From: Jaidev Shastri <jaidevshastri@vt.edu>

allocate_buf_for_compression() stores big_oops_buf and then
max_compressed_size, both with plain stores. pstore_dump() runs from
kmsg_dump on any CPU, tests big_oops_buf without psinfo_lock and then
reads max_compressed_size.

Store the size first and publish the buffer with smp_store_release(),
paired with smp_load_acquire() in pstore_dump().

Found with MBCheck, a static herd7-based memory consistency checker.

Signed-off-by: Jaidev Shastri <jaidevshastri@vt.edu>
---
 fs/pstore/platform.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index 1d76c9d92..1ad6e40f4 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -240,9 +240,14 @@ static void allocate_buf_for_compression(void)
 		return;
 	}
 
-	/* A non-NULL big_oops_buf indicates compression is available. */
-	big_oops_buf = buf;
 	max_compressed_size = compressed_size;
+	/*
+	 * A non-NULL big_oops_buf indicates compression is available.
+	 * pstore_dump() tests it without psinfo_lock and then reads
+	 * max_compressed_size, which is stored above. Publish the buffer
+	 * with release semantics.
+	 */
+	smp_store_release(&big_oops_buf, buf);
 
 	pr_info("Using crash dump compression: %s\n", compress);
 }
@@ -316,7 +321,8 @@ static void pstore_dump(struct kmsg_dumper *dumper,
 		record.part = part;
 		record.buf = psinfo->buf;
 
-		dst = big_oops_buf ?: psinfo->buf;
+		/* Pairs with the smp_store_release() in allocate_buf_for_compression(). */
+		dst = smp_load_acquire(&big_oops_buf) ?: psinfo->buf;
 		dst_size = max_compressed_size ?: psinfo->bufsize;
 
 		/* Write dump header. */

---
base-commit: 93f51579e7df248780214094418f205253383cc5
change-id: 20260921-mb-pstore-77eb4154d1f2

Best regards,
--  
Jaidev Shastri <jaidevshastri@vt.edu>

On Mon, 21 Sep 2026 21:16:54 -0400, Jaidev Shastri wrote:
> allocate_buf_for_compression() stores big_oops_buf and then
> max_compressed_size, both with plain stores. pstore_dump() runs from
> kmsg_dump on any CPU, tests big_oops_buf without psinfo_lock and then
> reads max_compressed_size.
> 
> Store the size first and publish the buffer with smp_store_release(),
> paired with smp_load_acquire() in pstore_dump().
> 
> [...]

Applied to for-next/pstore, thanks!

[1/1] pstore: publish big_oops_buf after max_compressed_size
      https://git.kernel.org/kees/c/7c756181175d

Take care,

-- 
Kees Cook