All of lore.kernel.org
 help / color / mirror / Atom feed
* [GIT PULL] tracing: Fixes for 7.1
@ 2026-06-04 12:47 Steven Rostedt
  2026-06-04 22:12 ` pr-tracker-bot
  2026-06-05 15:58 ` Nathan Chancellor
  0 siblings, 2 replies; 7+ messages in thread
From: Steven Rostedt @ 2026-06-04 12:47 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: LKML, Masami Hiramatsu, Mathieu Desnoyers, Peter Zijlstra,
	Eva Kurchatova


Linus,

tracing fixes for 7.1:

- Fix CFI violation in probestub function

  The probestub is a function to allow tprobes to hook to a tracepoint to
  gain access to its parameters. The function itself is only referenced by
  the tracepoint structure which lives in the __tracepoint section.
  objtool explicitly ignores that section and when processing functions in
  the kernel, if it detects one that has no references it will seal it to
  have its ENDBR stripped on boot up. This means the probstub function
  will have its ENDBR stripped and if a tprobe is attached to it with IBT
  enabled, it will go *boom*.


Please pull the latest trace-v7.1-rc6 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v7.1-rc6

Tag SHA1: f9504915379aa495293ca8adc857a1ee27407952
Head SHA1: 0652a3daa78723f955b1ebeb621665ce72bec53e


Eva Kurchatova (1):
      tracing: Fix CFI violation in probestub being called by tprobes

----
 include/linux/tracepoint.h | 8 ++++++++
 1 file changed, 8 insertions(+)
---------------------------
commit 0652a3daa78723f955b1ebeb621665ce72bec53e
Author: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
Date:   Wed Jun 3 18:31:42 2026 +0300

    tracing: Fix CFI violation in probestub being called by tprobes
    
    The probestub is a function to allow tprobes to hook to a tracepoint to
    gain access to its parameters. The function itself is only referenced by
    the tracepoint structure which lives in the __tracepoint section. objtool
    explicitly ignores that section and when processing functions in the
    kernel, if it detects one that has no references it will seal it to have
    its ENDBR stripped on boot up.
    
    This means when a tprobe is attached to the sched_wakeup tracepoint, when it
    is triggered it will call __probestub_sched_wakeup and due to the missing
    ENDBR on a CFI-enabled machine it will take a #CP exception.
    
    Fix this by adding CFI_NOSEAL annotation to probestub declaration.
    
    Cc: stable@vger.kernel.org
    Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
    Link: https://patch.msgid.link/20260603153147.573589-1-eva.kurchatova@virtuozzo.com
    Fixes: d5173f753750 ("objtool: Exclude __tracepoints data from ENDBR checks")
    Signed-off-by: Eva Kurchatova <eva.kurchatova@virtuozzo.com>
    [ Updated change log ]
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/include/linux/tracepoint.h b/include/linux/tracepoint.h
index 763eea4d80d8..2d2b9f8cdda4 100644
--- a/include/linux/tracepoint.h
+++ b/include/linux/tracepoint.h
@@ -20,6 +20,7 @@
 #include <linux/rcupdate_trace.h>
 #include <linux/tracepoint-defs.h>
 #include <linux/static_call.h>
+#include <linux/cfi.h>
 
 struct module;
 struct tracepoint;
@@ -389,6 +390,13 @@ static inline struct tracepoint *tracepoint_ptr_deref(tracepoint_ptr_t *p)
 	void __probestub_##_name(void *__data, proto)			\
 	{								\
 	}								\
+	/*								\
+	 * Annotate the probestub 'CFI_NOSEAL' to stop objtool from	\
+	 * requesting the kernel remove the ENDBR, because the only	\
+	 * references to the function are in the __tracepoint section,	\
+	 * that objtool doesn't scan.					\
+	 */								\
+	CFI_NOSEAL(__probestub_##_name);				\
 	DEFINE_STATIC_CALL(tp_func_##_name, __traceiter_##_name);	\
 	DEFINE_RUST_DO_TRACE(_name, TP_PROTO(proto), TP_ARGS(args))
 

^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [GIT PULL] tracing: Fixes for 7.1
@ 2026-05-21 22:08 Steven Rostedt
  2026-05-22 14:26 ` pr-tracker-bot
  0 siblings, 1 reply; 7+ messages in thread
From: Steven Rostedt @ 2026-05-21 22:08 UTC (permalink / raw)
  To: Linus Torvalds; +Cc: LKML, Masami Hiramatsu, Mathieu Desnoyers, David Carlier


Linus,

tracing fixes for v7.1:

- Avoid NULL return from hist_field_name()

  The function hist_field_name() is directly passed to a strcat()
  which does not handle "NULL" characters. Return a zero length
  string when size is greater than the limit.

  This is used only to output already created histograms and no
  field currently is greater than the limit. But it should still
  not return NULL.

- Do not call map->ops->elt_free() on allocation failure

  When elt_alloc() fails, it should not call the map->ops->elt_free()
  function if it exists, as that function may not be able to handle
  the free on allocation failures. The ->elt_free() should only be
  called when elt_alloc() succeeds.


Please pull the latest trace-v7.1-rc4 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v7.1-rc4

Tag SHA1: 29687dffda8036a4a5d37fc65205c44189c81a80
Head SHA1: 8f0f5c4fb9df0e19a341e0c6ed8dc4fda9124f03


David Carlier (1):
      tracing: Avoid NULL return from hist_field_name() on truncation

Masami Hiramatsu (Google) (1):
      tracing: Do not call map->ops->elt_free() if elt_alloc() fails

----
 kernel/trace/trace_events_hist.c |  6 ++----
 kernel/trace/tracing_map.c       | 17 +++++++++++++----
 2 files changed, 15 insertions(+), 8 deletions(-)
---------------------------
diff --git a/kernel/trace/trace_events_hist.c b/kernel/trace/trace_events_hist.c
index 0dbbf6cca9bc..eb2c2bc8bc3d 100644
--- a/kernel/trace/trace_events_hist.c
+++ b/kernel/trace/trace_events_hist.c
@@ -1369,10 +1369,8 @@ static const char *hist_field_name(struct hist_field *field,
 			len = snprintf(full_name, sizeof(full_name), fmt,
 				       field->system, field->event_name,
 				       field->name);
-			if (len >= sizeof(full_name))
-				return NULL;
-
-			field_name = full_name;
+			if (len < sizeof(full_name))
+				field_name = full_name;
 		} else
 			field_name = field->name;
 	} else if (field->flags & HIST_FIELD_FL_TIMESTAMP)
diff --git a/kernel/trace/tracing_map.c b/kernel/trace/tracing_map.c
index bf1a507695b6..0dd7927df22a 100644
--- a/kernel/trace/tracing_map.c
+++ b/kernel/trace/tracing_map.c
@@ -386,13 +386,11 @@ static void tracing_map_elt_init_fields(struct tracing_map_elt *elt)
 	}
 }
 
-static void tracing_map_elt_free(struct tracing_map_elt *elt)
+static void __tracing_map_elt_free(struct tracing_map_elt *elt)
 {
 	if (!elt)
 		return;
 
-	if (elt->map->ops && elt->map->ops->elt_free)
-		elt->map->ops->elt_free(elt);
 	kfree(elt->fields);
 	kfree(elt->vars);
 	kfree(elt->var_set);
@@ -400,6 +398,17 @@ static void tracing_map_elt_free(struct tracing_map_elt *elt)
 	kfree(elt);
 }
 
+static void tracing_map_elt_free(struct tracing_map_elt *elt)
+{
+	if (!elt)
+		return;
+
+	/* Only objects initialized with alloc_elt() should be passed to free_elt().*/
+	if (elt->map->ops && elt->map->ops->elt_free)
+		elt->map->ops->elt_free(elt);
+	__tracing_map_elt_free(elt);
+}
+
 static struct tracing_map_elt *tracing_map_elt_alloc(struct tracing_map *map)
 {
 	struct tracing_map_elt *elt;
@@ -444,7 +453,7 @@ static struct tracing_map_elt *tracing_map_elt_alloc(struct tracing_map *map)
 	}
 	return elt;
  free:
-	tracing_map_elt_free(elt);
+	__tracing_map_elt_free(elt);
 
 	return ERR_PTR(err);
 }

^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [GIT PULL] tracing: Fixes for 7.1
@ 2026-05-17 13:17 Steven Rostedt
  2026-05-17 19:28 ` pr-tracker-bot
  0 siblings, 1 reply; 7+ messages in thread
From: Steven Rostedt @ 2026-05-17 13:17 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: LKML, Masami Hiramatsu, Mathieu Desnoyers, Andrew Morton,
	Mark Rutland, Arnd Bergmann, Vincent Donnefort


Linus,

tracing fixes for 7.1:

- Add more functions to the remote allowed list

  randconfig found more functions that are allowed for the remote code for
  s390 and arm. Add them to the allowed list.

- Fix remote_test error path

  If one of the simple ring buffers fails to load, the code is supposed to
  rollback its initialized buffers. Instead of rolling back the buffers for
  the failed load, it uses the global variable and rolls back all the
  successfully loaded buffers.


Please pull the latest trace-v7.1-rc3 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v7.1-rc3

Tag SHA1: 0d57a98dab81f85b0baf3ddb0aa97e1df11d03c6
Head SHA1: 55a0005518195fdea1fd2991b07644f8dc97ea8e


Arnd Bergmann (1):
      ring-buffer remote: Avoid unexpected symbol warnings (arm, s390)

Vincent Donnefort (1):
      tracing: Fix desc in error path for the trace remote test module

----
 kernel/trace/Makefile      | 4 ++--
 kernel/trace/remote_test.c | 4 ++--
 2 files changed, 4 insertions(+), 4 deletions(-)
---------------------------
diff --git a/kernel/trace/Makefile b/kernel/trace/Makefile
index 1decdce8cbef..9b0834134cae 100644
--- a/kernel/trace/Makefile
+++ b/kernel/trace/Makefile
@@ -143,8 +143,8 @@ obj-$(CONFIG_TRACE_REMOTE_TEST) += remote_test.o
 targets += undefsyms_base.o
 KASAN_SANITIZE_undefsyms_base.o := y
 
-UNDEFINED_ALLOWLIST = __asan __gcov __kasan __kcsan __hwasan __sancov __sanitizer __tsan __ubsan __x86_indirect_thunk \
-		      __msan simple_ring_buffer \
+UNDEFINED_ALLOWLIST = __asan __gcov __kasan __kcsan __hwasan __sancov __sanitizer __tsan __ubsan __msan \
+		      __aeabi_unwind_cpp __s390_indirect_jump __x86_indirect_thunk simple_ring_buffer \
 		      $(shell $(NM) -u $(obj)/undefsyms_base.o 2>/dev/null | awk '{print $$2}')
 
 quiet_cmd_check_undefined = NM      $<
diff --git a/kernel/trace/remote_test.c b/kernel/trace/remote_test.c
index 6c1b7701ddae..a3e2c9b606eb 100644
--- a/kernel/trace/remote_test.c
+++ b/kernel/trace/remote_test.c
@@ -110,9 +110,9 @@ static struct trace_buffer_desc *remote_test_load(unsigned long size, void *unus
 	return remote_test_buffer_desc;
 
 err_unload:
-	for_each_ring_buffer_desc(rb_desc, cpu, remote_test_buffer_desc)
+	for_each_ring_buffer_desc(rb_desc, cpu, desc)
 		remote_test_unload_simple_rb(rb_desc->cpu);
-	trace_remote_free_buffer(remote_test_buffer_desc);
+	trace_remote_free_buffer(desc);
 
 err_free_desc:
 	kfree(desc);

^ permalink raw reply related	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-06-05 15:58 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-06-04 12:47 [GIT PULL] tracing: Fixes for 7.1 Steven Rostedt
2026-06-04 22:12 ` pr-tracker-bot
2026-06-05 15:58 ` Nathan Chancellor
  -- strict thread matches above, loose matches on Subject: below --
2026-05-21 22:08 Steven Rostedt
2026-05-22 14:26 ` pr-tracker-bot
2026-05-17 13:17 Steven Rostedt
2026-05-17 19:28 ` pr-tracker-bot

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.