From: sashiko-bot@kernel.org
To: "Vincent Donnefort" <vdonnefort@google.com>,
linux-trace-kernel@vger.kernel.org
Subject: Re: [PATCH v1 8/9] ring-buffer: Enable context analysis
Date: Thu, 12 Nov 2026 14:28:24 +0000 [thread overview]
Message-ID: <sashiko-outbox-211316@kernel.org> (raw)
In-Reply-To: <20261112141440.3050124-9-vdonnefort@google.com>
Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] ring-buffer: overwritten lost events count in
__rb_get_reader_page() [1]
--
commit 07222abe396def21c907e79ee32f4784cd985857
Author: Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Enable context analysis
This commit enables compiler context analysis for kernel/trace/ring_buffer.c,
adding lock annotations and inlining rb_get_mapped_buffer() and
rb_put_mapped_buffer() into ring_buffer_map_get_reader().
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 82f6e3df46276..99ade8b41b536 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
[ ... ]
> @@ -8031,7 +8023,7 @@ int ring_buffer_map_get_reader(struct trace_buffer *buffer, int cpu)
> rb_update_meta_page(cpu_buffer);
>
> raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
> - rb_put_mapped_buffer(cpu_buffer);
> + mutex_unlock(&cpu_buffer->mapping_lock);
>
> return 0;
> }
[Severity: Medium]
This problem wasn't introduced by this patch, but can __rb_get_reader_page()
overwrite an unconsumed cpu_buffer->lost_events count [1]?
When __rb_get_reader_page() swaps in a new reader page after an overrun, it
assigns the delta directly to cpu_buffer->lost_events and loops back to
"again:":
kernel/trace/ring_buffer.c:__rb_get_reader_page() {
...
if (overwrite != cpu_buffer->last_overrun) {
cpu_buffer->lost_events = overwrite - cpu_buffer->last_overrun;
cpu_buffer->last_overrun = overwrite;
}
goto again;
}
If the swapped page is empty (or the reader catches up to commit_page on the
next iteration), __rb_get_reader_page() returns NULL with
cpu_buffer->lost_events still non-zero. Callers such as
ring_buffer_map_get_reader() and ring_buffer_read_page() then jump to their
"out:" paths without consuming or clearing cpu_buffer->lost_events. If
another overrun happens before the next page swap, the direct assignment in
__rb_get_reader_page() overwrites the earlier unconsumed count instead of
accumulating it with +=, under-reporting dropped events to trace readers and
user-space meta-page mappings.
[1] https://sashiko.dev/#/bug/linux-6817998d-f7d9-427c-82e8-fac5ea6dfa8c
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261112141440.3050124-1-vdonnefort@google.com?part=8
next prev parent reply other threads:[~2026-11-12 14:28 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-12 14:14 [PATCH v1 0/9] ring-buffer: Enable Clang context analysis Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 1/9] ring-buffer: Always read buffer->buffers after testing the cpumask Vincent Donnefort
2026-11-12 14:22 ` sashiko-bot
2026-11-12 14:14 ` [PATCH v1 2/9] ring-buffer: Drop cpus_read_lock() from ring_buffer_poll_remote() Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 3/9] ring-buffer: Hold buffer->mutex in trace_rb_cpu_prepare() Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 4/9] tracing: Cache ring_buffer_max_event_size() for trace_marker Vincent Donnefort
2026-11-12 14:25 ` sashiko-bot
2026-11-12 14:14 ` [PATCH v1 5/9] ring-buffer: Validate event length against rb_page_capacity() Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 6/9] ring-buffer: Introduce rb_start_write() and rb_end_write() Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 7/9] ring-buffer: Avoid reading buffer::subbuf_order on the write path Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 8/9] ring-buffer: Enable context analysis Vincent Donnefort
2026-11-12 14:28 ` sashiko-bot [this message]
2026-11-12 14:14 ` [PATCH v1 9/9] ring-buffer: Annotate subbuf_order with __guarded_by(&mutex) Vincent Donnefort
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-211316@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=vdonnefort@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.