From nobody Fri Sep 25 23:09:13 2026 Received: from mail-ej1-f53.google.com (mail-ej1-f53.google.com [209.85.218.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9905B4ADD88 for ; Mon, 7 Sep 2026 15:07:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788793675; cv=none; b=Y/hKvGFcu5mWbTvN3xaN7m0cH/KiO3jS9QQ8Io1lKJH0Cy6w7f5IyXwbtgfpp8SlyKQ0LJYxHDzaYGDHnfugtADscL3xaEUBQ+qbrIcvFKTR9RbUSIXHbr3sA7xl2zl5jLrjSLdiMDkUj70Dm++Imh3NAhZb8OQfClvw0oFXUYQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788793675; c=relaxed/simple; bh=QIW325cnNhaMcdbwLES3qKrrKOmDydBwFAQQk6R+p10=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=YmCuYgA7guH55AOIFNkxqgPTMTN/IUVSrkd9UPZWob5aMvXU4g/dW1v6W+uxb62RlMFI/Y0oGmm62Egq6SEXNiX3e+WxxtpND09lPW1BTi9yrLutAmCFWp1+y/kYc0eeuYzyHP1j69xG1uotwBW9jsIrUtRoJPr1d/jX4mHCrQg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=iPQjYbIy; arc=none smtp.client-ip=209.85.218.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="iPQjYbIy" Received: by mail-ej1-f53.google.com with SMTP id a640c23a62f3a-c253425b253so523820966b.1 for ; Mon, 07 Sep 2026 08:07:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788793672; x=1789398472; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=t0UFyMkj4yYcM7C9qagjMJD0/AtaB8gajsJEK2CwTCQ=; b=iPQjYbIyxf73OTYkMOoCUR6O/68sStd2SWgDycwrJOfwuz85JadFOBl44GBZ4sgaER DsPpT8R7dRjdthk3/ndAbKTvFSxvd+fIb8uYmgc2b/ghM17vWBibG7H+xaAm9+BlIZcV uqO/0dfl94FIE19W4eGFq3QkxJnRSUTvTb2DAmy0OGQPkaLBxqk+coyzID1lqQ7vjOLY 0dYGoFlO0pIqT29rT038tAtbEMKSLVypSFipfJMYIIWl9iOFguhu/Ie86HUP0/aH8OpM 54rEeXIxOXIB4zXDPor8Uuuqp1q7OpFPnl9MT1fG0IQDV+IK4wB/AxypEAZlqka4fsSB 9Tcw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788793672; x=1789398472; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=t0UFyMkj4yYcM7C9qagjMJD0/AtaB8gajsJEK2CwTCQ=; b=bULjxVUqvsBYAOyxm38752MWKZeqVzKI6cSfrov6i4EEcaH7S2XnaQyjNvof4lAnnb CN0LRQcVirEzXfW/a5toPBQqMndV002xaoPPWXJ4huLGTgoUM5gxj9tsTC1EsMmDYUgN ir+V/RKp+rRJc6jH7vAvYrIyxAHk8lXm4ln6jTRhy3Kp9iukCPDw9mMd6uS0PKK85qrf wcY9qEGZOqAw4FuurXtDHFIEK6u8suw8uyzFB02oiqfn/AGEp3QoHoJJjvSpHQLW7qOz L8u1X5UWTFp2pDwZC15KVtyHvzWGtxbhAtHzOehJ/NMD7C1ehgKmpNhBOdlWnRBXegNX Fo6g== X-Forwarded-Encrypted: i=1; AKwUvByhsCYuDz/roCVvDVYfalB4QumClIR+y3rwJQALrqK/WUCvlLBPTzKSFXKccZ3bHzuzR98nOXQaXI2zjYw=@vger.kernel.org X-Gm-Message-State: AFuF++kibYuCrO09C7fzYItEVKkVlz9EFiUUbWQp/KUDSuoG/Rki7DpI T+Jbvk7idjAMgUd/k9hsOrz40pOvJEZJgaRXuAiKl/8OzZYjU4W9uxBp X-Gm-Gg: AYBFou2w2WYdEUttVxl+sb2A4egan8QWMZK4Sle1nBNzxne4Dw8MNnrJXBmVyADxagz Va8a37ngQjFO3pnIWlbvYdEiz1XiEuUt3Aq6uvspmz0xY7oNFRXV9qL0EE84HtYfmerbhcsXfYX iiRgleq9Zf+zWTXaLqmeIlhunF4dd0LXoicDnkKwz19L2ClXLyZNTQZEPF/Vf0w+Q9gDVvqkBtU IGiWjqPcxPxg3s3rhRkJOw9RSctgrNcO2+5GkHygNEpWg6+ltHTPwKgq23Y2kGl0iBoYeUvA0C/ 0Waa3wClzEsTMCdTnjFztWAdRGilJ574RfhZa3NyekZyDNW/ISU4yOG4+O7U6EbwHr38X4GZM4j 7F9Mf/K1SumX+zJQ51fhAkC2bNusUbGmOkhJXLs6M5a2o/1VVNlFdh7dYx2VUrRA4u64RXZAr3V OZi2A74WAoU7kquZDLV1XtQmGh56wIUnAjVKQQ7e7waqZlWfAp8xkETTfB X-Received: by 2002:a17:907:3d44:b0:c27:420b:7c90 with SMTP id a640c23a62f3a-c27420ba0camr424931166b.48.1788793671549; Mon, 07 Sep 2026 08:07:51 -0700 (PDT) Received: from grower.astralinux.ru ([82.22.172.205]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c260d5773c5sm478376566b.40.2026.09.07.08.07.48 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 07 Sep 2026 08:07:51 -0700 (PDT) From: Alexander Martyniuk To: sashal@kernel.org, stable@vger.kernel.org, Greg Kroah-Hartman Cc: alexevgmart@gmail.com, karolherbst@gmail.com, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, mhiramat@kernel.org, mingo@kernel.org, nouveau@lists.freedesktop.org, ppaalanen@gmail.com, rostedt@goodmis.org, tglx@linutronix.de, Mark Rutland , Mathieu Desnoyers , Andrew Morton Subject: [PATCH v2 5.10 1/2] tracing/mmiotrace: Remove reference to unused per CPU data pointer Date: Mon, 7 Sep 2026 18:07:25 +0300 Message-ID: <20260907150726.168416-2-alexevgmart@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260907150726.168416-1-alexevgmart@gmail.com> References: <20260903-daily-reply-0001-re-mmiotrace-null-check-5.10@kernel.org> <20260907150726.168416-1-alexevgmart@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Steven Rostedt commit 6936298393d8d8bc3cec6b704f6a774162cf9bd3 upstream. The mmiotracer referenced the per CPU array_buffer->data descriptor but never actually used it. Remove the references to it. Cc: Masami Hiramatsu Cc: Mark Rutland Cc: Mathieu Desnoyers Cc: Andrew Morton Link: https://lore.kernel.org/20250505212234.696945463@goodmis.org Signed-off-by: Steven Rostedt (Google) Signed-off-by: Alexander Martyniuk --- Backport fix for CVE-2026-80689 kernel/trace/trace_mmiotrace.c | 12 ++---------- 1 file changed, 2 insertions(+), 10 deletions(-) diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c index e8ae2d92a678..55ba76bea98b 100644 --- a/kernel/trace/trace_mmiotrace.c +++ b/kernel/trace/trace_mmiotrace.c @@ -294,7 +294,6 @@ __init static int init_mmio_trace(void) device_initcall(init_mmio_trace); =20 static void __trace_mmiotrace_rw(struct trace_array *tr, - struct trace_array_cpu *data, struct mmiotrace_rw *rw) { struct trace_event_call *call =3D &event_mmiotrace_rw; @@ -319,12 +318,10 @@ static void __trace_mmiotrace_rw(struct trace_array *= tr, void mmio_trace_rw(struct mmiotrace_rw *rw) { struct trace_array *tr =3D mmio_trace_array; - struct trace_array_cpu *data =3D per_cpu_ptr(tr->array_buffer.data, smp_p= rocessor_id()); - __trace_mmiotrace_rw(tr, data, rw); + __trace_mmiotrace_rw(tr, rw); } =20 static void __trace_mmiotrace_map(struct trace_array *tr, - struct trace_array_cpu *data, struct mmiotrace_map *map) { struct trace_event_call *call =3D &event_mmiotrace_map; @@ -349,12 +346,7 @@ static void __trace_mmiotrace_map(struct trace_array *= tr, void mmio_trace_mapping(struct mmiotrace_map *map) { struct trace_array *tr =3D mmio_trace_array; - struct trace_array_cpu *data; - - preempt_disable(); - data =3D per_cpu_ptr(tr->array_buffer.data, smp_processor_id()); - __trace_mmiotrace_map(tr, data, map); - preempt_enable(); + __trace_mmiotrace_map(tr, map); } =20 int mmio_trace_printk(const char *fmt, va_list args) --=20 2.43.0 From nobody Fri Sep 25 23:09:13 2026 Received: from mail-ej1-f50.google.com (mail-ej1-f50.google.com [209.85.218.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F15804C9573 for ; Mon, 7 Sep 2026 15:07:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.218.50 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788793680; cv=none; b=pugsTk8up5Gdu3G/ghKyBiBLXnWhQQ2LNjWjhsOhQpgWoS06uQE+7PIHvrLa6/xlRcUSQXZfTO7YjfEJ4z052n1S9mMii+ntBaGazMo+5+K5bgW8+isvRTYXmwA0W+a0bPMdNiqayIluRKkG5GW18aBs+wBq5/VwhxZfRyQueBg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788793680; c=relaxed/simple; bh=K/oPKH1hT2lsIgOTcwhzcOTUD9vSEUwNLjMf0r7CPEI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ibsagfhCCk9vYrFZ7fwk/mQ77RHPBB3297FERu0kQI28Guf++turOzo5sKWpyWHw0f27eSuTx7eRcukq3gEu6HjaWaxWkk9dWg5shzjwoxVlhageCPwczX2VcR9JYq17AnOdcsNfXW5mm4HbG7gHnWSNdjuuDVaKRCARifXeKGI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=mGC4zt77; arc=none smtp.client-ip=209.85.218.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="mGC4zt77" Received: by mail-ej1-f50.google.com with SMTP id a640c23a62f3a-c2569aa5116so699720166b.0 for ; Mon, 07 Sep 2026 08:07:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1788793675; x=1789398475; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=jzZ6irP1IJm4iTmeFvSaA6y2Zk76xV4+MV1ou0UvxWY=; b=mGC4zt77dhQBYFuHFXy7g1FjFOYn2V4PLb2fk0SykPgUbRbSTIdNLq/GrhH58TYvYU 2XR+479JwR7zr5/osfUPcO5SYt0vww7+JAdCd8LAq7XKE0pq7aPmvte3s8BQgvurY++N C+h5NCbH3mYnTePjgnXMxZfOOekGp1jIYJSXTAde6TmjIjVhTxgnHck1uVnFo8irevdQ bNVHYeGnpIxVQ48p00fumjgQFH6EzZxgebGgq+IxKg6i/SaRb4unbA/WRJ1Ujyu2jDPt 9W1Gpc9oiBQciiU0r17ecQztH74+ygJ2U+6DYjxDY46rmUt+NRw+4dLVit98X/UCIl1y J+cA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788793675; x=1789398475; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=jzZ6irP1IJm4iTmeFvSaA6y2Zk76xV4+MV1ou0UvxWY=; b=XOEZjBY3xf6HEjSuJV0YcMXTz6mfE2wiNkzqOLgaf0THqDU0CyJzdTfBIXv/5N+oVt jUYVvzKs5y0w/140E5AyKsGyKYYrVkjs+2/6rseaIfarVvdRY6d3g08aWvbfw+mB/jWQ Y91eAwYVJXgHBvOa9ioNxU2QNyKMPfnkmMB2ANjriMEsU3KJ/ara42tRPAIGDqczP43y V+Y4vWmMRz1r5/HBD+5JInjfbejePWGdOvb6JQXH3cndDZOXb6P2vyWFyeuz6DNeiUqg OmJLiQS6ZMYcGo2nPi/jZGMFA8MQbnoenv9LIzE5l0Dmy33zTK9VFZR2UGSQF7ay6sYP GdsQ== X-Forwarded-Encrypted: i=1; AKwUvBzcJIC2XU4cRMOKV0aZ3Z+rYkDNdml9CwR4Pu+oGzAXRbMYLRCWL7cb3Qql/MfTO3AvBaAxzx4uzPDO5Cc=@vger.kernel.org X-Gm-Message-State: AFuF++nNIYrc5DaolxWsoguCmEHLlToxL/y2fdXCeaI8atTMtmd1dwdY 4YcZ4E7IHL10hVj0cS+00JOM5m+idP+PnBfJ+++nBvuIhPeRKiQPbMkW X-Gm-Gg: AYBFou3ceqrWdJ9W/pNGuQN298X4Z696SNfMKXjbRIwLFqREuurRbjIG2I//IAhdbqk 09adMjTRbHj7kk1nlOaBrVamvsfcAwAnbsWDBkneyKGPtVqF49eyNdLdlWQsF8bbHgis7sJjcGQ ZBCmhfV1ksZapemHQJjoLVaRx3caHIqL9TI45E+y0NBcrsi64gz4fafvClNw4ZKA0cZkGLTc6sO hFHkP14E1Zq/p7MHxeIXczN7vbpH0BGeGIsJ0yD20doxmdrV1OdwuT3DxGYDV1L0d1bQLleQa10 Kha/PF/GGHVNuzbkIFi+ngMXJCP0Ge4SxYgd4DkDD2FrrTvFPQqR7T5hFgurEth6aFyMdNvu4ig uN1F/XAKYROClxZ4UCZWXS6p9puHPbpcOQKfg8/XcTEUD5x91DSSu2st6c6U5Ar0ZH9ZEjW8WlO vXtVyC7Ib/kmytGQmNztbyPw+9MNgA27bxLAePwySPH8fyC3ck99/oWZTznRGndvo2KgljG3M= X-Received: by 2002:a17:907:d501:b0:c26:1f8f:ed53 with SMTP id a640c23a62f3a-c261f8ffdd0mr686260766b.12.1788793675037; Mon, 07 Sep 2026 08:07:55 -0700 (PDT) Received: from grower.astralinux.ru ([82.22.172.205]) by smtp.gmail.com with ESMTPSA id a640c23a62f3a-c260d5773c5sm478376566b.40.2026.09.07.08.07.52 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 07 Sep 2026 08:07:54 -0700 (PDT) From: Alexander Martyniuk To: sashal@kernel.org, stable@vger.kernel.org, Greg Kroah-Hartman Cc: alexevgmart@gmail.com, karolherbst@gmail.com, linux-kernel@vger.kernel.org, lvc-project@linuxtesting.org, mhiramat@kernel.org, mingo@kernel.org, nouveau@lists.freedesktop.org, ppaalanen@gmail.com, rostedt@goodmis.org, tglx@linutronix.de Subject: [PATCH v2 5.10 2/2] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Date: Mon, 7 Sep 2026 18:07:26 +0300 Message-ID: <20260907150726.168416-3-alexevgmart@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260907150726.168416-1-alexevgmart@gmail.com> References: <20260903-daily-reply-0001-re-mmiotrace-null-check-5.10@kernel.org> <20260907150726.168416-1-alexevgmart@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: "Masami Hiramatsu (Google)" commit 12b80cdbc54cf615b4717a4e8180063408091ea2 upstream. mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are invoked while mmio_trace_array is NULL (e.g. before initialization or after disabled), accessing tr->array_buffer.buffer will result in a NULL pointer dereference crash. Fix this by adding an explicit NULL check for tr at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map(). Link: https://patch.msgid.link/178524300062.56416.8362487250709962380.stgit= @devnote2 Fixes: f984b51e0779 ("ftrace: add mmiotrace plugin") Assisted-by: Antigravity:gemini-3.6-flash Signed-off-by: Masami Hiramatsu (Google) Signed-off-by: Steven Rostedt Signed-off-by: Alexander Martyniuk --- Backport fix for CVE-2026-80689 kernel/trace/trace_mmiotrace.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c index 55ba76bea98b..ce45c5ee5227 100644 --- a/kernel/trace/trace_mmiotrace.c +++ b/kernel/trace/trace_mmiotrace.c @@ -297,11 +297,15 @@ static void __trace_mmiotrace_rw(struct trace_array *= tr, struct mmiotrace_rw *rw) { struct trace_event_call *call =3D &event_mmiotrace_rw; - struct trace_buffer *buffer =3D tr->array_buffer.buffer; + struct trace_buffer *buffer; struct ring_buffer_event *event; struct trace_mmiotrace_rw *entry; int pc =3D preempt_count(); =20 + if (!tr) + return; + + buffer =3D tr->array_buffer.buffer; event =3D trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW, sizeof(*entry), 0, pc); if (!event) { @@ -325,11 +329,15 @@ static void __trace_mmiotrace_map(struct trace_array = *tr, struct mmiotrace_map *map) { struct trace_event_call *call =3D &event_mmiotrace_map; - struct trace_buffer *buffer =3D tr->array_buffer.buffer; + struct trace_buffer *buffer; struct ring_buffer_event *event; struct trace_mmiotrace_map *entry; int pc =3D preempt_count(); =20 + if (!tr) + return; + + buffer =3D tr->array_buffer.buffer; event =3D trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP, sizeof(*entry), 0, pc); if (!event) { --=20 2.43.0