From nobody Mon Sep 28 04:51:24 2026 Received: from mail-ed1-f72.google.com (mail-ed1-f72.google.com [209.85.208.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 62B6834A79D for ; Wed, 26 Aug 2026 09:45:34 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.208.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787737536; cv=none; b=Oh7PDlMqlaK/woGljDhpuNcCFTZUfej3tHW9GTpZ0Teva5qWjBESV0O2WfPAr8PqDwUac04uogWvvsLrVonUQ/tAH/sL1q6+RGrflUtKIIkhLjMU2Ntt3rhn1+pPyqeQGiO3HNtYmA58HYv3maqR3JDLt9PYebeo7sc0C4otv5U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787737536; c=relaxed/simple; bh=r4E1wmblzosXdsyk9oFjyfQpFLc3vVurFmAuXTUav68=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=fJpEE4I4jNnX11Mxc4K/KFah8jnPtotRcE6puri+4slT6JZvlNhYudIbJ35gpug14vL+1dubEGUNPh1VC83iJwdCOqnpLF2b2Vhzj+4TOjAqqeaj4i929NXA0yX4+lQe41vnUDySoPNKBUS9vJkGTSA0dxhMu2PgZo7Ga+abXf4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--vdonnefort.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=YfOtSoLy; arc=none smtp.client-ip=209.85.208.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--vdonnefort.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="YfOtSoLy" Received: by mail-ed1-f72.google.com with SMTP id 4fb4d7f45d1cf-6a5e3fb8e2cso601274a12.3 for ; Wed, 26 Aug 2026 02:45:34 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787737533; x=1788342333; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=+mIAXQrYWTjUciubr07LzQ/BR3tGtnEYxqqtXN+9mW4=; b=YfOtSoLyiQW5C8KXsmEUpS+qLqfGx02vSM0LC79s1RPMVqHQ2XBu8FPQ8TtdRkGQoX BLTLLLrMZX/t+0oPQpTnmU7GyOEQ7n8FNVDv3gh7h6U45CoDTPdHSkUj+/MlXMoEqIS3 lohsocTsYv+1EClaxoUtFxaJ74g7qTs5Ys3T3YVv3N2m7UO/5c4cdlxGqshKQj/UuUQq xonSyjqYo5UPEIpXhp3B9x6DHagMo3kWu6lLLbvp5QMtdyylvqVYLTSTOTh2KZKa4rlb k82UmieiaJ+WqBFv/CxPQAqiIkhLkI5EHyo90R00R4RLwQw3vVaY2mWE1winuB74lCMC u9AA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787737533; x=1788342333; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=+mIAXQrYWTjUciubr07LzQ/BR3tGtnEYxqqtXN+9mW4=; b=Wf1/piI9wRzvLYIGiLihA1HnpaNkN4LcLpL44PefGZ7vx6GrrS+bcz3tNdPvFGmzLO za+ljem+LCX00GRQhqMiBNm3Kt50bqr/0gI+uDNFVfyWO1+CPJpH9FqU+UrYM4ujNaAi YDXg3lMN9t3sGhlSANpUarOouV5+mnRzOD11Z3cgHaKW+0u7DRnOC8a7yPTgo3b9HjZi Dh91bJtLIABm2U2MER6zSxsfa7u9AybHOUH9oIg3QVX7aXqMNmVNI9budJ/kVs+vbYYG 74V+Dyes8VLQwe59O1sET2pKjpz8hxsalCfFY8WYL76i56nxIIPgvdJazrtrY6ulbZq0 AUHw== X-Forwarded-Encrypted: i=1; AHgh+Rqqdf50Cpsauxro5tk76FsNWHI0cyq71LFOTjjXx0UHCFCCr8cmfqoC6g2Bz/EYtvNCHlLqEBod1TxB6oU=@vger.kernel.org X-Gm-Message-State: AFuF++nJmkYXHKp3L4OXmZFAvRgMkSLECfGAwCxIcJBZTqthA6DBviJJ RkNsw3hB3lF/mdi23E8pYCP/sMnUX1oOmI/3doaKoIRUTXYw06JrbgxYOKl0ztnEQDu/Fe14QYU 08wSObYffzXhTPtA/nYK4Qw== X-Received: from edyv23.prod.google.com ([2002:a05:6402:1857:b0:6a3:6c9d:9d89]) (user=vdonnefort job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6402:1f84:b0:6a3:8525:b9da with SMTP id 4fb4d7f45d1cf-6a5df5f111cmr7974868a12.4.1787737532434; Wed, 26 Aug 2026 02:45:32 -0700 (PDT) Date: Wed, 26 Aug 2026 10:45:26 +0100 In-Reply-To: <20260826094528.3738023-1-vdonnefort@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260826094528.3738023-1-vdonnefort@google.com> X-Mailer: git-send-email 2.55.0.860.g4b6b3295ed-goog Message-ID: <20260826094528.3738023-2-vdonnefort@google.com> Subject: [PATCH v8 1/3] tracing: Fix subbuf resize races with trace_pipe_raw readers From: Vincent Donnefort To: rostedt@goodmis.org, mhiramat@kernel.org, linux-trace-kernel@vger.kernel.org Cc: mathieu.desnoyers@efficios.com, kernel-team@android.com, linux-kernel@vger.kernel.org, Vincent Donnefort Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values. Modify ring_buffer_alloc_read_page() to handle the resizing of an existing buffer_data_read_page if necessary and add a new ring_buffer_read_page_size(). This new function enables ring-buffer buffer_data_read_page users to not call the racy ring_buffer_subbuf_size_get(). This makes the spare_size member of ftrace_buffer_info redundant. Finally, handle buffer_data_read_page/reader_page order discrepancy in ring_buffer_read_page(). On a mismatch simply copy manually the data to the buffer_data_read_page. Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with cust= om sub buffer size") Signed-off-by: Vincent Donnefort diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h index 0670742b2d60..afc7daa6ee7d 100644 --- a/include/linux/ring_buffer.h +++ b/include/linux/ring_buffer.h @@ -218,14 +218,15 @@ bool ring_buffer_time_stamp_abs(struct trace_buffer *= buffer); size_t ring_buffer_nr_dirty_pages(struct trace_buffer *buffer, int cpu); =20 struct buffer_data_read_page; -struct buffer_data_read_page * -ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu); +int ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu, + struct buffer_data_read_page **rpage); void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, struct buffer_data_read_page *page); int ring_buffer_read_page(struct trace_buffer *buffer, struct buffer_data_read_page *data_page, size_t len, int cpu, int full); void *ring_buffer_read_page_data(struct buffer_data_read_page *page); +unsigned int ring_buffer_read_page_size(struct buffer_data_read_page *rpag= e); =20 struct trace_seq; =20 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 3c3ed639923d..b8e6bd309707 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -330,6 +330,11 @@ struct buffer_data_read_page { struct buffer_data_page *data; /* actual data, stored in this page */ }; =20 +static __always_inline unsigned int rb_read_page_capacity(struct buffer_da= ta_read_page *rpage) +{ + return (PAGE_SIZE << rpage->order) - BUF_PAGE_HDR_SIZE; +} + /* * Note, the buffer_page list must be first. The buffer pages * are allocated in cache lines, which means that each buffer @@ -6990,56 +6995,78 @@ EXPORT_SYMBOL_GPL(ring_buffer_swap_cpu); * ring_buffer_alloc_read_page - allocate a page to read from buffer * @buffer: the buffer to allocate for. * @cpu: the cpu buffer to allocate. + * @rpage: pointer to pass in an already allocated page (can be NULL) + * and returns the allocated page. * - * This function is used in conjunction with ring_buffer_read_page. + * This function is used in conjunction with ring_buffer_read_page(). * When reading a full page from the ring buffer, these functions * can be used to speed up the process. The calling function should * allocate a few pages first with this function. Then when it * needs to get pages from the ring buffer, it passes the result - * of this function into ring_buffer_read_page, which will swap + * of this function into ring_buffer_read_page(), which will swap * the page that was allocated, with the read page of the buffer. * + * If @rpage is provided, and it has a different order than the current + * subbuffer order, its payload will be freed and re-allocated. If it + * already matches the order, it is simply returned. + * * Returns: - * The page allocated, or ERR_PTR + * 0 on success, < 0 on error */ -struct buffer_data_read_page * -ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu) +int ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu, + struct buffer_data_read_page **rpage) { struct ring_buffer_per_cpu *cpu_buffer; - struct buffer_data_read_page *bpage =3D NULL; unsigned long flags; + unsigned int order; =20 if (!cpumask_test_cpu(cpu, buffer->cpumask)) - return ERR_PTR(-ENODEV); + return -ENODEV; =20 - bpage =3D kzalloc_obj(*bpage); - if (!bpage) - return ERR_PTR(-ENOMEM); + if (!rpage) + return -EINVAL; =20 - bpage->order =3D buffer->subbuf_order; + order =3D buffer->subbuf_order; + + if (*rpage) { + if ((*rpage)->order =3D=3D order) + return 0; + + /* We can reuse rpage, but we discard the payload */ + free_pages((unsigned long)(*rpage)->data, (*rpage)->order); + (*rpage)->data =3D NULL; + } else { + *rpage =3D kzalloc_obj(**rpage); + if (!*rpage) + return -ENOMEM; + } + + (*rpage)->order =3D order; cpu_buffer =3D buffer->buffers[cpu]; + local_irq_save(flags); arch_spin_lock(&cpu_buffer->lock); =20 if (cpu_buffer->free_page.data) { - *bpage =3D cpu_buffer->free_page; + **rpage =3D cpu_buffer->free_page; cpu_buffer->free_page.data =3D NULL; } =20 arch_spin_unlock(&cpu_buffer->lock); local_irq_restore(flags); =20 - if (bpage->data) { - rb_init_data_page(bpage->data); + if ((*rpage)->data) { + rb_init_data_page((*rpage)->data); } else { - bpage->data =3D alloc_cpu_data(cpu, bpage->order); - if (!bpage->data) { - kfree(bpage); - return ERR_PTR(-ENOMEM); + (*rpage)->data =3D alloc_cpu_data(cpu, (*rpage)->order); + if (!(*rpage)->data) { + kfree(*rpage); + *rpage =3D NULL; + return -ENOMEM; } } =20 - return bpage; + return 0; } EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page); =20 @@ -7047,21 +7074,30 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page); * ring_buffer_free_read_page - free an allocated read page * @buffer: the buffer the page was allocate for * @cpu: the cpu buffer the page came from - * @data_page: the page to free + * @rpage: the buffer_dat_read_page to free * * Free a page allocated from ring_buffer_alloc_read_page. */ void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, - struct buffer_data_read_page *data_page) + struct buffer_data_read_page *rpage) { struct ring_buffer_per_cpu *cpu_buffer; - struct buffer_data_page *dpage =3D data_page->data; - struct page *page =3D virt_to_page(dpage); + struct buffer_data_page *dpage; unsigned long flags; + struct page *page; =20 if (!buffer || !buffer->buffers || !buffer->buffers[cpu]) return; =20 + if (!rpage) + return; + + dpage =3D rpage->data; + if (!dpage) + goto out; + + page =3D virt_to_page(dpage); + cpu_buffer =3D buffer->buffers[cpu]; =20 /* @@ -7069,14 +7105,14 @@ void ring_buffer_free_read_page(struct trace_buffer= *buffer, int cpu, * is different from the subbuffer order of the buffer - * we can't reuse it */ - if (page_ref_count(page) > 1 || data_page->order !=3D buffer->subbuf_orde= r) + if (page_ref_count(page) > 1 || rpage->order !=3D buffer->subbuf_order) goto out; =20 local_irq_save(flags); arch_spin_lock(&cpu_buffer->lock); =20 if (!cpu_buffer->free_page.data) { - cpu_buffer->free_page =3D *data_page; + cpu_buffer->free_page =3D *rpage; dpage =3D NULL; } =20 @@ -7084,8 +7120,8 @@ void ring_buffer_free_read_page(struct trace_buffer *= buffer, int cpu, local_irq_restore(flags); =20 out: - free_pages((unsigned long)dpage, data_page->order); - kfree(data_page); + free_pages((unsigned long)dpage, rpage->order); + kfree(rpage); } EXPORT_SYMBOL_GPL(ring_buffer_free_read_page); =20 @@ -7156,10 +7192,9 @@ int ring_buffer_read_page(struct trace_buffer *buffe= r, if (!dpage) return -1; =20 - guard(raw_spinlock_irqsave)(&cpu_buffer->reader_lock); + len =3D min_t(size_t, len, rb_read_page_capacity(data_page)); =20 - if (data_page->order !=3D cpu_buffer->reader_page->order) - return -1; + guard(raw_spinlock_irqsave)(&cpu_buffer->reader_lock); =20 reader =3D rb_get_reader_page(cpu_buffer); if (!reader) @@ -7183,7 +7218,8 @@ int ring_buffer_read_page(struct trace_buffer *buffer, */ if (read || (len < (size - read)) || cpu_buffer->reader_page =3D=3D cpu_buffer->commit_page || - rb_is_static(cpu_buffer)) { + rb_is_static(cpu_buffer) || + data_page->order !=3D reader->order) { struct buffer_data_page *rpage =3D cpu_buffer->reader_page->page; unsigned int rpos =3D read; unsigned int pos =3D 0; @@ -7284,7 +7320,7 @@ int ring_buffer_read_page(struct trace_buffer *buffer, * missed events, then record it there. */ if (missed_events > 0 && - rb_page_capacity(reader) - size >=3D sizeof(missed_events)) { + rb_read_page_capacity(data_page) - size >=3D sizeof(missed_events)) { memcpy(&dpage->data[size], &missed_events, sizeof(missed_events)); local_add(RB_MISSED_STORED, &dpage->commit); @@ -7304,8 +7340,8 @@ int ring_buffer_read_page(struct trace_buffer *buffer, /* * This page may be off to user land. Zero it out here. */ - if (size < rb_page_capacity(reader)) - memset(&dpage->data[size], 0, rb_page_capacity(reader) - size); + if (size < rb_read_page_capacity(data_page)) + memset(&dpage->data[size], 0, rb_read_page_capacity(data_page) - size); =20 return read; } @@ -7323,6 +7359,18 @@ void *ring_buffer_read_page_data(struct buffer_data_= read_page *page) } EXPORT_SYMBOL_GPL(ring_buffer_read_page_data); =20 +/** + * ring_buffer_read_page_size - get size of the read page. + * @page: the page to get the size from + * + * Returns size of the page in bytes. + */ +unsigned int ring_buffer_read_page_size(struct buffer_data_read_page *rpag= e) +{ + return PAGE_SIZE << rpage->order; +} +EXPORT_SYMBOL_GPL(ring_buffer_read_page_size); + /** * ring_buffer_subbuf_size_get - get size of the sub buffer. * @buffer: the buffer to get the sub buffer size from diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffe= r_benchmark.c index 593e3b59e42e..c3d34c0e64e2 100644 --- a/kernel/trace/ring_buffer_benchmark.c +++ b/kernel/trace/ring_buffer_benchmark.c @@ -104,7 +104,7 @@ static enum event_status read_event(int cpu) =20 static enum event_status read_page(int cpu) { - struct buffer_data_read_page *bpage; + struct buffer_data_read_page *bpage =3D NULL; struct ring_buffer_event *event; struct rb_page *rpage; unsigned long commit; @@ -114,8 +114,8 @@ static enum event_status read_page(int cpu) int inc; int i; =20 - bpage =3D ring_buffer_alloc_read_page(buffer, cpu); - if (IS_ERR(bpage)) + ret =3D ring_buffer_alloc_read_page(buffer, cpu, &bpage); + if (ret < 0) return EVENT_DROPPED; =20 page_size =3D ring_buffer_subbuf_size_get(buffer); diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 3e0907aef172..a9cf76a0a3d8 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -7082,8 +7082,8 @@ ssize_t tracing_buffers_read(struct file *filp, char = __user *ubuf, { struct ftrace_buffer_info *info =3D filp->private_data; struct trace_iterator *iter =3D &info->iter; + unsigned int spare_size; void *trace_data; - int page_size; ssize_t ret =3D 0; ssize_t size; =20 @@ -7093,36 +7093,24 @@ ssize_t tracing_buffers_read(struct file *filp, cha= r __user *ubuf, if (iter->snapshot && tracer_uses_snapshot(iter->tr->current_trace)) return -EBUSY; =20 - page_size =3D ring_buffer_subbuf_size_get(iter->array_buffer->buffer); - - /* Make sure the spare matches the current sub buffer size */ +again: if (info->spare) { - if (page_size !=3D info->spare_size) { - ring_buffer_free_read_page(iter->array_buffer->buffer, - info->spare_cpu, info->spare); - info->spare =3D NULL; - } + spare_size =3D ring_buffer_read_page_size(info->spare); + /* Do we have previous read data to read? */ + if (info->read < spare_size) + goto read; } =20 - if (!info->spare) { - info->spare =3D ring_buffer_alloc_read_page(iter->array_buffer->buffer, - iter->cpu_file); - if (IS_ERR(info->spare)) { - ret =3D PTR_ERR(info->spare); - info->spare =3D NULL; - } else { - info->spare_cpu =3D iter->cpu_file; - info->spare_size =3D page_size; - } - } - if (!info->spare) + /* Make sure the read page order is aligned with the current subbuf order= */ + ret =3D ring_buffer_alloc_read_page(iter->array_buffer->buffer, iter->cpu= _file, + &info->spare); + if (ret) return ret; =20 - /* Do we have previous read data to read? */ - if (info->read < page_size) - goto read; + spare_size =3D ring_buffer_read_page_size(info->spare); + info->read =3D spare_size; + info->spare_cpu =3D iter->cpu_file; =20 - again: trace_access_lock(iter->cpu_file); ret =3D ring_buffer_read_page(iter->array_buffer->buffer, info->spare, @@ -7148,8 +7136,9 @@ ssize_t tracing_buffers_read(struct file *filp, char = __user *ubuf, } =20 info->read =3D 0; + read: - size =3D page_size - info->read; + size =3D spare_size - info->read; if (size > count) size =3D count; trace_data =3D ring_buffer_read_page_data(info->spare); @@ -7199,17 +7188,17 @@ int tracing_buffers_release(struct inode *inode, st= ruct file *file) } =20 struct buffer_ref { - struct trace_buffer *buffer; - void *page; - int cpu; - refcount_t refcount; + struct trace_buffer *buffer; + struct buffer_data_read_page *rpage; + int cpu; + refcount_t refcount; }; =20 static void buffer_ref_release(struct buffer_ref *ref) { if (!refcount_dec_and_test(&ref->refcount)) return; - ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page); + ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->rpage); kfree(ref); } =20 @@ -7270,23 +7259,12 @@ ssize_t tracing_buffers_splice_read(struct file *fi= le, loff_t *ppos, }; struct buffer_ref *ref; bool woken =3D false; - int page_size; int entries, i; ssize_t ret =3D 0; =20 if (iter->snapshot && tracer_uses_snapshot(iter->tr->current_trace)) return -EBUSY; =20 - page_size =3D ring_buffer_subbuf_size_get(iter->array_buffer->buffer); - if (*ppos & (page_size - 1)) - return -EINVAL; - - if (len & (page_size - 1)) { - if (len < page_size) - return -EINVAL; - len &=3D (~(page_size - 1)); - } - if (splice_grow_spd(pipe, &spd)) return -ENOMEM; =20 @@ -7294,7 +7272,8 @@ ssize_t tracing_buffers_splice_read(struct file *file= , loff_t *ppos, trace_access_lock(iter->cpu_file); entries =3D ring_buffer_entries_cpu(iter->array_buffer->buffer, iter->cpu= _file); =20 - for (i =3D 0; i < spd.nr_pages_max && len && entries; i++, len -=3D page_= size) { + for (i =3D 0; i < spd.nr_pages_max && len && entries; i++) { + unsigned int page_size; struct page *page; int r; =20 @@ -7306,25 +7285,35 @@ ssize_t tracing_buffers_splice_read(struct file *fi= le, loff_t *ppos, =20 refcount_set(&ref->refcount, 1); ref->buffer =3D iter->array_buffer->buffer; - ref->page =3D ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file); - if (IS_ERR(ref->page)) { - ret =3D PTR_ERR(ref->page); - ref->page =3D NULL; + + ret =3D ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file, &ref->r= page); + if (ret) { kfree(ref); break; } ref->cpu =3D iter->cpu_file; =20 - r =3D ring_buffer_read_page(ref->buffer, ref->page, - len, iter->cpu_file, 1); + page_size =3D ring_buffer_read_page_size(ref->rpage); + + r =3D -EINVAL; + if (IS_ALIGNED(*ppos, page_size) && len >=3D page_size) { + r =3D ring_buffer_read_page(ref->buffer, ref->rpage, len, iter->cpu_fil= e, 1); + } else if (!i) { + /* + * If the first iteration fails this is an invalid userspace input. + * Otherwise, this is because the subbuf order has been modified. Do not + * report an error and finish the read. + */ + ret =3D -EINVAL; + } + if (r < 0) { - ring_buffer_free_read_page(ref->buffer, ref->cpu, - ref->page); + ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->rpage); kfree(ref); break; } =20 - page =3D virt_to_page(ring_buffer_read_page_data(ref->page)); + page =3D virt_to_page(ring_buffer_read_page_data(ref->rpage)); =20 spd.pages[i] =3D page; spd.partial[i].len =3D page_size; @@ -7332,6 +7321,7 @@ ssize_t tracing_buffers_splice_read(struct file *file= , loff_t *ppos, spd.partial[i].private =3D (unsigned long)ref; spd.nr_pages++; *ppos +=3D page_size; + len -=3D page_size; =20 entries =3D ring_buffer_entries_cpu(iter->array_buffer->buffer, iter->cp= u_file); } diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 74a7a50d1e78..203d098ee14e 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -745,11 +745,10 @@ static inline int tracing_get_cpu(struct inode *inode) void tracing_reset_cpu(struct array_buffer *buf, int cpu); =20 struct ftrace_buffer_info { - struct trace_iterator iter; - void *spare; - unsigned int spare_cpu; - unsigned int spare_size; - unsigned int read; + struct trace_iterator iter; + struct buffer_data_read_page *spare; + unsigned int spare_cpu; + unsigned int read; }; =20 /** --=20 2.55.0.860.g4b6b3295ed-goog From nobody Mon Sep 28 04:51:24 2026 Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E12373BB113 for ; Wed, 26 Aug 2026 09:45:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.70 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787737537; cv=none; b=pyTUIE0JfvvoHDyL1eChjOA8E90XkXMEOgWJ0ozsNpywsCHUev9X0Y8ztFWyuA2r1Cl7qcf1cL01x9wGMxix6l9DeLqH6+RaPaRnhc+cLFaejeTs2nZDxRZl8sz+n34bp6KqRPXClVORl9/GsJCdNw+pQoEblS35+2656RCoEoQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787737537; c=relaxed/simple; bh=9GvMaws9PIuzDfM6Kx1/sGBDmvJF4DhLMYDax9a7XUY=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=u+qe3T/Zng36Z13O1guuG/Tv/OMlZVpUoAer6nYPQbe3n+wVV/XcWV7pcYEgXHZdgASy9P1lCe98cACU3mrHQVGf786dsSaRXyE2IrXuHtfJ6ZWK+0WxduuSvYsaTWwkW2N3RSk9IVTkmAUPfymp856JfOmpFM6v/yD66lQ7POM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--vdonnefort.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=tkdoQqWU; arc=none smtp.client-ip=209.85.128.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--vdonnefort.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="tkdoQqWU" Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-490a767c7dcso4308305e9.2 for ; Wed, 26 Aug 2026 02:45:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787737534; x=1788342334; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=3LWnSH1Ba+lR51/zFZG5VDYDvFp27k+/A/HbRVvfHQ8=; b=tkdoQqWUiU+8JnZ8gIdu3yb44WRxdjMPxuHAzIE4jimgprImYA4eYmQkG06jLFR8FK GFetwFKtdy9J45zst72kodbp9rFCoKyAMeUkOW1jSEIlqOFYDPOeOvp0R/aJ8XXVpt4N s6T1+3m1u4PboXbXC8TAUl+H59+h+3hjyPTHYgg9D/WYrVQJzhnV1F8A7SjUz7Cvfegq i2V1C3hemrOVAdL8gDEcJdC0GHKlS9CBrICmnfTONwNvKktLRLV9jVyAcM/FtFsJCLgf e7aV4I25JXx6ZJD5SzAHkNFuErPxlI7yKxNt9AyAd6P0foaAX9+ebRmEWBts3nHMKbOM ZFUA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787737534; x=1788342334; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=3LWnSH1Ba+lR51/zFZG5VDYDvFp27k+/A/HbRVvfHQ8=; b=pj/ThmREqGCxTV1LFc48V/gQMqwfpP5fY1MDAvxVRo05YKP32noVoWZK5yL43V+ZEO RkzsmYHDnxnBPnAhzCSP3GUTHlYhkigUxOdKWs3Ry+JLeXHI0sKVJUbqtG3LTSpTpLwC fZlJdoexD3WDo76j3IHrlH2g9Fmeic90EHIKqX/JX5eKaFLLki+mtOmsfQyDjVMHOnm2 7dnkytPotapLnFsuzUFU/fOwgWyd+dklpPU1RflPjPelaFL0rs13twZrwkLEs3snkrLn Z9AYJzT091WCvSzPKbZZweidUCM5utv/tZt+3LW4kXoDnEbX3AKB1sRjVrxeekGqwkg1 LXHA== X-Forwarded-Encrypted: i=1; AHgh+RqOYL9RCJMzzv71SoPjOsUnsQIJ1S7EHAg6OlxaRHvQ7YtCCR3BOxEN740qXen5fiA7bW09vIPbaZSCWSI=@vger.kernel.org X-Gm-Message-State: AFuF++l/vhxh5U1nWJLQILX45D972gV4xIlmVlm2CwLpRmzzyJdwAYos 0dTUKPd3IjSeFs8TygMphaxbLL5YdeUybRcj42hPkelk1RaWtsTXd0f6pkyq4jNGHm08LXC5xO8 UM7daa6G+IQWkXQzZiY6Xsw== X-Received: from wmom18.prod.google.com ([2002:a05:600c:4612:b0:495:5422:15f2]) (user=vdonnefort job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:3155:b0:499:4892:d022 with SMTP id 5b1f17b1804b1-499dc6feffcmr39924575e9.8.1787737533424; Wed, 26 Aug 2026 02:45:33 -0700 (PDT) Date: Wed, 26 Aug 2026 10:45:27 +0100 In-Reply-To: <20260826094528.3738023-1-vdonnefort@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260826094528.3738023-1-vdonnefort@google.com> X-Mailer: git-send-email 2.55.0.860.g4b6b3295ed-goog Message-ID: <20260826094528.3738023-3-vdonnefort@google.com> Subject: [PATCH v8 2/3] ring-buffer: Cap static ring buffer nr_pages From: Vincent Donnefort To: rostedt@goodmis.org, mhiramat@kernel.org, linux-trace-kernel@vger.kernel.org Cc: mathieu.desnoyers@efficios.com, kernel-team@android.com, linux-kernel@vger.kernel.org, Vincent Donnefort Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Static ring buffers (i.e. persistent, user-mapped and remote) rely on the bpage::id field. The number of pages for those ring buffers must fit into that variable. Enforce this limit on ring buffer creation or user-mapping. While at it, make buffer_page::id 31 bits. This does not change the struct buffer_page size. Fixes: be68d63a139b ("ring-buffer: Add ring_buffer_alloc_range()") Signed-off-by: Vincent Donnefort diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index b8e6bd309707..6089fcc67e2b 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -350,7 +350,7 @@ struct buffer_page { local_t entries; /* entries on this page */ unsigned long real_end; /* real end of data */ unsigned order; /* order of the page */ - u32 id:30; /* ID for external mapping */ + u32 id:31; /* ID for external mapping */ u32 range:1; /* Mapped via a range */ struct buffer_data_page *page; /* Actual data page */ }; @@ -657,6 +657,15 @@ static bool rb_is_static(struct ring_buffer_per_cpu *c= pu_buffer) return cpu_buffer->user_mapped || cpu_buffer->remote || cpu_buffer->ring_= meta; } =20 +static unsigned long rb_static_max_pages(void) +{ + /* + * Static ring buffers are using bpage::id and must account for the + * reader page. + */ + return (1UL << 31) - 1; +} + struct ring_buffer_iter { struct ring_buffer_per_cpu *cpu_buffer; unsigned long head; @@ -2842,6 +2851,10 @@ static struct trace_buffer *alloc_buffer(unsigned lo= ng size, unsigned flags, */ nr_pages =3D (size - sizeof(struct ring_buffer_cpu_meta)) / (subbuf_size + sizeof(int)); + + if (nr_pages > rb_static_max_pages()) + goto fail_free_buffers; + /* Need at least two pages plus the reader page */ if (nr_pages < 3) goto fail_free_buffers; @@ -2874,6 +2887,10 @@ static struct trace_buffer *alloc_buffer(unsigned lo= ng size, unsigned flags, /* The writer is remote. This ring-buffer is read-only */ atomic_inc(&buffer->record_disabled); nr_pages =3D desc->nr_page_va - 1; + + if (nr_pages > rb_static_max_pages()) + goto fail_free_buffers; + if (nr_pages < 2) goto fail_free_buffers; } else { @@ -7839,6 +7856,9 @@ int ring_buffer_map(struct trace_buffer *buffer, int = cpu, /* prevent another thread from changing buffer/sub-buffer sizes */ guard(mutex)(&buffer->mutex); =20 + if (cpu_buffer->nr_pages > rb_static_max_pages()) + return -E2BIG; + err =3D rb_alloc_meta_page(cpu_buffer); if (err) return err; --=20 2.55.0.860.g4b6b3295ed-goog From nobody Mon Sep 28 04:51:24 2026 Received: from mail-wr1-f72.google.com (mail-wr1-f72.google.com [209.85.221.72]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 185AB33AD9C for ; Wed, 26 Aug 2026 09:47:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.72 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787737624; cv=none; b=jFaC5ds9fryWKGnk7Dt1U681ejeY3bj3/m04jUdefaSrxPsO8oIABq4G8iH3tsdJp5Z1Zybgm9iOcJ2EgQo+84GEFbJvixwvX866cMWmAnathYQwVw36RI+mJAK0u6na2I5B23oofSZdA8MeDhkbZ0m9K4RCmHai4BLxTVpyV54= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787737624; c=relaxed/simple; bh=n9LyenMFcPw0B9rc52GW+H0nuObAcHawmJDkIecVI4I=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=PPvBi0zSvd+ddiOlE1Enbu3JVoNGaYb+21QW37CgXQ6PoLKfLmHNOzGA8EmI3jrJPBa7r86SOiWrMmXBbQhw6bMT1RGfubWOSQvJxFTSifco9eU9bxzROJOOiESVkoau62CXo4WVfkKz3I/QQnBTjDoaWrRExGC8HN4ueSLMoEg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--vdonnefort.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=skrkcqwp; arc=none smtp.client-ip=209.85.221.72 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--vdonnefort.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="skrkcqwp" Received: by mail-wr1-f72.google.com with SMTP id ffacd0b85a97d-482e575596aso163331f8f.3 for ; Wed, 26 Aug 2026 02:47:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1787737621; x=1788342421; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=JCN5ZDztYZPoXy473rXzWwFGq4crA1kqoBaWd7gcR/o=; b=skrkcqwpL8RyTUL+DEjbxUeZKtAzIUYQeTGQdUXvKo9YSvkTq9PrWVohDyA+FvKx8r x+tUYPB+pYVphLpTpM4Qa/KHAVtD/MJsSgDu/anGXjvjvGG7URiCuj0QBiKA71a535Qd vp6ILIPdOIlLEgckNVLy/4TQYKg+Qkxo74gzcsVHmlUdH7WZrzFVKx+Y5dJVia2uqafc ri+I7LiMNhr+PPGbrULON3/2DBscwyjKRoNjfktCyG730uOfdYsFvZrE5O2NRI6x5fXS QmizZCc3JtGvh8LrqXkH5TERlOUzUzHujjJKNEZTNWZE1NBGHAgxOB15WDFZInsjDPFx D0dQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1787737621; x=1788342421; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=JCN5ZDztYZPoXy473rXzWwFGq4crA1kqoBaWd7gcR/o=; b=RbeMWj6WHsEyY4Vx2brEpoXq/elof2puyYPZGvW1LYbMAr08lzTwnmew10AgPvV+Lr xxcNKpqtkxzI0MXerwbmWNV84B4Zn53tiAz7nsMabCofRUjUmxAAKCEzrnAajs6T2c7p iGQO7k24utfLO9ZzMHKW1+kpcQJNUvIksyXhCnJZUcPyePJghY0i84gRM9/NhqQP0rqZ HZ046RkE/vfJoVQZNPJ9EpoXXLoQGW8D650CMTP8KxNyGURXUIIf9qh6UqvV1E4wvMqf bz7lOSp5lpDGHxBrswRfAgF6te9NnN36+Q8XRIpsPZ3MBQKUB4HyUdon18SrbrAP1QFF iVfQ== X-Forwarded-Encrypted: i=1; AHgh+RrB6eBu/OVS0T+TI3paCQJbPW2SL2hhSFf2RYH+af+ttOG/jUok1hT0sEh72SwRRYLTnK+oPHBq+6YBV1Y=@vger.kernel.org X-Gm-Message-State: AFuF++mLhR3ZzhILyRBRdBIRsjKz+FURnwKiQaURyJrGr5b8gY+YvoCW vjDN76cxDvcVQXFFS7/qXnynTeVp9UtKjaTIDlot+pSi1Ud8bvVikU2OtkJUHRXq7NeXUZEeGqP QnjUe3CIMHVhKRP4bz5rPUg== X-Received: from wrwb11.prod.google.com ([2002:a5d:634b:0:b0:482:ddd8:17fc]) (user=vdonnefort job=prod-delivery.src-stubby-dispatcher) by 2002:a5d:6f07:0:b0:482:e64d:a1f7 with SMTP id ffacd0b85a97d-482e64da6e6mr1944582f8f.11.1787737534646; Wed, 26 Aug 2026 02:45:34 -0700 (PDT) Date: Wed, 26 Aug 2026 10:45:28 +0100 In-Reply-To: <20260826094528.3738023-1-vdonnefort@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260826094528.3738023-1-vdonnefort@google.com> X-Mailer: git-send-email 2.55.0.860.g4b6b3295ed-goog Message-ID: <20260826094528.3738023-4-vdonnefort@google.com> Subject: [PATCH v8 3/3] ring-buffer: Prevent truncation of nr_pages / nr_subbufs From: Vincent Donnefort To: rostedt@goodmis.org, mhiramat@kernel.org, linux-trace-kernel@vger.kernel.org Cc: mathieu.desnoyers@efficios.com, kernel-team@android.com, linux-kernel@vger.kernel.org, Vincent Donnefort Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Although ring_buffer_per_cpu::nr_pages is defined as unsigned long, it is capped to 32-bits in a few places, limiting the operations possible on a very large buffer. Use `unsigned long` where appropriate and prevent truncation of values using nr_pages (or nr_subbufs). While at it, subbuf_size must be at least `unsigned int`. Note that persistent, remote and user-mapped ring buffers are capping the number of pages to 31 bits already, making "int" safe in many places. Signed-off-by: Vincent Donnefort diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 6089fcc67e2b..1fcf55e2ca81 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1683,7 +1683,7 @@ static void rb_check_pages(struct ring_buffer_per_cpu= *cpu_buffer) * This is used to help find the next per cpu subbuffer within a mapped ra= nge. */ static unsigned long -rb_range_align_subbuf(unsigned long addr, int subbuf_size, int nr_subbufs) +rb_range_align_subbuf(unsigned long addr, unsigned int subbuf_size, unsign= ed long nr_subbufs) { addr +=3D sizeof(struct ring_buffer_cpu_meta) + sizeof(int) * nr_subbufs; @@ -1693,13 +1693,12 @@ rb_range_align_subbuf(unsigned long addr, int subbu= f_size, int nr_subbufs) /* * Return the ring_buffer_meta for a given @cpu. */ -static void *rb_range_meta(struct trace_buffer *buffer, int nr_pages, int = cpu) +static void *rb_range_meta(struct trace_buffer *buffer, unsigned long nr_p= ages, int cpu) { - int subbuf_size =3D rb_subbuf_size(buffer); + unsigned int subbuf_size =3D rb_subbuf_size(buffer); struct ring_buffer_cpu_meta *meta; struct ring_buffer_meta *bmeta; - unsigned long ptr; - int nr_subbufs; + unsigned long ptr, nr_subbufs; =20 bmeta =3D buffer->meta; if (!bmeta) @@ -1745,7 +1744,7 @@ static void *rb_range_meta(struct trace_buffer *buffe= r, int nr_pages, int cpu) /* Return the start of subbufs given the meta pointer */ static void *rb_subbufs_from_meta(struct ring_buffer_cpu_meta *meta) { - int subbuf_size =3D meta->subbuf_size; + unsigned int subbuf_size =3D meta->subbuf_size; unsigned long ptr; =20 ptr =3D (unsigned long)meta; @@ -1757,11 +1756,11 @@ static void *rb_subbufs_from_meta(struct ring_buffe= r_cpu_meta *meta) /* * Return a specific sub-buffer for a given @cpu defined by @idx. */ -static void *rb_range_buffer(struct ring_buffer_per_cpu *cpu_buffer, int i= dx) +static void *rb_range_buffer(struct ring_buffer_per_cpu *cpu_buffer, unsig= ned int idx) { struct ring_buffer_cpu_meta *meta; + unsigned int subbuf_size; unsigned long ptr; - int subbuf_size; =20 meta =3D rb_range_meta(cpu_buffer->buffer, 0, cpu_buffer->cpu); if (!meta) @@ -1777,7 +1776,7 @@ static void *rb_range_buffer(struct ring_buffer_per_c= pu *cpu_buffer, int idx) =20 ptr =3D (unsigned long)rb_subbufs_from_meta(meta); =20 - ptr +=3D subbuf_size * idx; + ptr +=3D (unsigned long)subbuf_size * idx; if (ptr + subbuf_size > cpu_buffer->buffer->range_addr_end) return NULL; =20 @@ -1854,13 +1853,13 @@ static bool rb_meta_init(struct trace_buffer *buffe= r, int scratch_size) * must be the same. */ static bool rb_cpu_meta_valid(struct ring_buffer_cpu_meta *meta, int cpu, - struct trace_buffer *buffer, int nr_pages, + struct trace_buffer *buffer, unsigned long nr_pages, unsigned long *subbuf_mask) { - int subbuf_size =3D PAGE_SIZE; + unsigned long subbuf_size =3D PAGE_SIZE; unsigned long buffers_start; unsigned long buffers_end; - int i; + unsigned long i; =20 if (!subbuf_mask) return false; @@ -2109,8 +2108,8 @@ static void rb_meta_validate_events(struct ring_buffe= r_per_cpu *cpu_buffer) struct buffer_page *head_page, *orig_head, *orig_reader; struct rb_validation_state state =3D { 0 }; bool skip =3D false; + unsigned long i; int ret; - int i; =20 if (!meta || !meta->head_buffer) return; @@ -2161,7 +2160,7 @@ static void rb_meta_validate_events(struct ring_buffe= r_per_cpu *cpu_buffer) rb_validate_buffer(head_page, cpu_buffer, meta, &state, 0, state.ts); } if (i) - pr_info("Ring buffer [%d] rewound %d pages\n", cpu_buffer->cpu, i); + pr_info("Ring buffer [%d] rewound %lu pages\n", cpu_buffer->cpu, i); =20 /* The last rewound page must be skipped. */ if (head_page !=3D orig_head) @@ -2245,7 +2244,8 @@ static void rb_meta_validate_events(struct ring_buffe= r_per_cpu *cpu_buffer) } } =20 -static void rb_range_meta_init(struct trace_buffer *buffer, int nr_pages, = int scratch_size) +static void rb_range_meta_init(struct trace_buffer *buffer, + unsigned long nr_pages, int scratch_size) { struct ring_buffer_cpu_meta *meta; unsigned long *subbuf_mask; @@ -2345,8 +2345,8 @@ static int rbm_show(struct seq_file *m, void *v) rb_meta_subbuf_idx(meta, (void *)meta->head_buffer)); seq_printf(m, "commit_buffer: %d\n", rb_meta_subbuf_idx(meta, (void *)meta->commit_buffer)); - seq_printf(m, "subbuf_size: %d\n", meta->subbuf_size); - seq_printf(m, "nr_subbufs: %d\n", meta->nr_subbufs); + seq_printf(m, "subbuf_size: %u\n", meta->subbuf_size); + seq_printf(m, "nr_subbufs: %u\n", meta->nr_subbufs); return 0; } =20 @@ -2431,7 +2431,7 @@ static void *ring_buffer_desc_page(struct ring_buffer= _desc *desc, unsigned int p } =20 static int __rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, - long nr_pages, struct list_head *pages) + unsigned long nr_pages, struct list_head *pages) { struct trace_buffer *buffer =3D cpu_buffer->buffer; struct ring_buffer_cpu_meta *meta =3D NULL; @@ -2559,7 +2559,7 @@ static int rb_allocate_pages(struct ring_buffer_per_c= pu *cpu_buffer, } =20 static struct ring_buffer_per_cpu * -rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu) +rb_allocate_cpu_buffer(struct trace_buffer *buffer, unsigned long nr_pages= , int cpu) { struct ring_buffer_per_cpu *cpu_buffer __free(kfree) =3D alloc_cpu_buffer(cpu); @@ -2716,8 +2716,8 @@ static void rb_test_inject_invalid_pages(struct trace= _buffer *buffer) struct ring_buffer_cpu_meta *meta; struct buffer_data_page *dpage; unsigned long entry_bytes =3D 0; + unsigned int subbuf_size; unsigned long ptr; - int subbuf_size; int invalid =3D 0; int cpu; int i; @@ -2787,8 +2787,8 @@ static struct trace_buffer *alloc_buffer(unsigned lon= g size, unsigned flags, struct ring_buffer_remote *remote) { struct trace_buffer *buffer __free(kfree) =3D NULL; - long nr_pages; - int subbuf_size; + unsigned int subbuf_size; + unsigned long nr_pages; int bsize; int cpu; int ret; @@ -5872,12 +5872,12 @@ __rb_get_reader_page_from_remote(struct ring_buffer= _per_cpu *cpu_buffer) static struct buffer_page * __rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) { - int max_loops =3D cpu_buffer->ring_meta ? cpu_buffer->nr_pages : 3; + unsigned long max_loops =3D cpu_buffer->ring_meta ? cpu_buffer->nr_pages = : 3; struct buffer_page *reader =3D NULL; + unsigned long nr_loops =3D 0; unsigned long overwrite; unsigned long flags; int missed_events =3D 0; - int nr_loops =3D 0; bool ret; =20 local_irq_save(flags); @@ -6195,8 +6195,8 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts) struct trace_buffer *buffer; struct ring_buffer_per_cpu *cpu_buffer; struct ring_buffer_event *event; - int nr_loops =3D 0; - int max_loops; + unsigned long nr_loops =3D 0; + unsigned long max_loops; =20 if (ts) *ts =3D 0; @@ -7442,8 +7442,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer = *buffer, int order) struct ring_buffer_per_cpu *cpu_buffer; struct buffer_page *bpage, *tmp; unsigned int old_capacity; + unsigned long nr_pages; int old_order; - int nr_pages; int psize; int err; int cpu; @@ -7625,10 +7625,10 @@ static void rb_setup_ids_meta_page(struct ring_buff= er_per_cpu *cpu_buffer, struct buffer_page **subbuf_ids) { struct trace_buffer_meta *meta =3D cpu_buffer->meta_page; - unsigned int nr_subbufs =3D cpu_buffer->nr_pages + 1; + unsigned long nr_subbufs =3D cpu_buffer->nr_pages + 1; struct buffer_page *first_subbuf, *subbuf; - int cnt =3D 0; - int id =3D 0; + unsigned int cnt =3D 0; + unsigned int id =3D 0; =20 id =3D rb_page_id(cpu_buffer, cpu_buffer->reader_page, id); subbuf_ids[id++] =3D cpu_buffer->reader_page; --=20 2.55.0.860.g4b6b3295ed-goog