Re: [PATCH v5 01/10] ring-buffer: Free cpu_buffer::free_page with subbuf_order

[Vincent Donnefort <vdonnefort@google.com>]

On Thu, Aug 13, 2026 at 05:02:54PM +0100, Vincent Donnefort wrote:
> On Fri, Aug 14, 2026 at 12:49:32AM +0900, Masami Hiramatsu wrote:
> > On Thu, 13 Aug 2026 13:54:39 +0000
> > sashiko-bot@kernel.org wrote:
> > 
> > > Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> > > 
> > > Pre-existing issues:
> > > - [Critical] A data race and locking mismatch between `ring_buffer_subbuf_order_set()`, `ring_buffer_alloc_read_page()`, and `ring_buffer_free_read_page()` allows `cpu_buffer->free_page` to cache a page of an old order while `buffer->subbuf_order` reflects a new larger order. This leads to heap buffer overflow and buddy allocator corruption.
> > > --
> > > 
> > > --- Patch [1]: [PATCH v5 01/10] ring-buffer: Free cpu_buffer::free_page with subbuf_order ---
> > > commit f550c0bfeadcc22eca47316e1820b4d91f6ef261
> > > Author: Vincent Donnefort <vdonnefort@google.com>
> > > 
> > > ring-buffer: Free cpu_buffer::free_page with subbuf_order
> > >     
> > > When sub-buffers use an order greater than 0, cpu_buffer->free_page is
> > > allocated with subbuf_order. Use the correct order for
> > > cpu_buffer->free_page.
> > > 
> > > > diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> > > > index 2667992f0aa29..a3d28b2e2c94a 100644
> > > > --- a/kernel/trace/ring_buffer.c
> > > > +++ b/kernel/trace/ring_buffer.c
> > > > @@ -2631,7 +2631,7 @@ static void rb_free_cpu_buffer(struct ring_buffer_per_cpu *cpu_buffer)
> > > >  		free_buffer_page(bpage);
> > > >  	}
> > > >  
> > > > -	free_page((unsigned long)cpu_buffer->free_page);
> > > > +	free_pages((unsigned long)cpu_buffer->free_page, cpu_buffer->buffer->subbuf_order);
> > > 
> > > [Severity: Critical]
> > > This is a pre-existing issue, but does this change expose a buddy allocator
> > > corruption if cpu_buffer->free_page contains a page of a smaller order than
> > > buffer->subbuf_order?
> > 
> > Hmm, I think you have to fix cpu_buffer->{free_page,subbuf_order} race issue at first.
> > Let me try another series to fix it.
> > 
> > Thank you,
> 
> You mean this one?
> 
> https://lore.kernel.org/all/20260813131152.3589632-4-vdonnefort@google.com/
> 
> > 
> > -- 
> > Masami Hiramatsu (Google) <mhiramat@kernel.org>
> 
> -- 
> Vincent

I believe I have covered most of it now... but Sashiko reviewing patches one by
one doesn't see all the fixes in one go.

-- 
Vincent