From nobody Fri Sep 25 11:05:03 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D9C613876C5; Sun, 13 Sep 2026 17:17:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319849; cv=none; b=uYgvuBAvHD+r55Hm1SFRvYrMLPM0Ttfo6VdsCMjlTG4S6DGtceDC6A0yh/5cS8ZNDp3vrnwwQL46HJxFHWn6GOVm83xtGMrf7tjvvOqsFMb+V+pufk83bFOgvNq1iwMQDpNCHaV2hSArSfuZ67lMLSoB4tGUpXqFYYoedHdMEok= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319849; c=relaxed/simple; bh=PCrMvJZRXyZvSFsHKytg5k3o8+DFbRdxMwl6rjj4o3M=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=FlJeGkwVjRo8wIc3s5rjc3Fby5GKeJZS59VG+18L2scvbIi0ZSCo1iVNbWE7kTPtQvT9nIFg/lzGqgbpsqpf4kbhM7Tek4a59Bn4naqCI9XeSxJyUDPfNvHq+pQOO9GSuYi6/A8PuDglSV9UbyD6Z6NKROLUw8cv2wMe+A5wQWE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Se9QN1en; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Se9QN1en" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8C6121F00893; Sun, 13 Sep 2026 17:17:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789319843; bh=GbJxA/XWPkGKugAgSRyy9K65mtSnbgmieUz75IVn5K4=; h=Date:From:To:Cc:Subject:References; b=Se9QN1enyUFIhJAukCjf8aVzEMHHQHNfn+O4syFnG+khabQapulZMw1nol4uA9vqH bmLnqf10+/bKt883CpnTk59ZwUtLGEvBhk1jcBVAW+P4D7DY+OSIGqBlzlPzPT3dyp TJUZ15ik1Cy2RFUcmrwgmRLCWguwrcltr5NHY8Yh1nzNKaoUDyYNIqRpRaLA220JnC 2Em4apzoFtVOxhkg8l5RSN9SYyeVV5L48jrqRUa737LMaYGBV/XHdpjiMVcaEO9Ett wUsTa+QPIvEIZv8I/7d/h8/8xBt17oT28w4Sh1qLvZUja1UKSK2vWAuM39m/rXSHvL iOLxOk9tHwn8w== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x5nqr-0000000AQZ4-2jYA; Sun, 13 Sep 2026 13:18:49 -0400 Message-ID: <20260913171849.455534017@kernel.org> User-Agent: quilt/0.69 Date: Sun, 13 Sep 2026 13:18:00 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, kernel test robot , Leon Hwang Subject: [for-linus][PATCH 1/5] ftrace: Use rcu_assign_pointer() for tmp_ops filter hash References: <20260913171759.469375546@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Leon Hwang tmp_ops.func_hash->filter_hash is annotated __rcu, but update_ftrace_direct_mod() assigns hash to it directly. Sparse reports an address-space mismatch. Use rcu_assign_pointer() for the assignment. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260911142512.19344-1-leon.hwang@linux.dev Fixes: 50b35c9e50a8 ("ftrace: Use hash argument for tmp_ops in update_ftrac= e_direct_mod") Reported-by: kernel test robot Closes: https://lore.kernel.org/oe-kbuild-all/202609110704.Q3M5vCDV-lkp@int= el.com/ Signed-off-by: Leon Hwang Signed-off-by: Steven Rostedt --- kernel/trace/ftrace.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c index 53d5db60bfa5..673a54fdf392 100644 --- a/kernel/trace/ftrace.c +++ b/kernel/trace/ftrace.c @@ -6675,7 +6675,7 @@ int update_ftrace_direct_mod(struct ftrace_ops *ops, = struct ftrace_hash *hash, b =20 /* Enable the tmp_ops to have the same functions as the hash object. */ ftrace_ops_init(&tmp_ops); - tmp_ops.func_hash->filter_hash =3D hash; + rcu_assign_pointer(tmp_ops.func_hash->filter_hash, hash); =20 err =3D register_ftrace_function_nolock(&tmp_ops); if (err) --=20 2.53.0 From nobody Fri Sep 25 11:05:03 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DD7B338655D; Sun, 13 Sep 2026 17:17:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319851; cv=none; b=dlEKoqwjPc1qL/kCRvoeaOZduyE9gj+k99YLZ9ZgojUlaupVATz1Pqv+I4075iKhGzqMlDGF/2ZREQDt2NeVNhCuadWW6wbxPoPiEHbgigyR9TJdxgxFXzAPMx68S1Z6O5dPvJISfManRwE82/sKhBh0Tt6H6e5/CFp8E18guOA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319851; c=relaxed/simple; bh=Hjb3jb3USV71UqUDGp095Qnz40Hf9kgKYHVuv3k5n7s=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=MLMwOjEZFpJdg5/KMCXeVxz+cckVAzNJsNPfWjuAVWs6KrMqlX1+xC1IF4p/U9XASNIwCGLd58wAOololuwdE+PnrPXe22tNwslsk+IbISDtxRVJ17GGu2jb+5gWJWIYZthBZ1k77kKGoWdzQHlHnPUaHz2C0/5jlNpkd1G6GDc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nL2fkYtQ; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nL2fkYtQ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C3BFE1F00898; Sun, 13 Sep 2026 17:17:23 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789319843; bh=Raxewkw96Z82Y9nRPZmzJgCe1hQ47cf/cMMXBMB6o0o=; h=Date:From:To:Cc:Subject:References; b=nL2fkYtQ8ohLg8H5gnFrc29W83XppU0ipP2Riu+6c88MNitCroygteSukxj/cqAKr 94lMk263pDoVyHIfRW2O5VATDjVFjAq43EvYrihLWCrtddTcH3Gq7ttSIIgMYpGy/g ZSDCV/QK/m5zUU6UTpLx8YDHcDguRUc1g0+ldFs8eY5zS27IFzedrnXyQ2pMkSc5O9 8K1OLQ8wpmrlHWikZOjBKsIHxkNW72favqWKn5GQ5+7SbCt3qHm0s5KwXh76kJP+ce rm73oyPzU8xk/LSbM4TQPL6N/P++5D0qYwgYSz2R7V1mp5ObTI6EUiBed8KrFTUucN Olr/y2IsT3u2w== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x5nqr-0000000AQZc-3fRE; Sun, 13 Sep 2026 13:18:49 -0400 Message-ID: <20260913171849.676672435@kernel.org> User-Agent: quilt/0.69 Date: Sun, 13 Sep 2026 13:18:01 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, Alexander Gordeev , =?UTF-8?q?Ali=20Ahmet=20Memi=C5=9F?= Subject: [for-linus][PATCH 2/5] tracing: Dont dereference trace_event_file in deferred trigger free References: <20260913171759.469375546@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: =3D?UTF-8?q?Ali=3D20Ahmet=3D20Memi=3DC5=3D9F?=3D The enable_event trigger defers trace_event_put_ref() to the trigger free kthread, but the trace_event_file can already be freed when the instance is removed. Keep the trace_event_call directly in enable_trigger_data so the deferred free does not access the freed trace_event_file. Cc: stable@vger.kernel.org Fixes: e091351b3881 ("tracing: Delay module ref count for "enable_event" tr= igger") Reported-by: Alexander Gordeev Closes: https://lore.kernel.org/all/20260828134340.2501683A24-agordeev@linu= x.ibm.com/ Link: https://patch.msgid.link/20260911155650.354844-1-aliamemis@disroot.org Signed-off-by: Ali Ahmet Memi=C5=9F Signed-off-by: Steven Rostedt --- kernel/trace/trace.h | 1 + kernel/trace/trace_events_trigger.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/trace/trace.h b/kernel/trace/trace.h index bd3c8f80300f..3749485a7d85 100644 --- a/kernel/trace/trace.h +++ b/kernel/trace/trace.h @@ -1953,6 +1953,7 @@ struct event_trigger_data { =20 struct enable_trigger_data { struct trace_event_file *file; + struct trace_event_call *call; bool enable; bool hist; }; diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_event= s_trigger.c index 149300cc5e8a..4d2fde996c0f 100644 --- a/kernel/trace/trace_events_trigger.c +++ b/kernel/trace/trace_events_trigger.c @@ -1728,7 +1728,8 @@ static void enable_trigger_private_data_free(struct e= vent_trigger_data *data) { struct enable_trigger_data *enable_data =3D data->private_data; =20 - trace_event_put_ref(enable_data->file->event_call); + /* The file may already be freed here, only the call is kept alive */ + trace_event_put_ref(enable_data->call); kfree(enable_data); } =20 @@ -1801,6 +1802,7 @@ int event_enable_trigger_parse(struct event_command *= cmd_ops, enable_data->hist =3D hist; enable_data->enable =3D enable; enable_data->file =3D event_enable_file; + enable_data->call =3D event_enable_file->event_call; =20 trigger_data =3D trigger_data_alloc(cmd_ops, cmd, param, enable_data); if (!trigger_data) --=20 2.53.0 From nobody Fri Sep 25 11:05:03 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6D6A138333F for ; Sun, 13 Sep 2026 17:17:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319849; cv=none; b=ttuQ7pghPcP+q6JLeWHPAc4MOev0iJt8XKaN47guKvHuwk0LK20xFL+8+ApiBqDd/MYMdTF0b8rtwDjkIbeZMrwOivrphaAS1T4Jv3Wx7/XXHw08wfbSJ+l++g/SyYgtssfkBLKgvoYDv+XHPkvp9kMkxOHFs8GelnDj3KYEgAw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319849; c=relaxed/simple; bh=shyFsPe6/+8qpbPdileocoW4dxnfkSl2KYeEpR/6IUs=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=DNuTuencmwAki7SwSaGAZkXW29guZJYZj5e64WdHtvKlyHpRLXwRo7/atulUHpGRRkd2CQ17vrNsur3p6JtS3idCXXnj5ibfJe9j/71EReYrrqao8YsZeIctGlYuj4HKcC2MsNu+7VYyGKfYrzpdFDzZQThnac3ZVIGWzINwDW4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=nJCzminw; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="nJCzminw" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0D9701F00899; Sun, 13 Sep 2026 17:17:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789319844; bh=rjxp0fEObwYxGRblo6C9NEX7rlxIdttxKlcZc1d/Dps=; h=Date:From:To:Cc:Subject:References; b=nJCzminwRh4mI57BQ+FvqEb+9enEcIy5Ml9ZLp587+OyANiN2VnoI3sB0apL+nf3C Pg/GnkgX6raGgsiVCWWrQFHPcNNVyLz2CU9XBmSltaGqr3tqaDD3HcCzVURKACdlQo K5QSnJklKMiYsJskX4itEDr9xmP2w9pZHcl53eFVt9QraHc4KVCPOQnZEJ5nBue1Zu 7+s7iOlzixqNWbfmWWHUpQKgNBfhdN+rqj3mR46M50e/apQisBXffcGmdiqUYcFJ/3 NgYugUF1XrDQ4e4YzEJfsqtqHcxQt05Nbh2lLL0Q44Vu0FttcY0voToDGprTLhD8H6 B5+hYfs2zrJmg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x5nqs-0000000AQaA-0Ogv; Sun, 13 Sep 2026 13:18:50 -0400 Message-ID: <20260913171849.896180781@kernel.org> User-Agent: quilt/0.69 Date: Sun, 13 Sep 2026 13:18:02 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort Subject: [for-linus][PATCH 3/5] tracing/remotes: Account for ring buffer page header in size calculation References: <20260913171759.469375546@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Vincent Donnefort trace_buffer_desc_size() and trace_remote_alloc_buffer() undercount the required pages because every ring buffer page contains a header (BUF_PAGE_HDR_SIZE). Account for that header to ensure allocated remote ring buffers aren't smaller than requested by the user. The newly introduced helper __calc_nr_pages_ring_buffer_desc() can return a value that overflows the descriptor nr_pages field (32 bits). Link: https://patch.msgid.link/20260911193937.602202-2-vdonnefort@google.com Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes") Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- include/linux/ring_buffer.h | 15 +++++++++++++-- kernel/trace/trace_remote.c | 2 +- 2 files changed, 14 insertions(+), 3 deletions(-) diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h index afc7daa6ee7d..11bffb6a142d 100644 --- a/include/linux/ring_buffer.h +++ b/include/linux/ring_buffer.h @@ -3,8 +3,9 @@ #define _LINUX_RING_BUFFER_H =20 #include -#include #include +#include +#include =20 #include =20 @@ -279,9 +280,19 @@ static inline struct ring_buffer_desc *__first_ring_bu= ffer_desc(struct trace_buf return (struct ring_buffer_desc *)(&desc->__data[0]); } =20 +/* + * Returns the number of pages for a ring_buffer_desc. The caller must ens= ure it + * does not overflow ring_buffer_desc::nr_page_va. + */ +static inline unsigned long __calc_nr_pages_ring_buffer_desc(size_t size) +{ + /* Takes into account the reader page */ + return max(DIV_ROUND_UP(size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1; +} + static inline size_t trace_buffer_desc_size(size_t buffer_size, unsigned i= nt nr_cpus) { - unsigned int nr_pages =3D max(DIV_ROUND_UP(buffer_size, PAGE_SIZE), 2UL) = + 1; + unsigned long nr_pages =3D __calc_nr_pages_ring_buffer_desc(buffer_size); struct ring_buffer_desc *rbdesc; =20 return size_add(offsetof(struct trace_buffer_desc, __data), diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c index 75fa1ffc4c96..c17902e42ef1 100644 --- a/kernel/trace/trace_remote.c +++ b/kernel/trace/trace_remote.c @@ -980,7 +980,7 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc = *desc, size_t desc_size, const struct cpumask *cpumask) { size_t min_desc_size =3D trace_buffer_desc_size(buffer_size, cpumask_weig= ht(cpumask)); - unsigned int nr_pages =3D max(DIV_ROUND_UP(buffer_size, PAGE_SIZE), 2UL) = + 1; + unsigned int nr_pages =3D __calc_nr_pages_ring_buffer_desc(buffer_size); struct ring_buffer_desc *rb_desc; int cpu, ret =3D -ENOMEM; =20 --=20 2.53.0 From nobody Fri Sep 25 11:05:03 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 51664386C0A for ; Sun, 13 Sep 2026 17:17:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319848; cv=none; b=I7CMp3GT/oU190A3XigVxtCx64J9qlsQ8Ym+mlVHGZ87ZL+Uj+ocw/Mvn907NA1CKmijKgPRA6ixtMWkrgpSaajvlIwd7FPsh+S0jDFEcSNUtkY/DxRCHCU4krZPVYkzv8QhWh360f18iywW4sSA4+CN4VHRBcQVQDh3KzUZxQk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319848; c=relaxed/simple; bh=MUjzs0JwgrAacduebmV4M1RxAHd/0cc3cjIxj/6R2kQ=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=NC8qJjLYni8pamNTh5TZUsp0kv7ixplPuofIZtXFlcwDNBqaHCY+umTZp5UnBEnnHE0orRal0RK9F4Q0EZZ1mMzamaqm0/OhyYdCgYMpdWMPKX3tySL+g9BrgYN+LsJkwwufRtTzf5YkcMblPZTdrFKs7qMyzEaVRHZA2IKsKx8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=DtdVdDye; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="DtdVdDye" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 364DC1F0089B; Sun, 13 Sep 2026 17:17:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789319844; bh=b4nohpa6rw6Jtm0z0TblGaxx+Ubk55nsfmnZONif07o=; h=Date:From:To:Cc:Subject:References; b=DtdVdDyeM/+izgEEtPjtRaGuNjb7f6ysdebkfIbHu4cDxWqr0Wkle+qDEvXp655fP t2NX3YOwMvm2GyUD4Y9mME7SUZZUnhEKUv4VTSG7I7CNDbTveV0ttV98kzPHJUXPFq YJnRbFCxF3j/VdvdEjYCRqSMjza8M8qxZmBtUtpgbmjt0WNU7ewdrEFJaIXQhj/nia NQQLfLZvtgQWXrXq3q77+R9zdn2rrLDWjmAT1M5kg1UIo90gbWMHFIKs4diRwysGpb x79Hj7piBdM9Q52OqqRTFM470RUlM59BbtSrFVc+IXw1GHAvdp0K4/rJWHYeK635mI NW7u8JBjgedjg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x5nqs-0000000AQai-1IjW; Sun, 13 Sep 2026 13:18:50 -0400 Message-ID: <20260913171850.115977878@kernel.org> User-Agent: quilt/0.69 Date: Sun, 13 Sep 2026 13:18:03 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , Vincent Donnefort Subject: [for-linus][PATCH 4/5] tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing References: <20260913171759.469375546@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Vincent Donnefort The number of pages per remote ring buffer is capped by ring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to overflow that field would silently allocate a descriptor smaller than what was asked for. Return SIZE_MAX from trace_buffer_desc_size() on nr_page_va overflow. Link: https://patch.msgid.link/20260911193937.602202-3-vdonnefort@google.com Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes") Signed-off-by: Vincent Donnefort Signed-off-by: Steven Rostedt --- include/linux/ring_buffer.h | 4 ++++ kernel/trace/trace_remote.c | 6 +++++- 2 files changed, 9 insertions(+), 1 deletion(-) diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h index 11bffb6a142d..eac3e9080c3c 100644 --- a/include/linux/ring_buffer.h +++ b/include/linux/ring_buffer.h @@ -295,6 +295,10 @@ static inline size_t trace_buffer_desc_size(size_t buf= fer_size, unsigned int nr_ unsigned long nr_pages =3D __calc_nr_pages_ring_buffer_desc(buffer_size); struct ring_buffer_desc *rbdesc; =20 + /* Capped by ring_buffer_desc::nr_page_va */ + if (nr_pages > UINT_MAX) + return SIZE_MAX; + return size_add(offsetof(struct trace_buffer_desc, __data), size_mul(nr_cpus, struct_size(rbdesc, page_va, nr_pages))); } diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c index c17902e42ef1..2d5bc423efca 100644 --- a/kernel/trace/trace_remote.c +++ b/kernel/trace/trace_remote.c @@ -980,9 +980,12 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc= *desc, size_t desc_size, const struct cpumask *cpumask) { size_t min_desc_size =3D trace_buffer_desc_size(buffer_size, cpumask_weig= ht(cpumask)); - unsigned int nr_pages =3D __calc_nr_pages_ring_buffer_desc(buffer_size); struct ring_buffer_desc *rb_desc; int cpu, ret =3D -ENOMEM; + unsigned int nr_pages; + + if (min_desc_size =3D=3D SIZE_MAX) + return -E2BIG; =20 if (desc_size < min_desc_size) return -EINVAL; @@ -991,6 +994,7 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc = *desc, size_t desc_size, desc->struct_len =3D min_desc_size; =20 rb_desc =3D __first_ring_buffer_desc(desc); + nr_pages =3D __calc_nr_pages_ring_buffer_desc(buffer_size); =20 for_each_cpu(cpu, cpumask) { unsigned int id; --=20 2.53.0 From nobody Fri Sep 25 11:05:03 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 47309370D41; Sun, 13 Sep 2026 17:17:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319849; cv=none; b=N86BkyKy8bqdcCp3DqGCcxlQISguxAFslQGVxFJrSDP8JJQjKpmEeaatCrLJwHTBHFfCzcXemovPEMHrGoGI7Lmlz1I7rpTqbhY4xUognXtq27qVeIh3p+93uKE4HR6xa6wQ8yRl2j9Aa+CpDKAafelQazzR+IMMznKdmNdKY14= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789319849; c=relaxed/simple; bh=LWejCjAZqJWklyv2DB7hafpF4LepG0wucncy9KBYSUE=; h=Message-ID:Date:From:To:Cc:Subject:References:MIME-Version: Content-Type; b=DmJvfL3Ah9QFYKnv5hfuYN6S5RXpekO+x8Ln5N1oK4iwLx40drXCBWmcYSmcgMCWq2GCqT3IeROyUo4OFaMugIEKdYl/ZGGiGxbut9YOLdKOi8hrKkHt52ePRHNS1SOXBz0A58UcFESwjuc1Ze4ARqEHFyRA1xhDBI/R53SQBNE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Sly3kvFF; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Sly3kvFF" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 672861F0089C; Sun, 13 Sep 2026 17:17:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1789319844; bh=JL3u3PskqYHAUCtact9lBPOcYoii5FVMGre3nlXY8EY=; h=Date:From:To:Cc:Subject:References; b=Sly3kvFFmi90eFduiQdlZtWLKK7+QDPVtE12bzwTZhTfgpzcuEMjkbpOKQey7J/Y3 Mj3gR5a5YFLZmuKrxW+CyZ80aDQ2keotTzW0DpAmVm0nwBET/Bcu4EjYLd3dQDPB5/ TC50I/+oNvAwqdjTr5Se22e+zyRpi7GwxkE2yg9eVVHg/AXV/7cK/jNX5Aj1CsfoYT Eqftq4OSVHpHVyNLRopZf+g1US30KT+e93sAd3R5h7u45qMpvVvp139vVTNIjWGwbC wghIrx/3u6114gqs+LNtBUdlQ/fi5QAMsKtnGbEuDKX7j+d5gMEvRDzkOlB0iKz4Uv hQ1V9DU/vMrCg== Received: from rostedt by gandalf with local (Exim 4.99.4) (envelope-from ) id 1x5nqs-0000000AQbI-2B8j; Sun, 13 Sep 2026 13:18:50 -0400 Message-ID: <20260913171850.328757114@kernel.org> User-Agent: quilt/0.69 Date: Sun, 13 Sep 2026 13:18:04 -0400 From: Steven Rostedt To: linux-kernel@vger.kernel.org Cc: Masami Hiramatsu , Mark Rutland , Mathieu Desnoyers , Andrew Morton , stable@vger.kernel.org, David Carlier Subject: [for-linus][PATCH 5/5] ring-buffer: Check resize_disabled before publishing the new subbuf order References: <20260913171759.469375546@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: David Carlier ring_buffer_subbuf_order_set() stores the new order and only then walks the CPUs, returning -EBUSY if any of them has resizing disabled. A user mapped buffer has resizing disabled, and __rb_map_vma() reads buffer->subbuf_order without buffer->mutex, so an mmap of an already mapped CPU racing the failing order change sizes the mapping with the new order and inserts pages past the sub-buffer into the VMA. Check the CPUs before storing the new order. Cc: stable@vger.kernel.org Fixes: 117c39200d9d ("ring-buffer: Introducing ring-buffer mapping function= s") Link: https://patch.msgid.link/20260912103938.1127021-1-devnexen@gmail.com Signed-off-by: David Carlier Signed-off-by: Steven Rostedt --- kernel/trace/ring_buffer.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 9bc8ce8c5676..04bb94c29f58 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -7473,6 +7473,14 @@ int ring_buffer_subbuf_order_set(struct trace_buffer= *buffer, int order) =20 old_capacity =3D rb_subbuf_capacity(buffer); =20 + /* The mmap fast path reads subbuf_order without buffer->mutex. */ + for_each_buffer_cpu(buffer, cpu) { + if (!cpumask_test_cpu(cpu, buffer->cpumask)) + continue; + if (atomic_read(&buffer->buffers[cpu]->resize_disabled)) + return -EBUSY; + } + atomic_inc(&buffer->record_disabled); =20 /* Make sure all commits have finished */ --=20 2.53.0