From: Steven Rostedt <rostedt@kernel.org>
To: linux-kernel@vger.kernel.org
Cc: "Masami Hiramatsu" <mhiramat@kernel.org>,
"Mark Rutland" <mark.rutland@arm.com>,
"Mathieu Desnoyers" <mathieu.desnoyers@efficios.com>,
"Andrew Morton" <akpm@linux-foundation.org>,
"Ali Ahmet Memiş" <aliamemis@disroot.org>,
"David Carlier" <devnexen@gmail.com>,
"Leon Hwang" <leon.hwang@linux.dev>,
"Vincent Donnefort" <vdonnefort@google.com>
Subject: [for-linus][PATCH 0/5] tracing: More fixes for v7.3
Date: Sun, 13 Sep 2026 13:17:59 -0400 [thread overview]
Message-ID: <20260913171759.469375546@kernel.org> (raw)
[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 2844 bytes --]
tracing fixes for 7.3:
- Use rcu_assign_pointer() for tmp_ops filter hash
The tmp_ops used in update_ftrace_direct_mod() assigns its filter_hash
field directly, but that field is annotated as __rcu and sparse complains.
Assign it with rcu_assign_pointer()
- Fix use-after-free in enable_trigger_private_data_free()
The trace_event_call is accessed through the event_trigger_data's
trace_event_file pointer to put the trace_event_call on freeing. The issue
is that the trace_event_file data may have been freed already causing a
use-after-free. Add a field to the event_trigger_data that points directly
to the trace_event_call so that it can decrement its reference directly
without needing to go through the trace_event_file.
- Fix accounting of buffer data remote headers
trace_buffer_desc_size() and trace_remote_alloc_buffer() undercount the
number of pages is needed for the asked for size as it doesn't take into
account the meta data on each page. Add a helper function to do the
calculation properly and use that in these functions.
- Catch nr_page_va overflow in ring_buffer_desc sizing
The number of pages per remote ring buffer is capped by
ring_buffer_desc::nr_page_va (32 bits). A buffer_size large enough to
overflow that field would silently allocate a descriptor smaller than what
was asked for.
- Do not resize the subbuf order if any per_cpu buffer is disabled
The mmapping of ring buffers disables resizing the subbuffers, but it is
done per-cpu whereas the subbuf size change is done for all the per_cpu
buffers under the buffer->mutex. It could change the size of some while
the mapping is happening on others. Have the resize of the subbuf order
check all the per_cpu buffers under the lock to see if any of them is
disabled before starting and causing an inconsistency between buffers that
are being mapped.
git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace/fixes
Head SHA1: d860c67c051685abb0460b593b193f0f45f4fa92
Ali Ahmet Memiş (1):
tracing: Don't dereference trace_event_file in deferred trigger free
David Carlier (1):
ring-buffer: Check resize_disabled before publishing the new subbuf order
Leon Hwang (1):
ftrace: Use rcu_assign_pointer() for tmp_ops filter hash
Vincent Donnefort (2):
tracing/remotes: Account for ring buffer page header in size calculation
tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing
----
include/linux/ring_buffer.h | 19 +++++++++++++++++--
kernel/trace/ftrace.c | 2 +-
kernel/trace/ring_buffer.c | 8 ++++++++
kernel/trace/trace.h | 1 +
kernel/trace/trace_events_trigger.c | 4 +++-
kernel/trace/trace_remote.c | 6 +++++-
6 files changed, 35 insertions(+), 5 deletions(-)
next reply other threads:[~2026-09-13 17:17 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-13 17:17 Steven Rostedt [this message]
2026-09-13 17:18 ` [for-linus][PATCH 1/5] ftrace: Use rcu_assign_pointer() for tmp_ops filter hash Steven Rostedt
2026-09-13 17:18 ` [for-linus][PATCH 2/5] tracing: Dont dereference trace_event_file in deferred trigger free Steven Rostedt
2026-09-13 17:18 ` [for-linus][PATCH 3/5] tracing/remotes: Account for ring buffer page header in size calculation Steven Rostedt
2026-09-13 17:18 ` [for-linus][PATCH 4/5] tracing/remotes: Catch nr_page_va overflow in ring_buffer_desc sizing Steven Rostedt
2026-09-13 17:18 ` [for-linus][PATCH 5/5] ring-buffer: Check resize_disabled before publishing the new subbuf order Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260913171759.469375546@kernel.org \
--to=rostedt@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=aliamemis@disroot.org \
--cc=devnexen@gmail.com \
--cc=leon.hwang@linux.dev \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=vdonnefort@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.