Re: [syzbot] Re: [syzbot] [trace?] BUG: corrupted list in ring_buffer_subbuf_order_set

[syzbot <syzbot+05d673e83ec640f0ced9@syzkaller.appspotmail.com>]

For archival purposes, forwarding an incoming command email to
linux-kernel@vger.kernel.org.

***

Subject: Re: [syzbot] [trace?] BUG: corrupted list in ring_buffer_subbuf_order_set
Author: hdanton@sina.com

> Date: Fri, 06 Jun 2025 00:29:28 -0700
> syzbot found the following issue on:
> 
> HEAD commit:    cd2e103d57e5 Merge tag 'hardening-v6.16-rc1-fix1-take2' of..
> git tree:       upstream
> console output: https://syzkaller.appspot.com/x/log.txt?x=17f0680c580000
> kernel config:  https://syzkaller.appspot.com/x/.config?x=d97b092471e3ab82
> dashboard link: https://syzkaller.appspot.com/bug?extid=05d673e83ec640f0ced9
> compiler:       gcc (Debian 12.2.0-14) 12.2.0, GNU ld (GNU Binutils for Debian) 2.40
> syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=1795b970580000
> C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=13b281d4580000

#syz test

--- x/kernel/trace/ring_buffer.c
+++ y/kernel/trace/ring_buffer.c
@@ -6909,7 +6909,6 @@ error:
 	buffer->subbuf_size = old_size;
 
 	atomic_dec(&buffer->record_disabled);
-	mutex_unlock(&buffer->mutex);
 
 	for_each_buffer_cpu(buffer, cpu) {
 		cpu_buffer = buffer->buffers[cpu];
@@ -6922,6 +6921,7 @@ error:
 			free_buffer_page(bpage);
 		}
 	}
+	mutex_unlock(&buffer->mutex);
 
 	return err;
 }
--