From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D706933A6EB; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659150; cv=none; b=YF1K7mZBtTthScpysgd8MnOF1UjsXTrE+DG/UlyoTcX2IQdXb7MJJ6bW//OCKnUWZlmlN/fbonaLgj/WzaIXS0xdvhSe5lwJAO9rv/eSGPdLerJHCkPvCsykd4ebzgBMRCzSG+0OaPBBvrbx4l+KynzhGFbrTZsymG0Ltzl88Bo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659150; c=relaxed/simple; bh=CB3IZDvKjhzxpQfenh3OJm8qxNZ8dN3oksgefFj5X7c=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=MvR4se7jVHy2NgsjJXqx70QTySgWzi9tea9sJlekLHW/8qglLLcZrYkmTU2x3sCE11v61giiW7VjqYVsjyTEulqPeF+2414MtA8NgXtFJa0LFh62lYknvMuZuOGWWOyp3j3eOr4pP9S6jqYPOYydE6ZhSn++KvMUVb0M1e+Owng= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=hBBDJga5; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="hBBDJga5" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 767161F00A3E; Sun, 6 Sep 2026 01:45:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659146; bh=uD0iVatw9o5KBLCWHhBsA7JNpLY36dD/rxu/pUX9iOA=; h=Date:From:To:Cc:Subject:References; b=hBBDJga5jjJqyMEIiEgsPDP0zt4VpelSQC/T7UVGG5jMcSxmO5f6vHlgKgPkgyXsN zz3NRS5Pn+UwZXCatfPY51/ZsxUTmnvXRQ20ervwBkXbSagxjuezwpcNqEyPuoZqlz YEFuUneVe6UyDfLcVwzlK9G1OBw5k3aQnZE16pQ8szTdHQvIs0c6tsg1LAL5FzI7mH FfV1XWRTpOMV+kifqg3K+Or5DM3dKTtgu187Nus0WzWOxEDa3A8NqeWdtrgT1gT9cZ lLcLA07xajfozeOxeAJgfxcxJFzPQAHYdlI3mt0ZLVnXB0zB18DaVPAlCdtYKsWziC IZFmu3Jj5crtA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yB-00000006PNh-1Zlv; Sat, 05 Sep 2026 21:46:55 -0400 Message-ID: <20260906014655.222422380@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:32 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort , stable@vger.kernel.org, Farhad Alemi , Aaron Tomlin Subject: [for-linus][PATCH 01/12] tracing: Have show_event_filters/triggers files take trace array ref References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt The newly added files show_event_filters and show_event_triggers that show all filters or triggers that are set within the trace array do not take a reference for the trace array it is showing. Without taking a reference, the trace_array may be freed via "rmdir" while a task is reading one of theses files. Those files iterate all the events within an instance (trace_array) and nothing prevents that instance from being freed while its data is being read. This causes a use-after-free crash. Have the open of both those files take the trace_array reference via the trace_array_get() that prevents the trace_array from being freed while the files are opened. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260828094153.17b95037@gandalf.local.home Fixes: 729757b96a662 ("tracing: Add show_event_filters to expose active eve= nt filters") Fixes: 6a80838814eea ("tracing: Add show_event_triggers to expose active ev= ent triggers") Reported-by: Farhad Alemi Closes: https://lore.kernel.org/all/CA+0ovCjerKZJLwXScM9bF2ga2rLi4_XOpUfK41= NDbENpeu98jA@mail.gmail.com/ Reviewed-by: Aaron Tomlin Signed-off-by: Steven Rostedt --- kernel/trace/trace_events.c | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c index 1d39eaf6a0f7..9dbc2441763b 100644 --- a/kernel/trace/trace_events.c +++ b/kernel/trace/trace_events.c @@ -2736,14 +2736,14 @@ static const struct file_operations ftrace_show_eve= nt_filters_fops =3D { .open =3D ftrace_event_show_filters_open, .read =3D seq_read, .llseek =3D seq_lseek, - .release =3D seq_release, + .release =3D ftrace_event_release, }; =20 static const struct file_operations ftrace_show_event_triggers_fops =3D { .open =3D ftrace_event_show_triggers_open, .read =3D seq_read, .llseek =3D seq_lseek, - .release =3D seq_release, + .release =3D ftrace_event_release, }; =20 static const struct file_operations ftrace_set_event_pid_fops =3D { @@ -2908,7 +2908,17 @@ ftrace_event_set_open(struct inode *inode, struct fi= le *file) static int ftrace_event_show_filters_open(struct inode *inode, struct file *file) { - return ftrace_event_open(inode, file, &show_show_event_filters_seq_ops); + struct trace_array *tr =3D inode->i_private; + int ret; + + ret =3D tracing_check_open_get_tr(tr); + if (ret) + return ret; + + ret =3D ftrace_event_open(inode, file, &show_show_event_filters_seq_ops); + if (ret < 0) + trace_array_put(tr); + return ret; } =20 /** @@ -2922,7 +2932,17 @@ ftrace_event_show_filters_open(struct inode *inode, = struct file *file) static int ftrace_event_show_triggers_open(struct inode *inode, struct file *file) { - return ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops); + struct trace_array *tr =3D inode->i_private; + int ret; + + ret =3D tracing_check_open_get_tr(tr); + if (ret) + return ret; + + ret =3D ftrace_event_open(inode, file, &show_show_event_triggers_seq_ops); + if (ret < 0) + trace_array_put(tr); + return ret; } =20 static int --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D6C93339360; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659150; cv=none; b=o4nmcS+ZtfOzChEKTl4ED4CNRAhW5bhAhwLgUgaPBMPuvqm/6fnUMjXqrwzuS+FwOSsuYIaMFUOsesmSBnlHpqrUtXX1i9jFp8kcVCc6ggenqSj5pVM8CVhHzc6UObu4KpUD/iXuyLT67zRGwLwKleAsShBwk+p5GIYSiUp6EKE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659150; c=relaxed/simple; bh=C/nmJqIpj9Qo37/aXuKCkckjdqnuKl5TtqMJGfAZ+xQ=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=qR5irosOVj/Tk60jXOqbcvM6g4gdFkQn3XXBdTNy6A2DMfvvyzvD7iO3jzFDWO3GmP0MSiwU+JENWO2NWL5ySQswlTcS8amqR2BGTo8Hf41smeFR6KTEGnwTTaTfKPu4cZaw2cDg1hFAzyt5BvPaaXlGuvzhjoJ8lMENQYFdqhY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=RLM3gb75; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="RLM3gb75" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BB24E1F00A3D; Sun, 6 Sep 2026 01:45:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659146; bh=1YUfvz1vxFFyEzl/5JjQa4kmCbP460iPGSkmlkg4LKw=; h=Date:From:To:Cc:Subject:References; b=RLM3gb75wzxVOTSCnMP+qtU5rsiimXs8pYQr1Whjn4irfmDhddu2ECi0I803xPY5b ZTNMWJE5C/Ml+FZkJK5kNE/6v/aQo+lWhJaeYAfrg4mmodaDAj0NR96rCmNqujiFz6 B+SOoJfHakTD2u8In3mBd/I8noWyTzDlFOlYU7kmsETMXbm6Kx8iLFYONaqbBoXukj iXXxKVaCo/WdOgWZta7VaaGFnAdufrO5s6J0YAejqcT5aR1ViwRohRVYCljQhtJGW/ DyhH8rNhhpWJ5QymaXiPsJuaeBxlc7J0LhP6nwnKXuzf7w6Y5SZnuWWZo2q162pzcY 2JOKQ6eltmvpw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yB-00000006POB-2K8D; Sat, 05 Sep 2026 21:46:55 -0400 Message-ID: <20260906014655.400756978@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:33 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort , stable@vger.kernel.org, Breno Leitao Subject: [for-linus][PATCH 02/12] ftrace: Take trace_array reference before accessing its ftrace_ops References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt The trace instance files set_ftrace_filter and set_ftrace_notrace was updated to work with specific trace instances (trace_arrays). The issue is that when these files are opened, there is a small race window where it will use the ftrace_ops from the inode->private pointer to get a reference to the trace_array and then take its reference. The problem is that the ftrace_ops itself could be freed. If the rmdir on the instance happens at the same time the set_ftrace_filter file is opened, the rmdir could have also freed the ftrace_ops and referencing it will cause a use-after-free bug and crash the kernel. Instead, pass in the trace_array as the file private data (NULL for the top level instance), and then pass both the trace_array and the ftrace_ops to the ftrace_regex_open() function. If the trace_array is NULL, then it just uses the ftrace_ops without the need to take its reference (like normal). If the ftrace_ops is NULL, that is only the case for the top level instance and the global_ops can be used. This allows the trace_array to have its reference incremented before touching the ftrace_ops that could also be freed when the instance is. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260828223901.29e26edb@robin Fixes: 591dffdade9f0 ("ftrace: Allow for function tracing instance to filte= r functions") Reported-by: Breno Leitao Tested-by: Breno Leitao Closes: https://lore.kernel.org/all/apGORjltZgAiAYHT@gmail.com/ Signed-off-by: Steven Rostedt --- include/linux/ftrace.h | 5 +-- kernel/trace/ftrace.c | 57 ++++++++++++++++++++++------------ kernel/trace/trace.h | 5 +-- kernel/trace/trace_functions.c | 2 +- kernel/trace/trace_stack.c | 2 +- 5 files changed, 45 insertions(+), 26 deletions(-) diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h index 02bc5027523a..bd76a16a63af 100644 --- a/include/linux/ftrace.h +++ b/include/linux/ftrace.h @@ -866,8 +866,9 @@ unsigned long ftrace_get_addr_new(struct dyn_ftrace *re= c); unsigned long ftrace_get_addr_curr(struct dyn_ftrace *rec); =20 extern ftrace_func_t ftrace_trace_function; +struct trace_array; =20 -int ftrace_regex_open(struct ftrace_ops *ops, int flag, +int ftrace_regex_open(struct trace_array *tr, struct ftrace_ops *ops, int = flag, struct inode *inode, struct file *file); ssize_t ftrace_filter_write(struct file *file, const char __user *ubuf, size_t cnt, loff_t *ppos); @@ -1077,7 +1078,7 @@ static inline unsigned long ftrace_location(unsigned = long ip) * have them defined when ftrace is not enabled, but these * functions may still be called. Use a macro instead of inline. */ -#define ftrace_regex_open(ops, flag, inod, file) ({ -ENODEV; }) +#define ftrace_regex_open(tr, ops, flag, inode, file) ({ -ENODEV; }) #define ftrace_set_early_filter(ops, buf, enable) do { } while (0) #define ftrace_set_filter_ip(ops, ip, remove, reset) ({ -ENODEV; }) #define ftrace_set_filter_ips(ops, ips, cnt, remove, reset) ({ -ENODEV; }) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index f9d80c7bd9f1..c7cf36f2dd7b 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -4677,7 +4677,8 @@ ftrace_avail_addrs_open(struct inode *inode, struct f= ile *file) =20 /** * ftrace_regex_open - initialize function tracer filter files - * @ops: The ftrace_ops that hold the hash filters + * @tr: The trace_array that holds the ftrace_ops [optional] + * @ops: The ftrace_ops that hold the hash filters [optional] * @flag: The type of filter to process * @inode: The inode, usually passed in to your open routine * @file: The file, usually passed in to your open routine @@ -4691,26 +4692,45 @@ ftrace_avail_addrs_open(struct inode *inode, struct= file *file) * tracing_lseek() should be used as the lseek routine, and * release must call ftrace_regex_release(). * + * Note, If @tr is not NULL, its reference has to be taken before + * @ops may be referenced. + * If @ops is NULL and @tr is not, then @tr->ops is used. + * If @tr is NULL and @ops is not then @ops->private is uesd for @tr. + * If both @tr and @ops are NULL, then the &global_ops is + * to be used, and @tr will be the global_ops.private pointer. + * * Returns: 0 on success or a negative errno value on failure */ int -ftrace_regex_open(struct ftrace_ops *ops, int flag, +ftrace_regex_open(struct trace_array *tr, struct ftrace_ops *ops, int flag, struct inode *inode, struct file *file) { - struct ftrace_iterator *iter; + struct ftrace_iterator *iter =3D NULL; struct ftrace_hash *hash; struct list_head *mod_head; - struct trace_array *tr =3D ops->private; - int ret =3D -ENOMEM; - - ftrace_ops_init(ops); + int ret =3D -ENODEV; =20 if (unlikely(ftrace_disabled)) return -ENODEV; =20 + if (!tr) { + if (!ops) + ops =3D &global_ops; + tr =3D ops->private; + } + if (tracing_check_open_get_tr(tr)) return -ENODEV; =20 + if (!ops) + ops =3D tr->ops; + + if (WARN_ON_ONCE(!ops)) + goto out; + + ftrace_ops_init(ops); + + ret =3D -ENOMEM; iter =3D kzalloc_obj(*iter); if (!iter) goto out; @@ -4788,21 +4808,19 @@ ftrace_regex_open(struct ftrace_ops *ops, int flag, static int ftrace_filter_open(struct inode *inode, struct file *file) { - struct ftrace_ops *ops =3D inode->i_private; + struct trace_array *tr =3D inode->i_private; =20 - /* Checks for tracefs lockdown */ - return ftrace_regex_open(ops, - FTRACE_ITER_FILTER | FTRACE_ITER_DO_PROBES, - inode, file); + return ftrace_regex_open(tr, NULL, + FTRACE_ITER_FILTER | FTRACE_ITER_DO_PROBES, + inode, file); } =20 static int ftrace_notrace_open(struct inode *inode, struct file *file) { - struct ftrace_ops *ops =3D inode->i_private; + struct trace_array *tr =3D inode->i_private; =20 - /* Checks for tracefs lockdown */ - return ftrace_regex_open(ops, FTRACE_ITER_NOTRACE, + return ftrace_regex_open(tr, NULL, FTRACE_ITER_NOTRACE, inode, file); } =20 @@ -7492,15 +7510,15 @@ static const struct file_operations ftrace_graph_no= trace_fops =3D { }; #endif /* CONFIG_FUNCTION_GRAPH_TRACER */ =20 -void ftrace_create_filter_files(struct ftrace_ops *ops, +void ftrace_create_filter_files(struct trace_array *tr, struct dentry *parent) { =20 trace_create_file("set_ftrace_filter", TRACE_MODE_WRITE, parent, - ops, &ftrace_filter_fops); + tr, &ftrace_filter_fops); =20 trace_create_file("set_ftrace_notrace", TRACE_MODE_WRITE, parent, - ops, &ftrace_notrace_fops); + tr, &ftrace_notrace_fops); } =20 /* @@ -7525,7 +7543,6 @@ void ftrace_destroy_filter_files(struct ftrace_ops *o= ps) =20 static __init int ftrace_init_dyn_tracefs(struct dentry *d_tracer) { - trace_create_file("available_filter_functions", TRACE_MODE_READ, d_tracer, NULL, &ftrace_avail_fops); =20 @@ -7538,7 +7555,7 @@ static __init int ftrace_init_dyn_tracefs(struct dent= ry *d_tracer) trace_create_file("touched_functions", TRACE_MODE_READ, d_tracer, NULL, &ftrace_touched_fops); =20 - ftrace_create_filter_files(&global_ops, d_tracer); + ftrace_create_filter_files(NULL, d_tracer); =20 #ifdef CONFIG_FUNCTION_GRAPH_TRACER trace_create_file("set_graph_function", TRACE_MODE_WRITE, d_tracer, diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 74a7a50d1e78..3c111ca88e32 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -1340,7 +1340,7 @@ extern void clear_ftrace_function_probes(struct trace= _array *tr); int register_ftrace_command(struct ftrace_func_command *cmd); int unregister_ftrace_command(struct ftrace_func_command *cmd); =20 -void ftrace_create_filter_files(struct ftrace_ops *ops, +void ftrace_create_filter_files(struct trace_array *tr, struct dentry *parent); void ftrace_destroy_filter_files(struct ftrace_ops *ops); =20 @@ -1363,11 +1363,12 @@ static inline void clear_ftrace_function_probes(str= uct trace_array *tr) { } =20 +static inline void ftrace_create_filter_files(struct trace_array *tr, + struct dentry *parent) { } /* * The ops parameter passed in is usually undefined. * This must be a macro. */ -#define ftrace_create_filter_files(ops, parent) do { } while (0) #define ftrace_destroy_filter_files(ops) do { } while (0) #endif /* CONFIG_FUNCTION_TRACER && CONFIG_DYNAMIC_FTRACE */ =20 diff --git a/kernel/trace/trace_functions.c b/kernel/trace/trace_functions.c index cd37f2013758..c879d43a5fbb 100644 --- a/kernel/trace/trace_functions.c +++ b/kernel/trace/trace_functions.c @@ -101,7 +101,7 @@ int ftrace_create_function_files(struct trace_array *tr, return ret; } =20 - ftrace_create_filter_files(tr->ops, parent); + ftrace_create_filter_files(tr, parent); =20 return 0; } diff --git a/kernel/trace/trace_stack.c b/kernel/trace/trace_stack.c index 0aa2514a6593..e7f4e523587d 100644 --- a/kernel/trace/trace_stack.c +++ b/kernel/trace/trace_stack.c @@ -499,7 +499,7 @@ stack_trace_filter_open(struct inode *inode, struct fil= e *file) struct ftrace_ops *ops =3D inode->i_private; =20 /* Checks for tracefs lockdown */ - return ftrace_regex_open(ops, FTRACE_ITER_FILTER, + return ftrace_regex_open(NULL, ops, FTRACE_ITER_FILTER, inode, file); } =20 --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D79D533ADB3; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659150; cv=none; b=T2F2EABgx/f1jhRrB74TOiNWI8xbffJpUEqDLs2cUHNyoozX5yC3vwxXKPWB2toDdMEQrQ+hNe3ELHIvk93rTOodW5WwANpaOhx0hdLxQIZLC6br1kGftc2yo2imMQLh8DXPVFRYtS7c3OsUmPk1jQb6c+smGiKwVNAAHFXNGHE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659150; c=relaxed/simple; bh=KpL3Y5PEKdflnZITTtl3R8Jts6F89kSv5DxuB5B3psQ=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=TLVgyCi+erRZ2PlrZmNL/DfcmayTtCIC3rQYyR2qs2L2otad0PAG8UYCs2pLmPanY/F9oOQ4KpHsRWarS4jFKrtnIFqJMM9MNK0gz7XmqUL7T3aZa75Uf/yV5PK/rPzEeYeQlOt7nzXHmtXDHMngQpVWuI6+tRbOCSPBRw/h6gw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Vh5J4n99; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Vh5J4n99" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE95F1F00A3F; Sun, 6 Sep 2026 01:45:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659146; bh=mJLEZSIIo7/+3swM0NPSAFKKDshxwBAUalNJtrrZRZ0=; h=Date:From:To:Cc:Subject:References; b=Vh5J4n99SZuOIOcWDDRf8N5bYtbt8eYgZ6VHzJgQpT2cvvju4/JHk80BPHjNPllXE sha7TKj//7WNOBnOnf9htZ396arx80pUpE3PkjX3uoOVjDMEqRNz3Pz36ZnQM3JDTy /t7pY2D+riwRcb2TqXKjVGOLwbbHKYVJDG0/DTxfdxDSJZYYnPCUS6QArQjs6pa8m8 1i04BIlozYfQtSZjdLGAvdOD0b2JvXDJul5AGOosoWEVZFWY7d6bblmakzFNw7Q16E 2dHEjeYsXGAi+YMfW5zSprV4Gv7ju3HWRXH7F1uq6ah8ndVGUqrecSByJ6j262tKry 2V+0Hbfm7afsw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yB-00000006POf-31NE; Sat, 05 Sep 2026 21:46:55 -0400 Message-ID: <20260906014655.571889474@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:34 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort , stable@vger.kernel.org, sashiko-bot@kernel.org Subject: [for-linus][PATCH 03/12] ftrace: Synchronize the initialization of ftrace_ops References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt There's some internal state that ftrace_ops needs to have set, but since it can be declared outside of the ftrace.c code, it calls ftrace_ops_init() on the ops in every global function. The issue is that if two tasks call it on the same ops at the same time it is possible to have the initialization of one corrupt the initialization of the other call. Create a ops_mutex to use to synchronize every initialization of the ftrace_ops. The mutex is taken within checking the ftrace_ops flag that states it was initializied but the flag is checked again after the mutex has been taken. Checking first outside the mutex allows it to shortcut having to take the mutex. But then the check needs to be done again after the mute is taken in case of races. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260902095501.6b59af20@gandalf.local.home Fixes: f04f24fb7e48d ("ftrace, kprobes: Fix a deadlock on ftrace_regex_lock= ") Reported-by: sashiko-bot@kernel.org Close: https://lore.kernel.org/all/20260829025528.49A831F000E9@smtp.kernel.= org/ Signed-off-by: Steven Rostedt --- kernel/trace/ftrace.c | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index c7cf36f2dd7b..53d5db60bfa5 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -75,6 +75,8 @@ .func_hash =3D &opsname.local_hash, \ .local_hash.regex_lock =3D __MUTEX_INITIALIZER(opsname.local_hash.regex_l= ock), \ .subop_list =3D LIST_HEAD_INIT(opsname.subop_list), +/* Used only to synchronize the initialization of ftrace_ops */ +static DEFINE_MUTEX(ops_mutex); #else #define INIT_OPS_HASH(opsname) #endif @@ -159,11 +161,18 @@ const struct ftrace_ops ftrace_nop_ops =3D { static inline void ftrace_ops_init(struct ftrace_ops *ops) { #ifdef CONFIG_DYNAMIC_FTRACE - if (!(ops->flags & FTRACE_OPS_FL_INITIALIZED)) { + unsigned long flags =3D smp_load_acquire(&ops->flags); + + if (!(flags & FTRACE_OPS_FL_INITIALIZED)) { + guard(mutex)(&ops_mutex); + /* Could have been initialized before lock taken */ + if (unlikely(ops->flags & FTRACE_OPS_FL_INITIALIZED)) + return; mutex_init(&ops->local_hash.regex_lock); INIT_LIST_HEAD(&ops->subop_list); ops->func_hash =3D &ops->local_hash; - ops->flags |=3D FTRACE_OPS_FL_INITIALIZED; + flags =3D ops->flags | FTRACE_OPS_FL_INITIALIZED; + smp_store_release(&ops->flags, flags); } #endif } --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5261833B6DA; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659151; cv=none; b=MLB97btc5KQwaHGuJFIyBz2RH82ilrwFYlKRAY3u1KtEPyeIcwSH9F2U6Vu8BSNs2BU9sF5MGGfYfQH0VzAgqfKhHnvU7N0nsBbi/X7B0Kug4QRRnia1+OVPpGSSW7QAngEZ2OwJu4TJal7lOymB8R63LDwpxMu4jpA4HDuCqrM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659151; c=relaxed/simple; bh=Qhe8iKJL1KONTtWn+bZJUW9hzqDn7ddhvHht6YcFZAQ=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=fWxPp0vF97HidktO/B8Ri1dnrfwACC4NNyPTmJiEGp1k28001iEbAMc39NHW+drgky7/RsI/FbjaQpzxc+etlgOxE33hExVCQ/8XPfaNclXiaBOIr1OVKW4axL2oQYrohnchC1u426CjxjownNNHuqrHO+O7P8WZTxMsxCp/KAk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=K8OfkdAu; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="K8OfkdAu" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EE95C1F00AC4; Sun, 6 Sep 2026 01:45:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659147; bh=VE72MNcUzceeZKE8KO67OwSgR318FFvhmYWi2dpqdhY=; h=Date:From:To:Cc:Subject:References; b=K8OfkdAu+fqwXPGbMkaApPLQU9Cc1a5cWRQESrw6W6GceJgrYgKV+nL2GHyZJcawL VReKoPVUeVcThhI4swVYqn6SGi9C1+hIUUag3O/bHv5kzJ+W+hsV81ZC4iZ8DiGmiD m/s+4xuK6LLAHjVjib8KCGHByOxG+aMcPhNODyxWU0Oa6Ddf9SyGvSglp4dXMwiHLE TGRZuHBq8DzdieKRjwEEvQPr71ZGuS7bjL6t5gA6yc82Nqkbr4V9r025ijEZEd/vU/ +LxViO3FZt42oPAHXIEtKzPWkixnbDzOGmAmKk67imsXFcBY5bzf9EXIgXI/+Aqzpl tQFU3CPnOt9Vw== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yB-00000006PP9-3eja; Sat, 05 Sep 2026 21:46:55 -0400 Message-ID: <20260906014655.737656886@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:35 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort , stable@vger.kernel.org, sashiko-bot@kernel.org Subject: [for-linus][PATCH 04/12] tracing: Take trace_array reference when opening options file References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt The options files do not take the trace_array reference for the options they represent. This could cause a use-after-free kernel crash if one of these files is opened by one task and another task removes the instance that the option is for. Because it doesn't take a reference upon opening, it will not stop the removal which will free the options descriptor that is being used. As the options are somewhat dynamic in their creation at boot up, each file represents a flag in the trace_array. The trace_array has an array of indexes to represent each of these flags that is stored in the trace_flags_index array. The address of the index array element is used to pass to the inode->i_private pointer. Then that element is read which holds the index (which represents the flag) and then the index is used to calculate the trace_array descriptor from its trace_flags_index array. One issue is that the index element can not be referenced until the trace_array's reference is taken. To handle this, create a new helper function called: trace_array_options_get() that will iterate all the existing trace_arrays in the ftrace_trace_arrays list (under the trace_types_lock), and compare the passed in address of the index element with the entire array of the trace_array's trace_flags_index array. If it matches, then up the corresponding trace_array's reference and return. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260902121918.5a9e9d1b@gandalf.local.home Fixes: 577b785f55168 ("tracing: add tracer dependent options to options dir= ectory") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/linux-trace-kernel/20260828135858.2AC501F00= 0E9@smtp.kernel.org/ Signed-off-by: Steven Rostedt --- kernel/trace/trace.c | 67 +++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 63 insertions(+), 4 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index a946e0183fd1..722d0ba2d233 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -7842,11 +7842,70 @@ trace_options_core_write(struct file *filp, const c= har __user *ubuf, size_t cnt, return cnt; } =20 +/* + * The tr_index is the address of a trace_array->trace_flags_index[] + * element that holds the index of the trace flag. But since the + * trace_array reference has not been taken yet, it cannot be referenced + * as it could have been freed by a rmdir of the instance the trace_array + * represents. + * + * Search the list of trace_arrays and compare the tr_index to the + * address of the entire trace_array trace_flags_index array for each + * trace_array in the list. If one is matched, then take the reference + * and return it. If not, the trace_array no longer exits. + */ +static int trace_array_options_get(void *tr_index) +{ + struct trace_array *tr; + int ret; + + ret =3D security_locked_down(LOCKDOWN_TRACEFS); + if (ret) + return ret; + + if (tracing_disabled) + return -ENODEV; + + guard(mutex)(&trace_types_lock); + list_for_each_entry(tr, &ftrace_trace_arrays, list) { + if (tr_index >=3D (void *)&tr->trace_flags_index[0] && + tr_index < (void *)&tr->trace_flags_index[TRACE_FLAGS_MAX_SIZE]) + return __trace_array_get(tr); + } + return -ENODEV; +} + +static int trace_options_open(struct inode *inode, struct file *filp) +{ + void *tr_index =3D inode->i_private; + + if (trace_array_options_get(tr_index) < 0) + return -ENODEV; + + filp->private_data =3D tr_index; + + return 0; +} + +static int trace_options_release(struct inode *inode, struct file *filp) +{ + void *tr_index =3D filp->private_data; + struct trace_array *tr; + unsigned int index; + + get_tr_index(tr_index, &tr, &index); + + trace_array_put(tr); + + return 0; +} + static const struct file_operations trace_options_core_fops =3D { - .open =3D tracing_open_generic, - .read =3D trace_options_core_read, - .write =3D trace_options_core_write, - .llseek =3D generic_file_llseek, + .open =3D trace_options_open, + .read =3D trace_options_core_read, + .write =3D trace_options_core_write, + .llseek =3D generic_file_llseek, + .release =3D trace_options_release, }; =20 struct dentry *trace_create_file(const char *name, --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2440234252C; Sun, 6 Sep 2026 01:45:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659154; cv=none; b=ZZcDH4HsDrl4EfkugZ2L9SmvAjb3bobbO0fH4uqkCIcUMczVlIKfdOTSH6mPELh51m4o5h6AsV3n1iaeqtQcIPHHW+AVx7Un+qNFXGixLUooJIP1wi28iMPH4a5SCkJi+/+p+zak+umMQq3fnuBq+Cihb+jobOo6d2LL95OtOao= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659154; c=relaxed/simple; bh=dNl5RYgoJyRe3BbQR5kcSu6ZiDR5iawJdpnVQzg2V7A=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=eFTGRlEBD+1zl1VVD5Yg/zbjsrTVE1P1ovgI/SSE5yKIh4AKoA61dRRSTCvB4QornyJxw+AgfI9W8YtfZfy0GhRoDCbBXDhmcGF78ETU1dQevnwu6w9arNxTYg9r3L0zlLMjXxXaOfApAT0oxlWXSPhIu3EINq76cXgPaMOP8as= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Y8kBJ818; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Y8kBJ818" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1CB571F00ADE; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659147; bh=cxFNKUL2XbhJTz3/Dyo98jS0edW4j43/SQuz71JNgFI=; h=Date:From:To:Cc:Subject:References; b=Y8kBJ818Zxgz9HFpBwIhJn3WNHWv01j9vZgrvn9pr1o0Yco/ArSXMyvAZBWaGk0vO fyOlhD1hjyNrmNmbqkuDpFSubv8RGJl5MK2c0oj+pMrqWFqeQxBdF0VsaG5q7pTsXQ I1C2sQJD5iZZdO4DCKPAjiYKiszGeLG9NHXU/vNpiBv23hqBDU20gHkyThwqG838t2 Gksdvhm8Afr5p2k3DP8KIOaVLCdo6lUkZCbj21ovVka858h0mBd5YueNo7ye7jFiF2 ZiKXzAMqBxtFmRVaAqMhrduVZjtoRh8KlW7Bbc0/5+NZCR6uur8xr4exBjVH8246m7 z4rBXQrSBeKDA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yC-00000006PPd-08OD; Sat, 05 Sep 2026 21:46:56 -0400 Message-ID: <20260906014655.890933279@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:36 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort , stable@vger.kernel.org Subject: [for-linus][PATCH 05/12] ring-buffer: Allow splice reads on static buffers References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Vincent Donnefort ring_buffer_read_page() rejects splice (full=3D1) reads on static buffers (that is user-mapped, persistent or remote) because !read check assumes unread pages must be swapped. However for those buffers we have no other choice than memcpy the data. For the memcpy case, only return an error when the writer is still on the reader page for the splice interface to wait. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260901155445.1475405-2-vdonnefort@google.c= om Fixes: 117c39200d9d ("ring-buffer: Introducing ring-buffer mapping function= s") Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/ring_buffer.c | 11 ++--------- 1 file changed, 2 insertions(+), 9 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index b0963ac6fd16..84fd4cdd486f 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -7193,15 +7193,8 @@ int ring_buffer_read_page(struct trace_buffer *buffe= r, unsigned int event_size; unsigned int flags =3D 0; =20 - /* - * If a full page is expected, this can still be returned - * if there's been a previous partial read and the - * rest of the page can be read and the commit page is off - * the reader page. - */ - if (full && - (!read || (len < (size - read)) || - cpu_buffer->reader_page =3D=3D cpu_buffer->commit_page)) + /* If a full page is requested, it cannot be the commit page */ + if (full && cpu_buffer->reader_page =3D=3D cpu_buffer->commit_page) return -1; =20 if (len > (size - read)) --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 44D53282F1C for ; Sun, 6 Sep 2026 01:45:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659155; cv=none; b=kn/UqHD2e5DnqgJyffeQHoiThIUzlP9wrhU/jKyXP+iNbwxs1o6P8LkrszY/mSo3CtyN4XWSQae8VqVlmLXJklXUuJ+YmJm+mWCuVflI+j6akxikpfy7CrUbipa+S9s0Lxx5JKwWlGp1wud3Cf+2+AG9LDnCPMpY+JS6dFybPNA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659155; c=relaxed/simple; bh=F6KQeZdbVNU6nqzdbwbqOcfr7MGeBxYJ/WbkW5sRG8c=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=HKo6n2kr8s8iLi4mLvAsLhU7lWZvW6dRVyOA7lfaxoscT8wMtXissrOzNS36rJ7JAzgy6Tm34VszKLOyxIl4RsSciuD+F7X6nLIuMTiHJiEzJ3Ahp0fvdMKlSuSAgmvUy7LkSXq/wWEkcbSpnT27Qf24LmiOkN1MbVkDvnNw2QI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CoHi1z+Q; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CoHi1z+Q" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4EC491F00ACA; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659147; bh=zLOsuJy/tiOhVClCFWf0RybPYTPcY6Fl4v6aNVup9Uo=; h=Date:From:To:Cc:Subject:References; b=CoHi1z+Qxovjzof5XhSvjpGQs67mtSXap+BHU+7BI1yuF0SWmuR/YqWUxTEDaCBZL GO4dBQ5dHXUm7TEM+aEcX3qQgcCaXViyW0lPXcM6zWM2yoXDsPvmgUQ0esO6UTXxY0 w+C6YxuuT0RcdKiIcqdstRUxJUSCCnZpKAKFiV9tUK70b1rVOaPQw55Ulg/KfHf2AE n20G90RRGq9ST7HwJ4TUJTWXbMOMXcyYsZUYTklfa15Son2gw2uNCbZstiu3nJenzQ wMzwOvp3Yjbe+hReG4UIJBgv/qTg6aR7aoBjaM0W1LRH8Eoh/tb2qJNJSDA+1p7Ml4 LTYzDf0ex3fZg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yC-00000006PQ8-0mtw; Sat, 05 Sep 2026 21:46:56 -0400 Message-ID: <20260906014656.049956688@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:37 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort , sashiko-bot@kernel.org Subject: [for-linus][PATCH 06/12] ring-buffer: Add checking nr_subbufs to persistent ring buffer validation References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt Sashiko reported that the code was using meta->nr_subbufs without making sure that it matched the nr_pages + 1 on data that was assuming the two were the same. Add a check to the persistent ring buffer validation code to make sure that the saved nr_subbufs matches what we expect. Link: https://patch.msgid.link/20260903132728.7fb27d34@gandalf.local.home Fixes: f5b95f1fa2ef3 ("ring-buffer: Validate the persistent meta data subbu= f array") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260901164836.D962D1F000E9@smtp.kernel= .org/ Reviewed-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/ring_buffer.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 84fd4cdd486f..ff0a44aa578d 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1856,6 +1856,11 @@ static bool rb_cpu_meta_valid(struct ring_buffer_cpu= _meta *meta, int cpu, return false; } =20 + if (meta->nr_subbufs !=3D nr_pages + 1) { + pr_info("Ring buffer boot meta [%d] invalid nr_subbufs\n", cpu); + return false; + } + buffers_start =3D meta->first_buffer; buffers_end =3D meta->first_buffer + (subbuf_size * meta->nr_subbufs); =20 --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CD6433CEA7 for ; Sun, 6 Sep 2026 01:45:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659157; cv=none; b=J4qp28j+OPOj0VXXpUna1GOW2qpgigrT3fQrrelOsa1/i3WotWQfawrydasZKfaqCpW85L+4SRkrqSuiObvHZHyojPhSRtfwNwPa/aFC7TMQ6C4NUxNq9BoxM7IEhy+eB+NBJKbfFhNdl610tS0Eu3UJqFYyh+dT/KUcAiba4IA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659157; c=relaxed/simple; bh=YxIpk6QkpYjSQquf/Jh8r113i695kj9fMB3adFZeP44=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=YNu0C9ZrI0TPQ7qSpRxUylZNhuFsKgdjwGra38EI9dMPDNZ1Byxs9s5saB+TZ1cUJRikF9UuvG0s5WhgJr8tw9BvxdpI+wdGe+4xEk6qZOQj427AvhLi9GxyfprGHQ6rk29gLtYTnls4ONoH5Opte3LCpmWcZGy5HHmdapAoJPs= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=E9e1hNm6; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="E9e1hNm6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 69DE61F00ADF; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659147; bh=mbrkhjXglhWeP9AyylMvYWDvOU+tbAELvSslJPWWkr4=; h=Date:From:To:Cc:Subject:References; b=E9e1hNm6ePV9+aWfYWdHiKwUkApb+LHPXFwTCZB6ujZlIEF2Bby8XAY+063kk0gyp 5xgOtCWu4T/4smHf7O7nCVTbuoBG0kDwOw2Y4TiYw3SpcYFIM12xAcpD0PWORp6v4i sAzfhzh17Qj2eZ7UU1i+WsMzpGq06QhW289OiCEQmV9yx0ClQmfYeunVEBX0WX87Mn jtblIDdZr95gFk5I1KVoAEXG0PaPg5vbuK+9oT/60ocEm/v28hWLIv5sDYL3euI5yu gC8m+KiLxn4+n50ieZsMc5cdglJfy5C0Ig1fTCuEicuoNyrYD4G0qOE9gNLYtmAY8g GeVXQrrGpLc9w== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yC-00000006PQd-1QFs; Sat, 05 Sep 2026 21:46:56 -0400 Message-ID: <20260906014656.204901338@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:38 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort Subject: [for-linus][PATCH 07/12] tracing: Fix to avoid creating trace instances with duplicate names References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Masami Hiramatsu (Google)" Since commit e645535a954a ("tracing: Add option to use memmapped memory for trace boot instance") changed trace_array_get_by_name() to trace_array_create_systems(), enable_instances() does not reuse the same name instance. Therefore, if an administrator mistakenly specifies multiple `trace_instance=3D` options with duplicate names, all are created but only the first is accessible via tracefs. Check whether an instance with the same name already exists before creating a new one, and reject duplicates with a warning. Link: https://patch.msgid.link/178847790399.283263.5313150997200138426.stgi= t@devnote2 Fixes: e645535a954a ("tracing: Add option to use memmapped memory for trace= boot instance") Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt --- kernel/trace/trace.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 722d0ba2d233..138e983c3c2f 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -9710,6 +9710,11 @@ __init static void enable_instances(void) if (flag_delim) *flag_delim++ =3D '\0'; =20 + if (trace_array_find(name)) { + pr_warn("Tracing: Instance %s already exists\n", name); + continue; + } + if (backup) { if (backup_instance_area(backup, &addr, &size) < 0) continue; --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 76F5B2857FA for ; Sun, 6 Sep 2026 01:45:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659155; cv=none; b=mLa0fpiXWjNoMVsPJYKor4nfN99izkT1jljcpXN+qONzQ2u4xCnoldmz/ySU/3ggrCAaod3PryGTGU8BfrbcxPnRLxBhjNq8tPgUK7rGTBT2WDzoNvSnarNEWEcPIYRXBzuUuTcu0+PiLYBh30cxDfAipFLDy5S9xqZy8rvkzCI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659155; c=relaxed/simple; bh=s8VewIXQRESO+xpFC2geZOOuNucSJeTyCQcPzvqOyMs=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=Zw5+CYTnRtZXTn44sKmYc+GfO1BkkA0Kqf/KQWcpdI4muKTm43FOJrgfS+Of4Fd3eNZaBqcWyayedH+6lap9cAk1GKp6/GD+D4b5GV10oDmgDRpthsLEM3nyBRwqydGJ6zo2cZ5As15PFG4eotCrjb24epezvSi4mVQJjprW4j0= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=amZ2o2vM; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="amZ2o2vM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8C7B01F00ACF; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659147; bh=4XfKs8SSmD+uqs4xIojGoUWGbWSOTdcOrN/NQUdHhtM=; h=Date:From:To:Cc:Subject:References; b=amZ2o2vMqK0Nnpj8SxCG4kMgLW+KV+4ieTNr7LuJboE9tj1M+NeKBeNO4yDmU7433 rjBdGBh2CbRJOrJnvTUDsFZbxeycEWx4Y3gBNINDh3r9dZOqbNEE6MTyMeVRkbQSmW v1AzrUZ1jlJKle6QJC4P+mcSTZxqW0U41V7nuNCVVbZkOHJvN/jEfpRmOIsqqsE3NV RyCEG7ckWvlCwF8NgNy2OQ+z8e3onMJ53tSrki47/k//GotdRpQSgONA/IwWlUIgaM 9vOYuVc9+UFh+P3TRWcypSPxaUlrlHzBfEetCJU1VXOvop48NBdzHjiVcH2r+EzkzV kFdoJ6PT/Ha5w== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yC-00000006PR7-22z7; Sat, 05 Sep 2026 21:46:56 -0400 Message-ID: <20260906014656.357681406@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:39 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort Subject: [for-linus][PATCH 08/12] tracing: Fix subbuf resize races with trace_pipe_raw readers References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Vincent Donnefort Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak uninitialized memory to userspace due to stale size values. Modify ring_buffer_alloc_read_page() to handle the resizing of an existing buffer_data_read_page if necessary and add a new ring_buffer_read_page_size(). This new function enables ring-buffer buffer_data_read_page users to not call the racy ring_buffer_subbuf_size_get(). This makes the spare_size member of ftrace_buffer_info redundant. Finally, handle buffer_data_read_page/reader_page order discrepancy in ring_buffer_read_page(). On a mismatch simply copy manually the data to the buffer_data_read_page. Link: https://lore.kernel.org/all/20260817140812.2C7D41F00A3A@smtp.kernel.o= rg/ Link: https://patch.msgid.link/20260904164450.1345852-3-vdonnefort@google.c= om Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with cust= om sub buffer size") Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- include/linux/ring_buffer.h | 5 +- kernel/trace/ring_buffer.c | 135 ++++++++++++++++++--------- kernel/trace/ring_buffer_benchmark.c | 6 +- kernel/trace/trace.c | 97 +++++++++---------- kernel/trace/trace.h | 9 +- 5 files changed, 144 insertions(+), 108 deletions(-) diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h index 0670742b2d60..afc7daa6ee7d 100644 --- a/include/linux/ring_buffer.h +++ b/include/linux/ring_buffer.h @@ -218,14 +218,15 @@ bool ring_buffer_time_stamp_abs(struct trace_buffer *= buffer); size_t ring_buffer_nr_dirty_pages(struct trace_buffer *buffer, int cpu); =20 struct buffer_data_read_page; -struct buffer_data_read_page * -ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu); +int ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu, + struct buffer_data_read_page **rpage); void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, struct buffer_data_read_page *page); int ring_buffer_read_page(struct trace_buffer *buffer, struct buffer_data_read_page *data_page, size_t len, int cpu, int full); void *ring_buffer_read_page_data(struct buffer_data_read_page *page); +unsigned int ring_buffer_read_page_size(struct buffer_data_read_page *rpag= e); =20 struct trace_seq; =20 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index ff0a44aa578d..077d6940af0c 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -330,6 +330,11 @@ struct buffer_data_read_page { struct buffer_data_page *data; /* actual data, stored in this page */ }; =20 +static __always_inline unsigned int rb_read_page_capacity(struct buffer_da= ta_read_page *rpage) +{ + return (PAGE_SIZE << rpage->order) - BUF_PAGE_HDR_SIZE; +} + /* * Note, the buffer_page list must be first. The buffer pages * are allocated in cache lines, which means that each buffer @@ -6998,56 +7003,78 @@ EXPORT_SYMBOL_GPL(ring_buffer_swap_cpu); * ring_buffer_alloc_read_page - allocate a page to read from buffer * @buffer: the buffer to allocate for. * @cpu: the cpu buffer to allocate. + * @rpage: pointer to pass in an already allocated page (can be NULL) + * and returns the allocated page. * - * This function is used in conjunction with ring_buffer_read_page. + * This function is used in conjunction with ring_buffer_read_page(). * When reading a full page from the ring buffer, these functions * can be used to speed up the process. The calling function should * allocate a few pages first with this function. Then when it * needs to get pages from the ring buffer, it passes the result - * of this function into ring_buffer_read_page, which will swap + * of this function into ring_buffer_read_page(), which will swap * the page that was allocated, with the read page of the buffer. * + * If @rpage is provided, and it has a different order than the current + * subbuffer order, its payload will be freed and re-allocated. If it + * already matches the order, it is simply returned. + * * Returns: - * The page allocated, or ERR_PTR + * 0 on success, < 0 on error */ -struct buffer_data_read_page * -ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu) +int ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu, + struct buffer_data_read_page **rpage) { struct ring_buffer_per_cpu *cpu_buffer; - struct buffer_data_read_page *bpage =3D NULL; unsigned long flags; + unsigned int order; =20 if (!cpumask_test_cpu(cpu, buffer->cpumask)) - return ERR_PTR(-ENODEV); + return -ENODEV; =20 - bpage =3D kzalloc_obj(*bpage); - if (!bpage) - return ERR_PTR(-ENOMEM); + if (!rpage) + return -EINVAL; + + order =3D READ_ONCE(buffer->subbuf_order); =20 - bpage->order =3D buffer->subbuf_order; + if (*rpage) { + if ((*rpage)->order =3D=3D order) + return 0; + + /* We can reuse rpage, but we discard the payload */ + free_pages((unsigned long)(*rpage)->data, (*rpage)->order); + (*rpage)->data =3D NULL; + } else { + *rpage =3D kzalloc_obj(**rpage); + if (!*rpage) + return -ENOMEM; + } + + (*rpage)->order =3D order; cpu_buffer =3D buffer->buffers[cpu]; + local_irq_save(flags); arch_spin_lock(&cpu_buffer->lock); =20 if (cpu_buffer->free_page.data) { - *bpage =3D cpu_buffer->free_page; + **rpage =3D cpu_buffer->free_page; cpu_buffer->free_page.data =3D NULL; } =20 arch_spin_unlock(&cpu_buffer->lock); local_irq_restore(flags); =20 - if (bpage->data) { - rb_init_data_page(bpage->data); + if ((*rpage)->data) { + rb_init_data_page((*rpage)->data); } else { - bpage->data =3D alloc_cpu_data(cpu, bpage->order); - if (!bpage->data) { - kfree(bpage); - return ERR_PTR(-ENOMEM); + (*rpage)->data =3D alloc_cpu_data(cpu, (*rpage)->order); + if (!(*rpage)->data) { + kfree(*rpage); + *rpage =3D NULL; + return -ENOMEM; } } =20 - return bpage; + return 0; } EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page); =20 @@ -7055,21 +7082,30 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page); * ring_buffer_free_read_page - free an allocated read page * @buffer: the buffer the page was allocate for * @cpu: the cpu buffer the page came from - * @data_page: the page to free + * @rpage: the buffer_data_read_page to free * * Free a page allocated from ring_buffer_alloc_read_page. */ void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, - struct buffer_data_read_page *data_page) + struct buffer_data_read_page *rpage) { struct ring_buffer_per_cpu *cpu_buffer; - struct buffer_data_page *dpage =3D data_page->data; - struct page *page =3D virt_to_page(dpage); + struct buffer_data_page *dpage; unsigned long flags; + struct page *page; =20 if (!buffer || !buffer->buffers || !buffer->buffers[cpu]) return; =20 + if (!rpage) + return; + + dpage =3D rpage->data; + if (!dpage) + goto out; + + page =3D virt_to_page(dpage); + cpu_buffer =3D buffer->buffers[cpu]; =20 /* @@ -7077,14 +7113,14 @@ void ring_buffer_free_read_page(struct trace_buffer= *buffer, int cpu, * is different from the subbuffer order of the buffer - * we can't reuse it */ - if (page_ref_count(page) > 1 || data_page->order !=3D buffer->subbuf_orde= r) + if (page_ref_count(page) > 1 || rpage->order !=3D READ_ONCE(buffer->subbu= f_order)) goto out; =20 local_irq_save(flags); arch_spin_lock(&cpu_buffer->lock); =20 if (!cpu_buffer->free_page.data) { - cpu_buffer->free_page =3D *data_page; + cpu_buffer->free_page =3D *rpage; dpage =3D NULL; } =20 @@ -7092,8 +7128,8 @@ void ring_buffer_free_read_page(struct trace_buffer *= buffer, int cpu, local_irq_restore(flags); =20 out: - free_pages((unsigned long)dpage, data_page->order); - kfree(data_page); + free_pages((unsigned long)dpage, rpage->order); + kfree(rpage); } EXPORT_SYMBOL_GPL(ring_buffer_free_read_page); =20 @@ -7164,10 +7200,9 @@ int ring_buffer_read_page(struct trace_buffer *buffe= r, if (!dpage) return -1; =20 - guard(raw_spinlock_irqsave)(&cpu_buffer->reader_lock); + len =3D min_t(size_t, len, rb_read_page_capacity(data_page)); =20 - if (data_page->order !=3D cpu_buffer->reader_page->order) - return -1; + guard(raw_spinlock_irqsave)(&cpu_buffer->reader_lock); =20 reader =3D rb_get_reader_page(cpu_buffer); if (!reader) @@ -7182,16 +7217,18 @@ int ring_buffer_read_page(struct trace_buffer *buff= er, /* Check if any events were dropped */ missed_events =3D cpu_buffer->lost_events; =20 - /* - * If this page has been partially read or - * if len is not big enough to read the rest of the page or - * a writer is still on the page, then - * we must copy the data from the page to the buffer. - * Otherwise, we can simply swap the page with the one passed in. - */ + /* + * It is not possible to swap the reader page if: + * - It has been partially read + * - len is not big enough to read it entirely + * - A writer is still on it + * - The ring buffer is static + * - The order doesn't match + */ if (read || (len < (size - read)) || cpu_buffer->reader_page =3D=3D cpu_buffer->commit_page || - rb_is_static(cpu_buffer)) { + rb_is_static(cpu_buffer) || + data_page->order !=3D reader->order) { struct buffer_data_page *rpage =3D cpu_buffer->reader_page->page; unsigned int rpos =3D read; unsigned int pos =3D 0; @@ -7285,7 +7322,7 @@ int ring_buffer_read_page(struct trace_buffer *buffer, * missed events, then record it there. */ if (missed_events > 0 && - rb_page_capacity(reader) - size >=3D sizeof(missed_events)) { + rb_read_page_capacity(data_page) - size >=3D sizeof(missed_events)) { memcpy(&dpage->data[size], &missed_events, sizeof(missed_events)); local_add(RB_MISSED_STORED, &dpage->commit); @@ -7305,8 +7342,8 @@ int ring_buffer_read_page(struct trace_buffer *buffer, /* * This page may be off to user land. Zero it out here. */ - if (size < rb_page_capacity(reader)) - memset(&dpage->data[size], 0, rb_page_capacity(reader) - size); + if (size < rb_read_page_capacity(data_page)) + memset(&dpage->data[size], 0, rb_read_page_capacity(data_page) - size); =20 return read; } @@ -7324,6 +7361,18 @@ void *ring_buffer_read_page_data(struct buffer_data_= read_page *page) } EXPORT_SYMBOL_GPL(ring_buffer_read_page_data); =20 +/** + * ring_buffer_read_page_size - get size of the read page. + * @page: the page to get the size from + * + * Returns size of the page in bytes. + */ +unsigned int ring_buffer_read_page_size(struct buffer_data_read_page *rpag= e) +{ + return rpage ? PAGE_SIZE << rpage->order : 0; +} +EXPORT_SYMBOL_GPL(ring_buffer_read_page_size); + /** * ring_buffer_subbuf_size_get - get size of the sub buffer. * @buffer: the buffer to get the sub buffer size from @@ -7409,7 +7458,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer = *buffer, int order) /* Make sure all commits have finished */ synchronize_rcu(); =20 - buffer->subbuf_order =3D order; + WRITE_ONCE(buffer->subbuf_order, order); =20 /* Make sure all new buffers are allocated, before deleting the old ones = */ for_each_buffer_cpu(buffer, cpu) { @@ -7513,7 +7562,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer = *buffer, int order) return 0; =20 error: - buffer->subbuf_order =3D old_order; + WRITE_ONCE(buffer->subbuf_order, old_order); =20 atomic_dec(&buffer->record_disabled); =20 diff --git a/kernel/trace/ring_buffer_benchmark.c b/kernel/trace/ring_buffe= r_benchmark.c index 593e3b59e42e..c3d34c0e64e2 100644 --- a/kernel/trace/ring_buffer_benchmark.c +++ b/kernel/trace/ring_buffer_benchmark.c @@ -104,7 +104,7 @@ static enum event_status read_event(int cpu) =20 static enum event_status read_page(int cpu) { - struct buffer_data_read_page *bpage; + struct buffer_data_read_page *bpage =3D NULL; struct ring_buffer_event *event; struct rb_page *rpage; unsigned long commit; @@ -114,8 +114,8 @@ static enum event_status read_page(int cpu) int inc; int i; =20 - bpage =3D ring_buffer_alloc_read_page(buffer, cpu); - if (IS_ERR(bpage)) + ret =3D ring_buffer_alloc_read_page(buffer, cpu, &bpage); + if (ret < 0) return EVENT_DROPPED; =20 page_size =3D ring_buffer_subbuf_size_get(buffer); diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index 138e983c3c2f..b26c4c277ce5 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -7082,8 +7082,8 @@ ssize_t tracing_buffers_read(struct file *filp, char = __user *ubuf, { struct ftrace_buffer_info *info =3D filp->private_data; struct trace_iterator *iter =3D &info->iter; + unsigned int spare_size; void *trace_data; - int page_size; ssize_t ret =3D 0; ssize_t size; =20 @@ -7093,36 +7093,22 @@ ssize_t tracing_buffers_read(struct file *filp, cha= r __user *ubuf, if (iter->snapshot && tracer_uses_snapshot(iter->tr->current_trace)) return -EBUSY; =20 - page_size =3D ring_buffer_subbuf_size_get(iter->array_buffer->buffer); + spare_size =3D ring_buffer_read_page_size(info->spare); =20 - /* Make sure the spare matches the current sub buffer size */ - if (info->spare) { - if (page_size !=3D info->spare_size) { - ring_buffer_free_read_page(iter->array_buffer->buffer, - info->spare_cpu, info->spare); - info->spare =3D NULL; - } - } +again: + /* Do we have previous read data to read? */ + if (info->read < spare_size) + goto read; =20 - if (!info->spare) { - info->spare =3D ring_buffer_alloc_read_page(iter->array_buffer->buffer, - iter->cpu_file); - if (IS_ERR(info->spare)) { - ret =3D PTR_ERR(info->spare); - info->spare =3D NULL; - } else { - info->spare_cpu =3D iter->cpu_file; - info->spare_size =3D page_size; - } - } - if (!info->spare) + ret =3D ring_buffer_alloc_read_page(iter->array_buffer->buffer, iter->cpu= _file, + &info->spare); + if (ret) return ret; =20 - /* Do we have previous read data to read? */ - if (info->read < page_size) - goto read; + spare_size =3D ring_buffer_read_page_size(info->spare); + info->read =3D spare_size; + info->spare_cpu =3D iter->cpu_file; =20 - again: trace_access_lock(iter->cpu_file); ret =3D ring_buffer_read_page(iter->array_buffer->buffer, info->spare, @@ -7148,8 +7134,9 @@ ssize_t tracing_buffers_read(struct file *filp, char = __user *ubuf, } =20 info->read =3D 0; + read: - size =3D page_size - info->read; + size =3D spare_size - info->read; if (size > count) size =3D count; trace_data =3D ring_buffer_read_page_data(info->spare); @@ -7190,26 +7177,24 @@ int tracing_buffers_release(struct inode *inode, st= ruct file *file) =20 __trace_array_put(iter->tr); =20 - if (info->spare) - ring_buffer_free_read_page(iter->array_buffer->buffer, - info->spare_cpu, info->spare); + ring_buffer_free_read_page(iter->array_buffer->buffer, info->spare_cpu, i= nfo->spare); kvfree(info); =20 return 0; } =20 struct buffer_ref { - struct trace_buffer *buffer; - void *page; - int cpu; - refcount_t refcount; + struct trace_buffer *buffer; + struct buffer_data_read_page *rpage; + int cpu; + refcount_t refcount; }; =20 static void buffer_ref_release(struct buffer_ref *ref) { if (!refcount_dec_and_test(&ref->refcount)) return; - ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->page); + ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->rpage); kfree(ref); } =20 @@ -7268,25 +7253,15 @@ ssize_t tracing_buffers_splice_read(struct file *fi= le, loff_t *ppos, .ops =3D &buffer_pipe_buf_ops, .spd_release =3D buffer_spd_release, }; + unsigned int page_size =3D 0; struct buffer_ref *ref; bool woken =3D false; - int page_size; int entries, i; ssize_t ret =3D 0; =20 if (iter->snapshot && tracer_uses_snapshot(iter->tr->current_trace)) return -EBUSY; =20 - page_size =3D ring_buffer_subbuf_size_get(iter->array_buffer->buffer); - if (*ppos & (page_size - 1)) - return -EINVAL; - - if (len & (page_size - 1)) { - if (len < page_size) - return -EINVAL; - len &=3D (~(page_size - 1)); - } - if (splice_grow_spd(pipe, &spd)) return -ENOMEM; =20 @@ -7306,25 +7281,37 @@ ssize_t tracing_buffers_splice_read(struct file *fi= le, loff_t *ppos, =20 refcount_set(&ref->refcount, 1); ref->buffer =3D iter->array_buffer->buffer; - ref->page =3D ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file); - if (IS_ERR(ref->page)) { - ret =3D PTR_ERR(ref->page); - ref->page =3D NULL; + + ret =3D ring_buffer_alloc_read_page(ref->buffer, iter->cpu_file, &ref->r= page); + if (ret) { kfree(ref); break; } ref->cpu =3D iter->cpu_file; =20 - r =3D ring_buffer_read_page(ref->buffer, ref->page, - len, iter->cpu_file, 1); + page_size =3D ring_buffer_read_page_size(ref->rpage); + + r =3D -EINVAL; + if (IS_ALIGNED(*ppos, page_size) && len >=3D page_size) { + r =3D ring_buffer_read_page(ref->buffer, ref->rpage, len, iter->cpu_fil= e, 1); + } else if (!i) { + /* + * We failed to read because the length is too small + * or unaligned. If this is the first iteration, it's + * an invalid userspace input. Otherwise, this is due + * to a subbuf order change. Do not report an error + * and just finish the read. + */ + ret =3D -EINVAL; + } + if (r < 0) { - ring_buffer_free_read_page(ref->buffer, ref->cpu, - ref->page); + ring_buffer_free_read_page(ref->buffer, ref->cpu, ref->rpage); kfree(ref); break; } =20 - page =3D virt_to_page(ring_buffer_read_page_data(ref->page)); + page =3D virt_to_page(ring_buffer_read_page_data(ref->rpage)); =20 spd.pages[i] =3D page; spd.partial[i].len =3D page_size; diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index 3c111ca88e32..5e76f94e7a80 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -745,11 +745,10 @@ static inline int tracing_get_cpu(struct inode *inode) void tracing_reset_cpu(struct array_buffer *buf, int cpu); =20 struct ftrace_buffer_info { - struct trace_iterator iter; - void *spare; - unsigned int spare_cpu; - unsigned int spare_size; - unsigned int read; + struct trace_iterator iter; + struct buffer_data_read_page *spare; + unsigned int spare_cpu; + unsigned int read; }; =20 /** --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 92DBD345EA4 for ; Sun, 6 Sep 2026 01:45:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659154; cv=none; b=EVLzLo4dXwyyf/uejSNjKeDHSg32OqWZjMwlEFfwHFziPN02NsWPhlwLcwvegSjSZKXVXAS5GENIhL5c2ye78e6NqDr8pJ2394gJyy1AGaL4D2evmnEKxrLu33tkmRjArKRuzPx0E+FKApmSDY5qM7NePZsh1s7j3NGm4pR2wa8= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659154; c=relaxed/simple; bh=bSPDSHIygvKCiRrnE82uvbInemfYCf5MqRiL/4o1WGA=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=Pv9dNgkPGeJx+11P2IFgUpSHMayMnMdJUFDWqpI0cNfHopxq8CzuCyFDhJm2T1lv8bxDPlcACcS1g3tYy+LsA3KR19PgJBlpKYBlfFYXmyckcRoOqpcBrW6eU4oen3o1Cy2JGpARW7oT9MebWJpxJk78SSMpitlqHwkPfi6H8WY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=cYIbA+PM; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cYIbA+PM" Received: by smtp.kernel.org (Postfix) with ESMTPSA id ADFEC1F01558; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659147; bh=UhoUYFnbdEHZsMIHAyDXcXcLz9YQcvlkaeH9qXWpWKc=; h=Date:From:To:Cc:Subject:References; b=cYIbA+PMlyF1Q5zG+nxEp4JZcNeqrwqWNdyL0C1R42/oP6hBNnOXJ0LcvILjV4S5o GiT8JoymcEHhGtvoV21SpJ105mRWSgM+E10IibKZPQ1/DwprPY0n0JVDYf0Lq1tjrn nyl7wwaLR/s6a5RWnzAUJpoui6Z12hDVZ7tCuX8FpHjbr65m78TW0N7bkxRXs2127M RyzaIVcJ4bI+ogVkvlwnVQIJvEEdqf6D8ahtrM5VKLBgKL90TxJNshMMKs3ygtu+8y Zb1KvcQ76imjmg911s2yB85YVaFZ/uqXBB2Z718oo63OoLrYTa7a2kuy4ytbZ+q9A+ 6ttooqPSGnbAg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yC-00000006PRb-2fU5; Sat, 05 Sep 2026 21:46:56 -0400 Message-ID: <20260906014656.508919614@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:40 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort Subject: [for-linus][PATCH 09/12] ring-buffer: Cap static ring buffer nr_pages References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Vincent Donnefort Static ring buffers (i.e. persistent, user-mapped and remote) rely on the bpage::id field. The number of pages for those ring buffers must fit into that variable. Enforce this limit on ring buffer creation or user-mapping. While at it, prevent nr_pages underflow when allocating a persistent buffer. Link: https://patch.msgid.link/20260904164450.1345852-4-vdonnefort@google.c= om Fixes: be68d63a139b ("ring-buffer: Add ring_buffer_alloc_range()") Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/ring_buffer.c | 22 ++++++++++++++++++++++ 1 file changed, 22 insertions(+) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 077d6940af0c..76fed01f1c49 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -657,6 +657,15 @@ static bool rb_is_static(struct ring_buffer_per_cpu *c= pu_buffer) return cpu_buffer->user_mapped || cpu_buffer->remote || cpu_buffer->ring_= meta; } =20 +static unsigned long rb_static_max_pages(void) +{ + /* + * Static ring buffers are using bpage::id and must account for the + * reader page. + */ + return (1UL << 30) - 1; +} + struct ring_buffer_iter { struct ring_buffer_per_cpu *cpu_buffer; unsigned long head; @@ -2838,6 +2847,8 @@ static struct trace_buffer *alloc_buffer(unsigned lon= g size, unsigned flags, size =3D end - buffers_start; size =3D size / nr_cpu_ids; =20 + if (size < sizeof(struct ring_buffer_cpu_meta)) + goto fail_free_buffers; /* * The number of sub-buffers (nr_pages) is determined by the * total size allocated minus the meta data size. @@ -2847,6 +2858,10 @@ static struct trace_buffer *alloc_buffer(unsigned lo= ng size, unsigned flags, */ nr_pages =3D (size - sizeof(struct ring_buffer_cpu_meta)) / (subbuf_size + sizeof(int)); + + if (nr_pages > rb_static_max_pages()) + goto fail_free_buffers; + /* Need at least two pages plus the reader page */ if (nr_pages < 3) goto fail_free_buffers; @@ -2879,6 +2894,10 @@ static struct trace_buffer *alloc_buffer(unsigned lo= ng size, unsigned flags, /* The writer is remote. This ring-buffer is read-only */ atomic_inc(&buffer->record_disabled); nr_pages =3D desc->nr_page_va - 1; + + if (nr_pages > rb_static_max_pages()) + goto fail_free_buffers; + if (nr_pages < 2) goto fail_free_buffers; } else { @@ -7841,6 +7860,9 @@ int ring_buffer_map(struct trace_buffer *buffer, int = cpu, /* prevent another thread from changing buffer/sub-buffer sizes */ guard(mutex)(&buffer->mutex); =20 + if (cpu_buffer->nr_pages > rb_static_max_pages()) + return -E2BIG; + err =3D rb_alloc_meta_page(cpu_buffer); if (err) return err; --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 379C4346FA1 for ; Sun, 6 Sep 2026 01:45:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659157; cv=none; b=utx5ahTOhyV2014c7wP7lFO2oXooX8Vmm3kcbL2fSkltiUldoB75D/dQ+LbVW49zF7wp5ZZ4SRxT+ejU9PgikQZCTNv5F//cgd4G/IOsWtUKKslA/Mx5bLf8GFOSane6SY8IRDvprMJssmwSuswan/ec0buUPwEeJuiofAZWnHA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659157; c=relaxed/simple; bh=d435VnZOzrrH2rPG5AX1NWYNf20yXTSkwuew4D4FkHI=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=ezg4qgg2LgxvzDBzVQgJf4NiGaawL3JUuphOKSBh/c2yQMYPTnffFBzOtEHNgVXkXPfYvI+VJwjzz6hWKfK0ZzwcNty9/gS+Q4QOTuK6GP7d8n9yanbxau4zxlWlHwyz+JQxLeay3XHO2GGf02lbKD8UxlKLFxjg0qxql/5HAD4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=G59OPv9j; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="G59OPv9j" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D3ED61F00ADB; Sun, 6 Sep 2026 01:45:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659147; bh=3p0f1YA0YMYemkiQzWv4tPMOkk68SoOlGOuPphnLWXY=; h=Date:From:To:Cc:Subject:References; b=G59OPv9jvSspq53PcIb/cOu0o1vgg1f7soAnB8lXDFUGzJDTM0JxpOIy15oHuMf10 ghUMZGvpsyecdDiDJUMM1T444TOBSplz5BRjaHfzTzRX09vW/bHeIzG7F4nNI0CeyT /OdOAa3NmfWNqI3XUEqrZDjo49FPbxN2YFPR5qeo2qJuBnjpbpn7M/ya43EqXXo7us iZxrbCP0A/Guxj/lRaRsfw6ZwE6UWehktzZWYv+TqUNybkrYxiF6xBYcoabCwPJfvB g7WD0SDl2Pxv41TUbd3cRdfU8L1gjiSWgslYC/03bs3X1e2+i0uRswpuza4Pm2p4zh CpQB9npuRbfiA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yC-00000006PS7-3Hyp; Sat, 05 Sep 2026 21:46:56 -0400 Message-ID: <20260906014656.654469185@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:41 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort Subject: [for-linus][PATCH 10/12] ring-buffer: Prevent truncation of nr_pages / nr_subbufs References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Vincent Donnefort Although ring_buffer_per_cpu::nr_pages is defined as unsigned long, it is capped to 32-bits in a few places, limiting the operations possible on a very large buffer. Use `unsigned long` where appropriate and prevent truncation of values using nr_pages (or nr_subbufs). While at it, subbuf_size must be at least `unsigned int`. Note that persistent, remote and user-mapped ring buffers are capping the number of pages to 30 bits already, making "int" safe in many places. Link: https://patch.msgid.link/20260904164450.1345852-5-vdonnefort@google.c= om Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- kernel/trace/ring_buffer.c | 61 +++++++++++++++++++------------------- 1 file changed, 30 insertions(+), 31 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 76fed01f1c49..220b8405adfc 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -1683,7 +1683,7 @@ static void rb_check_pages(struct ring_buffer_per_cpu= *cpu_buffer) * This is used to help find the next per cpu subbuffer within a mapped ra= nge. */ static unsigned long -rb_range_align_subbuf(unsigned long addr, int subbuf_size, int nr_subbufs) +rb_range_align_subbuf(unsigned long addr, unsigned int subbuf_size, unsign= ed long nr_subbufs) { addr +=3D sizeof(struct ring_buffer_cpu_meta) + sizeof(int) * nr_subbufs; @@ -1693,13 +1693,12 @@ rb_range_align_subbuf(unsigned long addr, int subbu= f_size, int nr_subbufs) /* * Return the ring_buffer_meta for a given @cpu. */ -static void *rb_range_meta(struct trace_buffer *buffer, int nr_pages, int = cpu) +static void *rb_range_meta(struct trace_buffer *buffer, unsigned long nr_p= ages, int cpu) { - int subbuf_size =3D rb_subbuf_size(buffer); + unsigned int subbuf_size =3D rb_subbuf_size(buffer); struct ring_buffer_cpu_meta *meta; struct ring_buffer_meta *bmeta; - unsigned long ptr; - int nr_subbufs; + unsigned long ptr, nr_subbufs; =20 bmeta =3D buffer->meta; if (!bmeta) @@ -1745,7 +1744,7 @@ static void *rb_range_meta(struct trace_buffer *buffe= r, int nr_pages, int cpu) /* Return the start of subbufs given the meta pointer */ static void *rb_subbufs_from_meta(struct ring_buffer_cpu_meta *meta) { - int subbuf_size =3D meta->subbuf_size; + unsigned int subbuf_size =3D meta->subbuf_size; unsigned long ptr; =20 ptr =3D (unsigned long)meta; @@ -1757,11 +1756,11 @@ static void *rb_subbufs_from_meta(struct ring_buffe= r_cpu_meta *meta) /* * Return a specific sub-buffer for a given @cpu defined by @idx. */ -static void *rb_range_buffer(struct ring_buffer_per_cpu *cpu_buffer, int i= dx) +static void *rb_range_buffer(struct ring_buffer_per_cpu *cpu_buffer, unsig= ned long idx) { struct ring_buffer_cpu_meta *meta; + unsigned int subbuf_size; unsigned long ptr; - int subbuf_size; =20 meta =3D rb_range_meta(cpu_buffer->buffer, 0, cpu_buffer->cpu); if (!meta) @@ -1777,7 +1776,7 @@ static void *rb_range_buffer(struct ring_buffer_per_c= pu *cpu_buffer, int idx) =20 ptr =3D (unsigned long)rb_subbufs_from_meta(meta); =20 - ptr +=3D subbuf_size * idx; + ptr +=3D (unsigned long)subbuf_size * idx; if (ptr + subbuf_size > cpu_buffer->buffer->range_addr_end) return NULL; =20 @@ -1854,13 +1853,12 @@ static bool rb_meta_init(struct trace_buffer *buffe= r, int scratch_size) * must be the same. */ static bool rb_cpu_meta_valid(struct ring_buffer_cpu_meta *meta, int cpu, - struct trace_buffer *buffer, int nr_pages, + struct trace_buffer *buffer, unsigned long nr_pages, unsigned long *subbuf_mask) { - int subbuf_size =3D PAGE_SIZE; unsigned long buffers_start; unsigned long buffers_end; - int i; + unsigned long i; =20 if (!subbuf_mask) return false; @@ -1876,7 +1874,7 @@ static bool rb_cpu_meta_valid(struct ring_buffer_cpu_= meta *meta, int cpu, } =20 buffers_start =3D meta->first_buffer; - buffers_end =3D meta->first_buffer + (subbuf_size * meta->nr_subbufs); + buffers_end =3D meta->first_buffer + (meta->nr_subbufs * PAGE_SIZE); =20 /* Is the head and commit buffers within the range of buffers? */ if (meta->head_buffer < buffers_start || @@ -2114,8 +2112,8 @@ static void rb_meta_validate_events(struct ring_buffe= r_per_cpu *cpu_buffer) struct buffer_page *head_page, *orig_head, *orig_reader; struct rb_validation_state state =3D { 0 }; bool skip =3D false; + unsigned long i; int ret; - int i; =20 if (!meta || !meta->head_buffer) return; @@ -2166,7 +2164,7 @@ static void rb_meta_validate_events(struct ring_buffe= r_per_cpu *cpu_buffer) rb_validate_buffer(head_page, cpu_buffer, meta, &state, 0, state.ts); } if (i) - pr_info("Ring buffer [%d] rewound %d pages\n", cpu_buffer->cpu, i); + pr_info("Ring buffer [%d] rewound %lu pages\n", cpu_buffer->cpu, i); =20 /* The last rewound page must be skipped. */ if (head_page !=3D orig_head) @@ -2250,7 +2248,8 @@ static void rb_meta_validate_events(struct ring_buffe= r_per_cpu *cpu_buffer) } } =20 -static void rb_range_meta_init(struct trace_buffer *buffer, int nr_pages, = int scratch_size) +static void rb_range_meta_init(struct trace_buffer *buffer, unsigned long = nr_pages, + int scratch_size) { struct ring_buffer_cpu_meta *meta; unsigned long *subbuf_mask; @@ -2350,8 +2349,8 @@ static int rbm_show(struct seq_file *m, void *v) rb_meta_subbuf_idx(meta, (void *)meta->head_buffer)); seq_printf(m, "commit_buffer: %d\n", rb_meta_subbuf_idx(meta, (void *)meta->commit_buffer)); - seq_printf(m, "subbuf_size: %d\n", meta->subbuf_size); - seq_printf(m, "nr_subbufs: %d\n", meta->nr_subbufs); + seq_printf(m, "subbuf_size: %u\n", meta->subbuf_size); + seq_printf(m, "nr_subbufs: %u\n", meta->nr_subbufs); return 0; } =20 @@ -2436,7 +2435,7 @@ static void *ring_buffer_desc_page(struct ring_buffer= _desc *desc, unsigned int p } =20 static int __rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, - long nr_pages, struct list_head *pages) + unsigned long nr_pages, struct list_head *pages) { struct trace_buffer *buffer =3D cpu_buffer->buffer; struct ring_buffer_cpu_meta *meta =3D NULL; @@ -2564,7 +2563,7 @@ static int rb_allocate_pages(struct ring_buffer_per_c= pu *cpu_buffer, } =20 static struct ring_buffer_per_cpu * -rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu) +rb_allocate_cpu_buffer(struct trace_buffer *buffer, unsigned long nr_pages= , int cpu) { struct ring_buffer_per_cpu *cpu_buffer __free(kfree) =3D alloc_cpu_buffer(cpu); @@ -2721,8 +2720,8 @@ static void rb_test_inject_invalid_pages(struct trace= _buffer *buffer) struct ring_buffer_cpu_meta *meta; struct buffer_data_page *dpage; unsigned long entry_bytes =3D 0; + unsigned int subbuf_size; unsigned long ptr; - int subbuf_size; int invalid =3D 0; int cpu; int i; @@ -2792,8 +2791,8 @@ static struct trace_buffer *alloc_buffer(unsigned lon= g size, unsigned flags, struct ring_buffer_remote *remote) { struct trace_buffer *buffer __free(kfree) =3D NULL; - long nr_pages; - int subbuf_size; + unsigned int subbuf_size; + unsigned long nr_pages; int bsize; int cpu; int ret; @@ -5882,12 +5881,12 @@ __rb_get_reader_page_from_remote(struct ring_buffer= _per_cpu *cpu_buffer) static struct buffer_page * __rb_get_reader_page(struct ring_buffer_per_cpu *cpu_buffer) { - int max_loops =3D cpu_buffer->ring_meta ? cpu_buffer->nr_pages : 3; + unsigned long max_loops =3D cpu_buffer->ring_meta ? cpu_buffer->nr_pages = : 3; struct buffer_page *reader =3D NULL; + unsigned long nr_loops =3D 0; unsigned long overwrite; unsigned long flags; int missed_events =3D 0; - int nr_loops =3D 0; bool ret; =20 local_irq_save(flags); @@ -6205,8 +6204,8 @@ rb_iter_peek(struct ring_buffer_iter *iter, u64 *ts) struct trace_buffer *buffer; struct ring_buffer_per_cpu *cpu_buffer; struct ring_buffer_event *event; - int nr_loops =3D 0; - int max_loops; + unsigned long nr_loops =3D 0; + unsigned long max_loops; =20 if (ts) *ts =3D 0; @@ -7446,8 +7445,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer = *buffer, int order) struct ring_buffer_per_cpu *cpu_buffer; struct buffer_page *bpage, *tmp; unsigned int old_capacity; + unsigned long nr_pages; int old_order; - int nr_pages; int psize; int err; int cpu; @@ -7629,10 +7628,10 @@ static void rb_setup_ids_meta_page(struct ring_buff= er_per_cpu *cpu_buffer, struct buffer_page **subbuf_ids) { struct trace_buffer_meta *meta =3D cpu_buffer->meta_page; - unsigned int nr_subbufs =3D cpu_buffer->nr_pages + 1; + unsigned long nr_subbufs =3D cpu_buffer->nr_pages + 1; struct buffer_page *first_subbuf, *subbuf; - int cnt =3D 0; - int id =3D 0; + unsigned int cnt =3D 0; + unsigned int id =3D 0; =20 id =3D rb_page_id(cpu_buffer, cpu_buffer->reader_page, id); subbuf_ids[id++] =3D cpu_buffer->reader_page; --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0CE20344D8B for ; Sun, 6 Sep 2026 01:45:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659157; cv=none; b=eOfORYgJUw4MSVf0Tq1MpbfR3MPiQiNW0jWCr4Mch01VDqko1qmxzxkBMZ7cZM2zeNuW8rJBKiaskP2TdY6IJ3Z3EXbcUvRBMsco6u4cmrxYjMARS2kEeK+3Rp/4ZyRMP/xYWXFZEVTNzvs9Os5eaZmLD47NJMWiigvSpGhtyLI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659157; c=relaxed/simple; bh=iXIi5ivYwA3/PODZ7jihR8WiVsAVQCLsTVUWk7o3wFo=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=n30RO0p9RcFTJN60xo12FYY/ZHHxaQDscgjx3z1iis1XEF8ZhmxGQ9BdrlRJFM6OWudC8w6TjWSBnwuB6D4wgjCssDS07FZu+c+oV5u3I2BQIHEywBa36sDKCdPFKpBkxmRm7jN0RXS5LcyS9USuBy0qlD9QnAMfwiIBRSMYuLI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=bRoqUzcz; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="bRoqUzcz" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0CC231F0155A; Sun, 6 Sep 2026 01:45:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659148; bh=v0XFtH9IENWoRrFdt3w7fuiznldTKGqF/Mu7B67yTtk=; h=Date:From:To:Cc:Subject:References; b=bRoqUzczdlBUkBAb2oAZuLslGz/Fe/KXZ1LBo6X4wfZpgTkf9Kzo45nYqeABzhh0I D7W2tcFiIEifK8/cCrVG7FnDZuXL6vpJCdLsxRpWg2p5ggpVnap3m2iGXPsAaUxpb6 OotChhq25j+kDdaQumLmEIR4fCmZTvb+cCr5jpZeXZGkuGjDvfUJv9bjXlyppaFEY9 XrkG+U8TYPjmd7o0EmjRcbPgQf1UCUTQ3p6eyLx8SCIclmV5855JtxP+nQTk3lOtCK KP49GVDJqwKW7DFa0qoT2fENWxHurTMDNNeSZAhAKPxwYPy8Z/CEzldzymyRYnYwIZ SaSwsJiLBSLxg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yC-00000006PSd-3vT9; Sat, 05 Sep 2026 21:46:56 -0400 Message-ID: <20260906014656.800567194@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:42 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort Subject: [for-linus][PATCH 11/12] tracing: Fix comment in tracing_buffers_splice_read() References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt The comment about returning an error if the read fails on the first iteration is slightly incorrect. It makes it sound like the only reason it could fail on a later iteration is if the subbuf order changed. That is incorrect, it could also fail if the length passed in was not a multiple of the subbuf size. Fix the comment. Link: https://lore.kernel.org/all/20260904143527.40e73d36@gandalf.local.hom= e/ Link: https://patch.msgid.link/20260904144902.506862a1@gandalf.local.home Fixes: dae8dda341d2 ("tracing: Fix subbuf resize races with trace_pipe_raw = readers") Signed-off-by: Steven Rostedt --- kernel/trace/trace.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c index b26c4c277ce5..8658cad53cb5 100644 --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c @@ -7296,11 +7296,13 @@ ssize_t tracing_buffers_splice_read(struct file *fi= le, loff_t *ppos, r =3D ring_buffer_read_page(ref->buffer, ref->rpage, len, iter->cpu_fil= e, 1); } else if (!i) { /* - * We failed to read because the length is too small - * or unaligned. If this is the first iteration, it's - * an invalid userspace input. Otherwise, this is due - * to a subbuf order change. Do not report an error - * and just finish the read. + * If this fails to read on the first iteration, it + * means the length was too small and an error should + * be returned to user space. Otherwise, at least + * one sub-buffer was successfully read but this failed + * due to either the length was unaligned or the + * subbuf order changed. Either case, do not report + * an error. */ ret =3D -EINVAL; } --=20 2.53.0 From nobody Sat Sep 26 01:59:09 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 32A9B346E7E for ; Sun, 6 Sep 2026 01:45:52 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659155; cv=none; b=jIIn7wEKHXFMLL2dW0ahyUIcnsr1Tn66OhbwbVmKnPzml5qfHJ+23yKfKGcoHRSjgzEJf2tB1hOrW+54xwKD2XOgjA5Gx3MhAahPhbhFX8c4MZIeeNzaY9FATfQTlpiRotSSsR7IrsUfWl4KZIsUIl88JnzQmtM/7uTusQ//QJo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788659155; c=relaxed/simple; bh=seoBvo7fTTRH4weJ9hmbvv6nuBcjndCagbe16XTPuhw=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=r9UQEg/ec9s8QLRUXklnHUNE0SrG2DS58dipiLKdrp7el7SOD+vx6WH8eIuIyqGFznOei1IWwZHbWUntP24Cub3r4bx/K56ojzvSpBDSfhvPvbcUiloZgdWp+HSuaxDyi92ltZJuq7DEo9qx8pNtxQaBEKsFGB8tFwd0o+VD7F4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gtFEV3c6; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gtFEV3c6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 319DA1F01559; Sun, 6 Sep 2026 01:45:48 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788659148; bh=1XbNGsPvuLsPJbCOotGpbVqbsKtkw9+ECgLpRwY2MC8=; h=Date:From:To:Cc:Subject:References; b=gtFEV3c6tMQ4EiasPO+TebxNmKhJlS5gJPfzc9Mr21CprjDu9DBsIjfSuZ3L8v7FX /yWVlUf7yXjZl0FTwzUjXAsOKWw/BRjQNRTsNOI1BfHem7ZMhfkEgJfGeBqM8viieF IJ5pZ6aElZGxyiypIg9SwhJaGuJ3E4fmMz0sFD8GUizFvhYl6ANCAkiCVqCStZPyA/ h6Nwrdr1zeCO2Ve9fIUIzscU51xOpD/8hcnoXqK4Wa/rnJqTeeCbxppWhrXQ6fmFv9 ztbJvJUoVsop2XMiY3Up16UHlcfMDDrh3l/GxcSpvqueoyhjgQA3Mt+X0xluQjipbL 0Yo63hla0l3hA== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x31yD-00000006PT7-0Mf1; Sat, 05 Sep 2026 21:46:57 -0400 Message-ID: <20260906014656.957203365@kernel.org> User-Agent: quilt/0.69 Date: Sat, 05 Sep 2026 21:45:43 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort Subject: [for-linus][PATCH 12/12] ring-buffer: Use a macro for static buffer bits References: <20260906014531.720267751@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt Instead of hard coding 30 for the number of bits used for the static buffer ids in two places, create a macro. This way if it changes in the future, it will change in all the locations that use it. Link: https://patch.msgid.link/20260904151641.17eae0aa@gandalf.local.home Signed-off-by: Steven Rostedt --- kernel/trace/ring_buffer.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 220b8405adfc..b88c75b52e8f 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -335,6 +335,9 @@ static __always_inline unsigned int rb_read_page_capaci= ty(struct buffer_data_rea return (PAGE_SIZE << rpage->order) - BUF_PAGE_HDR_SIZE; } =20 +/* The number of bits for static buffer ids */ +#define RB_STATIC_BITS 30 + /* * Note, the buffer_page list must be first. The buffer pages * are allocated in cache lines, which means that each buffer @@ -350,7 +353,7 @@ struct buffer_page { local_t entries; /* entries on this page */ unsigned long real_end; /* real end of data */ unsigned order; /* order of the page */ - u32 id:30; /* ID for external mapping */ + u32 id:RB_STATIC_BITS; /* ID for external mapping */ u32 range:1; /* Mapped via a range */ struct buffer_data_page *page; /* Actual data page */ }; @@ -663,7 +666,7 @@ static unsigned long rb_static_max_pages(void) * Static ring buffers are using bpage::id and must account for the * reader page. */ - return (1UL << 30) - 1; + return (1UL << RB_STATIC_BITS) - 1; } =20 struct ring_buffer_iter { --=20 2.53.0