From nobody Mon Sep 28 01:56:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6CFF6481FC5; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843364; cv=none; b=nD2mGEt4p7l/vMf1+QkKBtw+vEVjZwxXtqiNw4+v7lD7Owif584bWZatHfqXlt/K3WFcSYaMyJWBE3FQW0Jv+EvVA2Yk5Pg+5A1Np5Y7ga2NEBX3ViUqdx1DwA3vJjtlWDOMqAUmjCbbpwj0Q2IxVGsSfLFkO9RhRBITfSr3ksA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843364; c=relaxed/simple; bh=BWP0s543Qo/7CIy8BPbQxMzSMaAR4+do1+amOHhUcTI=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=Mvn9ctL7eW1zuJmnfIqDDI0ns5TxQdiNSC0tVt8+ugY71KzNFP8Y67CjR/LpHMpVz1TQXKv7Pw0LXzULMgPmj8oHj06dE1H8+PrgcE07CNfVR24+EpU/2zpndFkPWpiIBbdk50mFn1V2Z140229C1pTP5mIvp1XD1AEtWLnSv6c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KAPcRF9C; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KAPcRF9C" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0ED901F00A3A; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787843363; bh=ldpf+J78qH9gTkGAWHy50kOb1dxxwTC58VOBRS95Rzw=; h=Date:From:To:Cc:Subject:References; b=KAPcRF9CvdEJbQ3cheyGhqJneO5AUj46nGzx/9X9gszjaRM5N9O1vStnEBpl8IeDV OQKRDYHmXC0V4lzHwpzpVWJ9BUB8BnE6x8mJS2AodxjD/oMsElqSh9OQm7m8+RNt4F F2VsxLdLvRc6uudh+o3wDGHcMyw0N8Hsa9w6s1jBpX+o98LfREBFlZIpRQ2Ka/Qmd7 MbCS+xmxBFkf4R+o14Afe+NKZ7RkIt7zrFgh5ZWc8GQVFEIBI1eZCM3KqsEvSan6gt Cc2ZrgCHvnbCzamDWVmx3B/T2gIC2Z6i+Vvcd/9DG1V6UHJoBBF6uIAxv1vIrHcpUA 6IM6wqTScB+ow== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wzbk2-00000008PEY-3dX9; Thu, 27 Aug 2026 11:10:10 -0400 Message-ID: <20260827151010.719796681@kernel.org> User-Agent: quilt/0.69 Date: Thu, 27 Aug 2026 11:09:50 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Deepanshu Kartikey , Haotian Zhang , Hui Su , Vincent Donnefort , stable@vger.kernel.org Subject: [for-linus][PATCH 1/7] tracing: Fix logged instance name on creation failure References: <20260827150949.304280511@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Vincent Donnefort When boot instance creation fails, the kernel incorrectly logs "(null)" as the instance name because strsep() consumes curr_str entirely during parsing. Print the properly parsed name variable instead. And while at it log the error code. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260807085423.4175161-1-vdonnefort@google.c= om Fixes: cb1f98c5e574 ("tracing: Add creation of instances at boot command li= ne") Acked-by: Masami Hiramatsu (Google) Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/trace.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 89dc1c0ebb90..740c5f358b75 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -9726,7 +9726,8 @@ __init static void enable_instances(void) =20 tr =3D trace_array_create_systems(name, NULL, addr, size); if (IS_ERR(tr)) { - pr_warn("Tracing: Failed to create instance buffer %s\n", curr_str); + pr_warn("Tracing: Failed to create instance buffer '%s' (%ld)\n", name, + PTR_ERR(tr)); continue; } =20 --=20 2.53.0 From nobody Mon Sep 28 01:56:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6CF49477995; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843365; cv=none; b=XwXIIFS9JZyWKAgrUuBnhc3Mke5OtokBbV52PO2FhEZhtX47sZlWuGRe7psXZxQ5lA6MO24LoKDgecFCx73S1d9VZRLp44CNzrSVRsnta0SFgtYYFQj0YAKKeSFrw1PKoFQ6EK2livtmAd7xhkr0de1IA9umvcXUrZl4vOww/E8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843365; c=relaxed/simple; bh=JPELbtqDwmev8QYHC4CJVOnU1QVGCPg6zDW7t3hN2BI=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=pO07s3q2HhDihoQOb4sm11/H2Pym8eW+ctYec1nEuzIyqR02DzHBr/YrVDq665dnGIND+6GPUsnZ8iheAVUEEqOtvjil26mI2YucXHC52mr/uMb8UUg2EGs9k8eM2vjKrgG1/8ec7ThoQZvbG//wLmuLgsDDp5euDLuuFXnyzww= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=M2dFF7+2; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="M2dFF7+2" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2AC9E1F00A3D; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787843363; bh=5EI51HQq89GNPsww2hRYcznaJIDs1nehxu0amxKuebQ=; h=Date:From:To:Cc:Subject:References; b=M2dFF7+2iJR3VaGO+VmUr/x0KYGvHzQJoodyYFFpjxLXMyCGdp9mwSSujt7AcoUAU +oR9HKyUGgBjdFcVlblHEydPKb/UTsspMbXPJKXpK+aOtgrJDN2STTtpfa33G1CSg6 hoJX/0dbLdT0tg7uwmcJpv4DdzQobI+0ieNG0cFenzYpYMNZRJgNG7bOF12oOHrH8N pVVPVcOKAs6mAWrO3NongioS+zSjQ3UvmJDd/YEt9OBP4nRZ2ecaiZFqm8RWVq8bn3 GhR4Dt6lvJM6YmwVQxkMiIKzsCjVOMDXZjptjJA8BOFn8rpHbc7iGLS2mPuG+GToV7 dILqDrtEaJMXA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wzbk3-00000008PF2-0E0v; Thu, 27 Aug 2026 11:10:11 -0400 Message-ID: <20260827151010.884247572@kernel.org> User-Agent: quilt/0.69 Date: Thu, 27 Aug 2026 11:09:51 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Deepanshu Kartikey , Haotian Zhang , Hui Su , Vincent Donnefort , stable@vger.kernel.org Subject: [for-linus][PATCH 2/7] tracing: Fix use-after-free with same-name named triggers References: <20260827150949.304280511@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Hui Su When two hist triggers on different events are registered with the same name=3D, the second one reuses the first as named_data. Both are added to tr->hist_vars by save_hist_vars() during event_hist_trigger_parse(), because save_hist_vars() is called before event_trigger_register() while the named reuse is only detected later, in hist_register_trigger(). In the named-data branch hist_register_trigger() then frees the second histogram's hist_data via destroy_hist_data(), but never removes its tr->hist_vars list entry, leaving a dangling pointer and leaking the trace_array reference it holds. A later hist trigger that references a variable makes find_var_file() walk tr->hist_vars and dereference the freed hist_data. The bug is reproducible from userspace by writing three hist triggers to tracefs: cd /sys/kernel/tracing echo 'hist:keys=3Dcommon_pid:x=3Dcommon_pid:name=3Dmh' > events/sched/sch= ed_switch/trigger echo 'hist:keys=3Dcommon_pid:x=3Dcommon_pid:name=3Dmh' > events/sched/sch= ed_process_fork/trigger echo 'hist:keys=3Dcommon_pid:vals=3D$x' > events/sched/sched_process_exit= /trigger The third write panics the kernel: BUG: KASAN: slab-use-after-free in find_var_file.part.0+0x272/0x290 Read of size 8 at addr ffff888001f8a0e0 by task sh/1 CPU: 1 UID: 0 PID: 1 Comm: sh Tainted: G D N Call Trace: find_var_file.part.0 find_event_var parse_atom parse_expr __create_val_field event_hist_trigger_parse trigger_process_regex event_trigger_write vfs_write ksys_write do_syscall_64 entry_SYSCALL_64_after_hwframe Allocated by task 1: event_hist_trigger_parse Freed by task 1: hist_register_trigger+0x618/0xa30 event_hist_trigger_parse The buggy address belongs to freed 2048-byte region Oops: general protection fault ... RIP: find_var_file.part.0 Kernel panic - not syncing: Attempted to kill init! exitcode=3D0x0000000b Fix by removing the hist_data from tr->hist_vars and releasing the trace_array reference in the named-data branch of hist_register_trigger() before freeing the hist_data. Cc: stable@vger.kernel.org Fixes: 6f86bdeab633 ("tracing: Fix bad hist from corrupting named_triggers = list") Link: https://patch.msgid.link/20260816100427.33642-3-sh_def@163.com Signed-off-by: Hui Su Signed-off-by: Steven Rostedt --- kernel/trace/trace_events_hist.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_h= ist.c index 893bd8b0e48a..963e0d6b61fd 100644 --- a/kernel/trace/trace_events_hist.c +++ b/kernel/trace/trace_events_hist.c @@ -6661,8 +6661,10 @@ static int hist_register_trigger(char *glob, tracing_set_filter_buffering(file->tr, true); } =20 - if (named_data) + if (named_data) { + remove_hist_vars(hist_data); destroy_hist_data(hist_data); + } out: return ret; } --=20 2.53.0 From nobody Mon Sep 28 01:56:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 94B9E483BD0; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843366; cv=none; b=mPaUvuwFFPwLIRxvKYrtVcpV8eRqVjRUTC9qFwvI//feduwwwvn0Rkq4e+jjQS7izeTjFmkYoHscAgH6I7044TVg0PrEdMzDkRqZ5YcMqukKmz18XzKdrtAOm+KMgoVsdS13tvCqYuFPlppDP8ufPD7Am1L0frN5CC+dQN+n8sM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843366; c=relaxed/simple; bh=kyz2dtWICwa7+Pyo/t4DfHeokFCJ25WI2pLckoWiW1c=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=JDjTcgg6En79GohHo0fC4qXdIfxzYp+QRaa4lp3YVGz2gk2Rj5RqY0Am4YdlxrILR1Fffvuuj2Vtn1G83RbyGoPE44Oc1kY7kjf2Daz02Q2xzITnVtzuir+ACnKIV0bD/ADA7CurHeZcQSWYW3+t1PAu9gbKhMuVUfr/MFi653s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=O+vYhec+; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="O+vYhec+" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 64BD01F00A3E; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787843363; bh=6/5YtY7kTxdIotP3/iaXXG+tvNSlRhJ1vz2QoNLsBNU=; h=Date:From:To:Cc:Subject:References; b=O+vYhec+QDe6tmChCFszDHwFHqr9pNe954APZp4RJhDTkUXBnJ33QHe+HCwKFcKhG ok86UbA/x1jGB/tnbCN3eqQMVuxWlkysy+IwfhHW7kGTaM6BfoTz0GFwOC+6yGcfyN 2lrTqxof0O1odZ7JuDKms9ofSp78XQv9MsRiknu62D/fpY61iy770LB7TtRL7yZXMB ZYi7LGoa/AocK3+CgyPLr5NB2YTwzfoVu2H5sj/mjDh98cMqvwbs98htz2W2jlYtRq gKfZ5baz0l+Xbe85JNhyWTNIeI6bqc/t8rEc4HIDiaM4fHJwrZkLXSXboZVzGGjpgg 7af/JEB2IHRWw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wzbk3-00000008PFW-0teQ; Thu, 27 Aug 2026 11:10:11 -0400 Message-ID: <20260827151011.069475087@kernel.org> User-Agent: quilt/0.69 Date: Thu, 27 Aug 2026 11:09:52 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Deepanshu Kartikey , Haotian Zhang , Hui Su , Vincent Donnefort , stable@vger.kernel.org Subject: [for-linus][PATCH 3/7] tracing: Fix crash passing ERR_PTR to kthread_stop() References: <20260827150949.304280511@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Hui Su event_test_stuff() calls kthread_run() and unconditionally passes the returned task_struct pointer to kthread_stop(). kthread_run() returns an error pointer such as ERR_PTR(-ENOMEM) when kthread creation fails, for example under memory pressure during the boot-time event self-test. kthread_stop() then dereferences the invalid pointer, crashing the kernel. Check the result of kthread_run() before passing it to kthread_stop(). Use WARN_ON() so that a failure to create the self-test thread does not go unnoticed, matching the ring-buffer self-test fix in commit 91542863abad ("ring-buffer: Fix crash passing ERR_PTR to kthread_stop()"). Cc: stable@vger.kernel.org Fixes: e6187007d6c3 ("tracing/events: add startup tests for events") Link: https://patch.msgid.link/20260817120642.668375-3-sh_def@163.com Signed-off-by: Hui Su Signed-off-by: Steven Rostedt --- kernel/trace/trace_events.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 9f8f2d02276c..1d39eaf6a0f7 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -5019,6 +5019,8 @@ static __init void event_test_stuff(void) struct task_struct *test_thread; =20 test_thread =3D kthread_run(event_test_thread, NULL, "test-events"); + if (WARN_ON(IS_ERR(test_thread))) + return; msleep(1); kthread_stop(test_thread); } --=20 2.53.0 From nobody Mon Sep 28 01:56:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 94271483BC0; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843365; cv=none; b=P7BFmadwPDWEp7Y4rvD4K/SAfnVLaP9vI6xslabs7QfFdXCZXJvmD04kzly1oNy4fgETKRxeav7bKQV8I1U627EUBAd8Bmzu6e4QGTkgWGov3HR+OEUV9GHjHNaE260RZ9bvV9THzERJw/2jAhI75Pqgudmik6ibSmnwszXRYA4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843365; c=relaxed/simple; bh=rE9ONnbb64DmnGnBJPTYkqY0J4giVPlIuQ5Z+fpA4+g=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=SL65XPJG76UUANvW22cMAISbpyFKO7nQFS0joPlrH4MhOw5dnYgPYCjFhCQfApXDtVrHnJaJ+Vvl0whYrzLArB9Ij58VQcx+YDgABqgi5O+N2aHwRHGNg0dbfRuO4a+XjZvSeyldKiNzs3s+33PSRys5WAhTSp66w+Ho9caTJxc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gkfPyTx9; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gkfPyTx9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 778EB1F00A3F; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787843363; bh=zyjyAs9XuohXcWHmBc/uGuYEOCdR4P0MDF3YsN/etfQ=; h=Date:From:To:Cc:Subject:References; b=gkfPyTx9Rm4YIxdb+n+U6v8o5UD4k//4Hjy2Unt5WkmBglKjo24E6DmZJmJLLILL1 Sst4R7kz0LpKU42qyItGkz3A27chHcP3LAGjBMuM1C/a5517wvVa99AqJnuoRRlBcL c4UH1Iie/gxhzxTCdqG+gKT0Ut3pEAhsuMt64upsqBGZU504mEro83FvprHeJTbeTw V2ROIXtIdxyN9XZ4HqsTMWUcHc5I8tm4pn/ZX7/06vq+hnzK4n6O6J4BGU+KBFiMLp FVcQ+hQjqBiq7+aovssRNC31XnmzAU2eRc//64cK5IjE18NA8wdbWHbGDhNcflR3kL TO+7+JhgosH/Q== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wzbk3-00000008PG0-1ZBc; Thu, 27 Aug 2026 11:10:11 -0400 Message-ID: <20260827151011.232932653@kernel.org> User-Agent: quilt/0.69 Date: Thu, 27 Aug 2026 11:09:53 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Deepanshu Kartikey , Haotian Zhang , Hui Su , Vincent Donnefort , stable@vger.kernel.org, syzbot+685955db58555575fdd2@syzkaller.appspotmail.com, Bradley Morgan Subject: [for-linus][PATCH 4/7] tracing: Fix use-after-free in trace_pipe read on sub-buffer order change References: <20260827150949.304280511@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Deepanshu Kartikey Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), which frees every sub-buffer of the ring buffer, including the reader page, and replaces them with newly allocated ones. Readers of trace_pipe hold pointers into those pages. ring_buffer_peek() looks up an event under cpu_buffer->reader_lock but returns the event pointer after dropping the lock, and peek_next_entry() then calls ring_buffer_event_length() and ring_buffer_event_data() on it. If the sub-buffer order is changed in that window, the reader dereferences freed memory: BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430 Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002 Freed by: free_buffer_page kernel/trace/ring_buffer.c:398 [inline] ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:74= 44 buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221 Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change. This is the lock trace_pipe readers already hold across their entire peek-and-print loop, so the swap can no longer race with a reader that is dereferencing a peeked event. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260817140655.5694-1-kartikey406@gmail.com Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page= ") Reported-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D685955db58555575fdd2 Tested-by: syzbot+685955db58555575fdd2@syzkaller.appspotmail.com Reviewed-by: Bradley Morgan Signed-off-by: Deepanshu Kartikey Signed-off-by: Steven Rostedt --- kernel/trace/trace.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 740c5f358b75..60c87977f1e3 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -8214,6 +8214,8 @@ buffer_subbuf_size_write(struct file *filp, const cha= r __user *ubuf, /* Do not allow tracing while changing the order of the ring buffer */ tracing_stop_tr(tr); =20 + trace_access_lock(RING_BUFFER_ALL_CPUS); + old_order =3D ring_buffer_subbuf_order_get(tr->array_buffer.buffer); if (old_order =3D=3D order) goto out; @@ -8253,6 +8255,7 @@ buffer_subbuf_size_write(struct file *filp, const cha= r __user *ubuf, #endif (*ppos)++; out: + trace_access_unlock(RING_BUFFER_ALL_CPUS); if (ret) cnt =3D ret; tracing_start_tr(tr); --=20 2.53.0 From nobody Mon Sep 28 01:56:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CFE3F483BD8; Thu, 27 Aug 2026 15:09:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843366; cv=none; b=qE368lZyAQiPXWqYQ+eoJqJvHICWtBBrcOWGMRXAIEl8BDYEYz9IiWLh+eXRRSXliiXci1C3e9qpG9fylQHYkgLfNvDC2egn3nCcSTuHKYRVn10PK2nK0qair9moz+hqAV5rfgdTPfPg/s1q2EkWB7qpcZAaxMwt3dMoPnSMjlU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843366; c=relaxed/simple; bh=3IpjydfBdKSdOv0gibALtpPNd7MBnOHOPknnrtM0Q3k=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=Vb0dU2zoCSm36FeVfigWSnSnQNt57fRm5YBBQxNrdmJP2iRc9h5NvMOY14QYjD4aMNvcSiLsIiIDqLxEmkQUHy9Sk6YvuhVLdf1aNISuk+4JWRkAUQxyLc9Ohx4+mGD/cEXFxAi24x+HiTbGMTF0Lu8l77+RkYBynpgrFHRGWS4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=LqqeF/iJ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="LqqeF/iJ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3ED61F00AC4; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787843363; bh=bKsi1VJGfYifc0X2FDO2ozZA/yp+juJv4gMOzdPOn4I=; h=Date:From:To:Cc:Subject:References; b=LqqeF/iJaW2SL6kaq5B7Gg5biJKDjXYb/ghEhhcbZFM5+6H0UxanehvkgQtGpQCiG LjLnSM40jhLWFFQ5kZRTR7eKHuQ2AlRFBdxZo4H8HqGT8WWNx7KKFpxNw+Usih8HGk kSMHVmtS+dnKXJMlmNJKTf7vfOeu3/ivWTSikmdLmDoVk9vJTxuen1JhyUum9nq422 ivkacrQeNfRb6xv/zqmwtnxBEIXcilnrnE29RsCeJeWIMIDB1w3tQF078lLGIrr7dD 3hA8DxIPlKJKDyolFPzTollsNXFR/vQbXVGUELUmfPOjZ1vnAW4PhuWVfbwMTCK5qm SmDoF+wTSspEA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wzbk3-00000008PGU-2ByI; Thu, 27 Aug 2026 11:10:11 -0400 Message-ID: <20260827151011.389282397@kernel.org> User-Agent: quilt/0.69 Date: Thu, 27 Aug 2026 11:09:54 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Deepanshu Kartikey , Haotian Zhang , Hui Su , Vincent Donnefort , stable@vger.kernel.org, syzbot+3ef80b4ed02226d04a06@syzkaller.appspotmail.com Subject: [for-linus][PATCH 5/7] eventfs: Initialize ei->children and ei->list in init_ei() References: <20260827150949.304280511@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Deepanshu Kartikey eventfs_create_dir() allocates the eventfs_inode and initializes it with init_ei(). But this does not initialize the eventfs_inode list_heads. If the eventfs_create_dir() fails due to memory pressure, it will call free_ei() before it initialized the lists, and that checks to make sure the eventfs_inode has no children. But because the list wasn't initialized, it will give a false warning. Fix it by moving the list initialization into init_ei(). Cc: stable@vger.kernel.org Fixes: 5790b1fb3d67 ("eventfs: Remove eventfs_file and just use eventfs_ino= de") Reported-by: syzbot+3ef80b4ed02226d04a06@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3D3ef80b4ed02226d04a06 Link: https://patch.msgid.link/20260824144653.54044-1-kartikey406@gmail.com Signed-off-by: Deepanshu Kartikey [ Rewrote change log ] Signed-off-by: Steven Rostedt --- fs/tracefs/event_inode.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/fs/tracefs/event_inode.c b/fs/tracefs/event_inode.c index 604ba3e841d2..6e3513b13cfa 100644 --- a/fs/tracefs/event_inode.c +++ b/fs/tracefs/event_inode.c @@ -438,6 +438,8 @@ static inline struct eventfs_inode *init_ei(struct even= tfs_inode *ei, const char if (!ei->name) return NULL; kref_init(&ei->kref); + INIT_LIST_HEAD(&ei->children); + INIT_LIST_HEAD(&ei->list); return ei; } =20 @@ -729,8 +731,6 @@ struct eventfs_inode *eventfs_create_dir(const char *na= me, struct eventfs_inode ei->entries =3D entries; ei->nr_entries =3D size; ei->data =3D data; - INIT_LIST_HEAD(&ei->children); - INIT_LIST_HEAD(&ei->list); =20 scoped_guard(mutex, &eventfs_mutex) { if (!parent->is_freed) @@ -802,9 +802,6 @@ struct eventfs_inode *eventfs_create_events_dir(const c= har *name, struct dentry ei->attr.uid =3D uid; ei->attr.gid =3D gid; =20 - INIT_LIST_HEAD(&ei->children); - INIT_LIST_HEAD(&ei->list); - ti =3D get_tracefs(inode); ti->flags |=3D TRACEFS_EVENT_INODE; ti->private =3D ei; --=20 2.53.0 From nobody Mon Sep 28 01:56:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CFF12483BDE for ; Thu, 27 Aug 2026 15:09:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843366; cv=none; b=Xoq1PzAR7Xrww7T40Z0DP2ow+MHd+dN6aU2NS9FRRXKRnHQ/2okSP5+4fkx2KPqIyoxzsI2zDsCOeuCc+LS8mxx4W74Diw/4qA5DvLF4rmnEUNNRTOKrg+9Dhp+PxxBPscfvquoQaia5/CURnJqXszdw7VfRG1k8IZm3p0oKXws= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843366; c=relaxed/simple; bh=THvfUMg5TbfzBxeyN4QirCFqOs9S7SFIChRddP64VeM=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=dTIcRFjJv89ZKJ4r2/BPbw7uwQGcKL6zdsODhFTWPOD0QADvybGVPtoS7nnEfeLywfWfrFcJ+osU6g8eH3DYGcvXRyjzrj2eEwKIzXHpMybKkS/moL8BVMEo6KjV0sRO9Kaw+WVX8nhqpk4bOBtuxTVcmJIRqfCwxGQZrG1hqLM= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=l3Xc6vnv; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="l3Xc6vnv" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D6DC41F00ACA; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787843363; bh=OoOb25/cKzKtyIcy2W/62Wt5IvtdO4qR8/ih5HeWboY=; h=Date:From:To:Cc:Subject:References; b=l3Xc6vnvOOfGj26hVfx232SQZA/YZYTqqyRxpt1Bn3+V65oE5hkIk8Cpedkm+gPhN n4wG7gZvBxrUpranFA2Ftrq8nAsqJx9gyLznnKuzp2dO5pR+1a3SQzJ/FuQqCUwOxm wRvJyZPZhqakZN0+/6WeqwmAL9ZmFQXUG7Vn05rSRmDcRIOyTyIAoOg/DmeQ+K7ld8 ldlNy39C7slc+HhD9NjSU/CE/wumj1fALa8MWGdtg+oJJCRiduh1QP6a/NDwXgznJ2 uScUv0i+u7/BOOM1UXpgX3yvQZfejsBwktSTSmlCPvP2TPIHsH/tvRtmdWVQ0EIP21 pyLCspLJTNEcw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wzbk3-00000008PGy-2onS; Thu, 27 Aug 2026 11:10:11 -0400 Message-ID: <20260827151011.539857810@kernel.org> User-Agent: quilt/0.69 Date: Thu, 27 Aug 2026 11:09:55 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Deepanshu Kartikey , Haotian Zhang , Hui Su , Vincent Donnefort Subject: [for-linus][PATCH 6/7] samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-modify References: <20260827150949.304280511@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Haotian Zhang ftrace_direct_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_exit() then passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference. Check the return value of kthread_run() with IS_ERR(); on failure, unregister the ftrace direct call and propagate the error code. Link: https://patch.msgid.link/20260826015034.10755-1-vulab@iscas.ac.cn Fixes: ae0cc3b7e7f5 ("ftrace/samples: Add a sample module that implements m= odify_ftrace_direct()") Suggested-by: Steven Rostedt Signed-off-by: Haotian Zhang Signed-off-by: Steven Rostedt --- samples/ftrace/ftrace-direct-modify.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/samples/ftrace/ftrace-direct-modify.c b/samples/ftrace/ftrace-= direct-modify.c index 1ba1927b548e..164d9dd6fd92 100644 --- a/samples/ftrace/ftrace-direct-modify.c +++ b/samples/ftrace/ftrace-direct-modify.c @@ -320,9 +320,15 @@ static int __init ftrace_direct_init(void) ftrace_set_filter_ip(&direct, (unsigned long) my_ip, 0, 0); ret =3D register_ftrace_direct(&direct, my_tramp); =20 - if (!ret) - simple_tsk =3D kthread_run(simple_thread, NULL, "event-sample-fn"); - return ret; + if (ret) + return ret; + simple_tsk =3D kthread_run(simple_thread, NULL, "event-sample-fn"); + if (IS_ERR(simple_tsk)) { + unregister_ftrace_direct(&direct, my_tramp, true); + return PTR_ERR(simple_tsk); + } + + return 0; } =20 static void __exit ftrace_direct_exit(void) --=20 2.53.0 From nobody Mon Sep 28 01:56:28 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 36DF4483BFF for ; Thu, 27 Aug 2026 15:09:25 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843366; cv=none; b=L63VxuRmVt39gh4ew7M15Po+gJbzbbFT1NOZp2Zc+cUl1d/JKaxWyDaXliWGgdr+bZp2Ux1dxI+ztViXrDKWVMEdi3uJ6HzCn6hPozKqTnmjTDVe8xqNsaggCJk7w7HtXIc8Jtm4xYDkWRif8XDy9eFrbjZQkcH1NeeBWtH5biM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1787843366; c=relaxed/simple; bh=/F6DF9N6aI26k2SDHGgLnmmPKxBwn4ZVAH11GI8tveE=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=dUyWCyRYjRYtq6m6lydqIjPAQyKOieNta3lE+2AQu5k8fAZjuzoP+a3A2ewtKHmOH1KA5a8DmqdTCdVJRryDy82v+Iz6LdJ6UbiCi+KZsqR2UKNaLLJq31CCvBKLHeTWH6FxDExAOSCWiWIlgcAzAPuX5CULr0nosawy84bpDSE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=aVwm26yt; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="aVwm26yt" Received: by smtp.kernel.org (Postfix) with ESMTPSA id DF1201F00ACF; Thu, 27 Aug 2026 15:09:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1787843363; bh=b9FCRmxqVb1GJL/GzWj6/s/4yvGvvUOtw/dfPPgDqJ0=; h=Date:From:To:Cc:Subject:References; b=aVwm26ytG5vCtBjhbP4WGCbepn+mVciOnp2gejjpx6ib2uCPVtzharPqBH9i9pEFm BYMKUanTVW6sq7JptmoDDatIiEtfUlrNzd+SliMzLv0HYawdYrgwTNXt1k9rfFE6Dm K3iGT4SMJfnv7plQZdCFugOKWw5oXgWOEtw/VnMz7vAuGvdkYYXsGl2khUIfLP4q1W 2yUuadg0FZnHsSjd0ZeE6czeus0mcNQusV0+fSJGqlRPQ++r8pN5+0Qql942U/9iTB agVa5yPJqIkKs/gZH5gW4umb8Gv0bhoDbSnlaq8SiJr3tMKaaMgaVRNr62CS1+qCv0 tZgbyRCp20oIQ== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1wzbk3-00000008PHU-3RVF; Thu, 27 Aug 2026 11:10:11 -0400 Message-ID: <20260827151011.689123441@kernel.org> User-Agent: quilt/0.69 Date: Thu, 27 Aug 2026 11:09:56 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Deepanshu Kartikey , Haotian Zhang , Hui Su , Vincent Donnefort Subject: [for-linus][PATCH 7/7] samples/ftrace: Fix kthread_stop() on ERR_PTR in ftrace-direct-multi-modify References: <20260827150949.304280511@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Haotian Zhang ftrace_direct_multi_init() assigns kthread_run()'s return value to simple_tsk without an IS_ERR() check. When kthread_run() fails it returns ERR_PTR(-ENOMEM), but init still returns 0, so the module loads with simple_tsk holding an error pointer. On unload, ftrace_direct_multi_exit() then passes that ERR_PTR to kthread_stop(), leading to a null-pointer-dereference. Check the return value of kthread_run() with IS_ERR(); on failure, unregister the ftrace direct call and propagate the error code. Link: https://patch.msgid.link/20260826015050.10772-1-vulab@iscas.ac.cn Fixes: e1067a07cfbc ("ftrace/samples: Add module to test multi direct modif= y interface") Suggested-by: Steven Rostedt Signed-off-by: Haotian Zhang Signed-off-by: Steven Rostedt --- samples/ftrace/ftrace-direct-multi-modify.c | 12 +++++++++--- 1 file changed, 9 insertions(+), 3 deletions(-) diff --git a/samples/ftrace/ftrace-direct-multi-modify.c b/samples/ftrace/f= trace-direct-multi-modify.c index 7a7822dfeb50..b03766c6217b 100644 --- a/samples/ftrace/ftrace-direct-multi-modify.c +++ b/samples/ftrace/ftrace-direct-multi-modify.c @@ -364,9 +364,15 @@ static int __init ftrace_direct_multi_init(void) =20 ret =3D register_ftrace_direct(&direct, my_tramp); =20 - if (!ret) - simple_tsk =3D kthread_run(simple_thread, NULL, "event-sample-fn"); - return ret; + if (ret) + return ret; + simple_tsk =3D kthread_run(simple_thread, NULL, "event-sample-fn"); + if (IS_ERR(simple_tsk)) { + unregister_ftrace_direct(&direct, my_tramp, true); + return PTR_ERR(simple_tsk); + } + + return 0; } =20 static void __exit ftrace_direct_multi_exit(void) --=20 2.53.0