[PATCH RFC] ring-buffer: Fix false warning in ring_buffer_map_get_reader()

[PATCH RFC] ring-buffer: Fix false warning in ring_buffer_map_get_reader()

[syzbot]

In ring_buffer_map_get_reader(), an unconditional WARN_ON(!reader) is
triggered when rb_get_reader_page() returns NULL:

WARNING: CPU: 1 PID: 5906 at kernel/trace/ring_buffer.c:7998
ring_buffer_map_get_reader+0x940/0x9d0
CPU: 1 UID: 0 PID: 5906 Comm: task Not tainted
RIP: 0010:ring_buffer_map_get_reader+0x940/0x9d0
kernel/trace/ring_buffer.c:7998
Call Trace:
 <TASK>
 tracing_buffers_ioctl+0x258/0x300 kernel/trace/trace.c:7381
 __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
 </TASK>

This warning is triggered due to a race between a writer committing events
and a reader mapping the ring buffer via TRACE_MMAP_IOCTL_GET_READER. When
a writer commits an event in rb_set_commit_to_write(), it advances
cpu_buffer->commit_page to cpu_buffer->tail_page in its first loop before
updating the commit counter (commit_page->page->commit) in the second loop.
If a reader invokes ring_buffer_map_get_reader() at this moment, the
initial check cpu_buffer->reader_page == cpu_buffer->commit_page is false,
and it calls rb_get_reader_page(). Inside __rb_get_reader_page(), the
reader swaps reader_page with the head page (which is the new commit_page).
Because the writer has not yet updated the commit count on the new page,
rb_page_size() is zero and reader_page->read < rb_page_size() evaluates to
false. __rb_get_reader_page() then checks if cpu_buffer->commit_page ==
cpu_buffer->reader_page. Since both now point to the swapped page, the
condition evaluates to true and rb_get_reader_page() legitimately returns
NULL to indicate the reader caught up to the writer.

Because WARN_ON must not be used for conditions that can legitimately
happen, ring_buffer_map_get_reader() should not unconditionally warn when
rb_get_reader_page() returns NULL. Fix this by only warning if
rb_get_reader_page() returns NULL while cpu_buffer->reader_page !=
cpu_buffer->commit_page.

Fixes: 117c39200d9d ("ring-buffer: Introducing ring-buffer mapping functions")
Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
Reported-by: syzbot+de3d7f9bcc9212f3fae1@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=de3d7f9bcc9212f3fae1
Link: https://syzkaller.appspot.com/ai_job?id=f119d7de-b21d-4d27-b61e-5503e31edccd
To: <linux-trace-kernel@vger.kernel.org>
To: "Masami Hiramatsu" <mhiramat@kernel.org>
To: "Steven Rostedt" <rostedt@goodmis.org>
To: "Vincent Donnefort" <vdonnefort@google.com>
Cc: <linux-kernel@vger.kernel.org>
Cc: "Mathieu Desnoyers" <mathieu.desnoyers@efficios.com>

---
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 9c03a555a..98130182e 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7995,8 +7995,10 @@ int ring_buffer_map_get_reader(struct trace_buffer *buffer, int cpu)
 		goto out;
 
 	reader = rb_get_reader_page(cpu_buffer);
-	if (WARN_ON(!reader))
+	if (!reader) {
+		WARN_ON(cpu_buffer->reader_page != cpu_buffer->commit_page);
 		goto out;
+	}
 
 	/* Check if any events were dropped */
 	missed_events = cpu_buffer->lost_events;


base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
This is an AI-generated patch subject to moderation.
Reply with '#syz upstream' to Sign-off the patch as a human author
and send it to the upstream kernel mailing lists.
Reply with '#syz reject' to reject it ('#syz unreject' to undo).

See https://goo.gle/syzbot-ai-patches for information about AI-generated patches.
You can comment on the patch as usual, syzbot will try to address
the comments and send a new version of the patch if necessary.
syzbot engineers can be reached at syzkaller@googlegroups.com.

Re: [PATCH RFC] ring-buffer: Fix false warning in ring_buffer_map_get_reader()

[Krystian Kaniewski]

Remove the replacement WARN_ON(cpu_buffer->reader_page != 
cpu_buffer->commit_page) from the NULL-result branch in 
ring_buffer_map_get_reader(). Handle a NULL rb_get_reader_page() result 
through the existing out label without another assertion.

The helper can legitimately return NULL after the reader catches the 
commit page, but the writer can advance commit_page before the caller 
evaluates the new condition. reader_lock serializes readers and does not 
stop the writer on another CPU. The post-return equality is therefore 
not a valid invariant. The helper also supports ordinary no-data 
returns, as reflected by the existing peek and read-page callers. Keep 
structural diagnostics in the helper.

Preserve the existing early exits, metadata update, cache flush, lock 
release, return values and missed-event handling. Keep the valid 
explanation of the empty-commit-page case, and update the final fix 
description to explain the optional reader result and why rechecking 
mutable writer state is insufficient. Preserve the current Fixes and 
reporting tags and existing provenance.

On 9/8/2026 1:48 PM, syzbot wrote:
> In ring_buffer_map_get_reader(), an unconditional WARN_ON(!reader) is
> triggered when rb_get_reader_page() returns NULL:
>
> WARNING: CPU: 1 PID: 5906 at kernel/trace/ring_buffer.c:7998
> ring_buffer_map_get_reader+0x940/0x9d0
> CPU: 1 UID: 0 PID: 5906 Comm: task Not tainted
> RIP: 0010:ring_buffer_map_get_reader+0x940/0x9d0
> kernel/trace/ring_buffer.c:7998
> Call Trace:
>   <TASK>
>   tracing_buffers_ioctl+0x258/0x300 kernel/trace/trace.c:7381
>   __se_sys_ioctl+0xfc/0x170 fs/ioctl.c:583
>   do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
>   entry_SYSCALL_64_after_hwframe+0x77/0x7f
>   </TASK>
>
> This warning is triggered due to a race between a writer committing events
> and a reader mapping the ring buffer via TRACE_MMAP_IOCTL_GET_READER. When
> a writer commits an event in rb_set_commit_to_write(), it advances
> cpu_buffer->commit_page to cpu_buffer->tail_page in its first loop before
> updating the commit counter (commit_page->page->commit) in the second loop.
> If a reader invokes ring_buffer_map_get_reader() at this moment, the
> initial check cpu_buffer->reader_page == cpu_buffer->commit_page is false,
> and it calls rb_get_reader_page(). Inside __rb_get_reader_page(), the
> reader swaps reader_page with the head page (which is the new commit_page).
> Because the writer has not yet updated the commit count on the new page,
> rb_page_size() is zero and reader_page->read < rb_page_size() evaluates to
> false. __rb_get_reader_page() then checks if cpu_buffer->commit_page ==
> cpu_buffer->reader_page. Since both now point to the swapped page, the
> condition evaluates to true and rb_get_reader_page() legitimately returns
> NULL to indicate the reader caught up to the writer.
>
> Because WARN_ON must not be used for conditions that can legitimately
> happen, ring_buffer_map_get_reader() should not unconditionally warn when
> rb_get_reader_page() returns NULL. Fix this by only warning if
> rb_get_reader_page() returns NULL while cpu_buffer->reader_page !=
> cpu_buffer->commit_page.
>
> Fixes: 117c39200d9d ("ring-buffer: Introducing ring-buffer mapping functions")
> Assisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot
> Reported-by: syzbot+de3d7f9bcc9212f3fae1@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=de3d7f9bcc9212f3fae1
> Link: https://syzkaller.appspot.com/ai_job?id=f119d7de-b21d-4d27-b61e-5503e31edccd
> To: <linux-trace-kernel@vger.kernel.org>
> To: "Masami Hiramatsu" <mhiramat@kernel.org>
> To: "Steven Rostedt" <rostedt@goodmis.org>
> To: "Vincent Donnefort" <vdonnefort@google.com>
> Cc: <linux-kernel@vger.kernel.org>
> Cc: "Mathieu Desnoyers" <mathieu.desnoyers@efficios.com>
>
> ---
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 9c03a555a..98130182e 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -7995,8 +7995,10 @@ int ring_buffer_map_get_reader(struct trace_buffer *buffer, int cpu)
>   		goto out;
>   
>   	reader = rb_get_reader_page(cpu_buffer);
> -	if (WARN_ON(!reader))
> +	if (!reader) {
> +		WARN_ON(cpu_buffer->reader_page != cpu_buffer->commit_page);
>   		goto out;
> +	}
>   
>   	/* Check if any events were dropped */
>   	missed_events = cpu_buffer->lost_events;
>
>
> base-commit: df2908090cda368b01ff43709f51890076c56157