Re: [PATCH] ring-buffer: Reset per-CPU buffer state in ring_buffer_subbuf_order_set()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] ring-buffer: wrong Fixes commit in
  ring_buffer_subbuf_order_set() fix
--

commit 2d978229f2f9c796f8090fdee8cc2744974a320c
Author: Shuai Liu <847807867@qq.com>

> ring-buffer: Reset per-CPU buffer state in ring_buffer_subbuf_order_set()
>
> ring_buffer_subbuf_order_set() replaces every page of a ring buffer
> with newly allocated empty pages when the sub-buffer order changes.
> However, it does not reset the per-CPU accounting of the discarded
> pages. The stale counters (pages_read, pages_touched, pages_lost,
> entries, ...) continue to describe pages that no longer exist.
>
> A full waiter (e.g. poll on per_cpu/*/trace_pipe_raw with
> buffer_percent set) then causes ring_buffer_nr_dirty_pages() to read
> the stale accounting, and the invariant pages_read <= pages_touched -
> pages_lost + 1 can be violated, which trips the WARN_ON_ONCE() there:
>
>   WARNING: kernel/trace/ring_buffer.c:866 at ring_buffer_nr_dirty_pages
>
> Since the old pages are gone, the buffer state after swapping in the
> new pages is equivalent to a freshly allocated buffer. Replace the
> manual head/tail/commit page assignment and the rb_head_page_activate()
> call with rb_reset_cpu(), which performs the same page setup and also
> resets all per-CPU accounting.
>
> Verified on QEMU (x86_64, v7.4-rc2): enable sched_switch events,
> partially consume trace_pipe, set buffer_subbuf_size_kb to 32, then
> poll trace_pipe_raw with buffer_percent=50 while writing events. The
> unpatched kernel triggers the WARN above, while the patched kernel
> does not, and the per-CPU stats report a clean buffer after the order
> change.
>
> Fixes: 2808e31ec12e5 ("ring-buffer: Add interface for configuring trace sub buffer size")
> Reported-by: syzbot+008851bf625629489e75@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=008851bf625629489e75
> Link: https://lore.kernel.org/linux-trace-kernel/6af009ed.4dd4714a.f8d02.000d.GAE@google.com/
> Signed-off-by: Shuai Liu <847807867@qq.com>

[Severity: Low]
2808e31ec12e ("ring-buffer: Add interface for configuring trace sub buffer
size") only added a stub for ring_buffer_subbuf_order_set(), and
f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
initially implemented it by allocating fresh ring_buffer_per_cpu structures
with zeroed counters.  The in-place page swap that leaves stale per-CPU
accounting was introduced in 8e7b58c27b3c ("ring-buffer: Just update the
subbuffers when changing their allocation order").

Should the Fixes tag be:

  Fixes: 8e7b58c27b3c ("ring-buffer: Just update the subbuffers when changing their allocation order")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/tencent_1C5982E4E79A087063C5142622DDF7A4B909@qq.com?part=1