patch.msgid.link/20260713072823.2668323-1-fuad.tabba@linu= x.dev Fixes: 96e43537af546 ("tracing: Introduce trace remotes") Signed-off-by: Fuad Tabba Reviewed-by: Vincent Donnefort Tested-by: Vincent Donnefort Signed-off-by: Steven Rostedt diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c index 0f6ef5c36d84..ef42d9c38b37 100644 --- a/kernel/trace/trace_remote.c +++ b/kernel/trace/trace_remote.c @@ -1004,11 +1004,10 @@ int trace_remote_alloc_buffer(struct trace_buffer_d= esc *desc, size_t desc_size, desc->nr_cpus++; =20 for (id =3D 0; id < nr_pages; id++) { + rb_desc->nr_page_va++; rb_desc->page_va[id] =3D (unsigned long)__get_free_page(GFP_KERNEL); if (!rb_desc->page_va[id]) goto err; - - rb_desc->nr_page_va++; } rb_desc =3D __next_ring_buffer_desc(rb_desc); }