[PATCH v4] tracing: ring-buffer: fix stale reader-page link

[PATCH v4] tracing: ring-buffer: fix stale reader-page link

[Haoli Zhang]

Hi Steve,

Thanks for reviewing v3. I apologize for adding unnecessary NMI reader
coordination and skip handling. You noted the report is unrelated to NMI
reads. The lockless NMI path is only a best-effort crash-dump path.
I have removed that complexity and dropped the Fixes tag.

The report shows rb_is_reader_page() dereferencing a freed page through
page->list.prev->next. During shrink, reader_page is detached from the
ring list and can retain a previous link to a page being removed. Redirect
that link to the surviving tail page while identifying pages to remove,
before any removed page is freed.

This change does not add work to the normal writer fast path or alter NMI
reader behavior.

Reported-by: syzbot+37e1793bdb0061ea3a47@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=37e1793bdb0061ea3a47
Co-developed-by: Jinning Zhang <25031212117@stu.xidian.edu.cn>
Signed-off-by: Jinning Zhang <25031212117@stu.xidian.edu.cn>
Co-developed-by: Bin Yu <byu@xidian.edu.cn>
Signed-off-by: Bin Yu <byu@xidian.edu.cn>
Signed-off-by: Haoli Zhang <26031212468@stu.xidian.edu.cn>

---
 v4:
 - Drop NMI reader coordination and skip handling.

 kernel/trace/ring_buffer.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3106,6 +3106,16 @@
 	for (nr_removed = 0; nr_removed < nr_pages; nr_removed++) {
 		to_remove = rb_list_head(to_remove)->next;
 		head_bit |= (unsigned long)to_remove & RB_PAGE_HEAD;
+
+		/*
+		 * The reader page is detached from the ring buffer list, so its
+		 * previous pointer can still refer to a page being removed.
+		 * rb_is_reader_page() follows this pointer, so redirect it to the
+		 * surviving tail page before the removed page is freed.
+		 */
+		if (rb_list_head(cpu_buffer->reader_page->list.prev) ==
+		    rb_list_head(to_remove))
+			cpu_buffer->reader_page->list.prev = tail_page;
 	}
 	/* Read iterators need to reset themselves when some pages removed */
 	cpu_buffer->pages_removed += nr_removed;
-- 

Re: [PATCH v4] tracing: ring-buffer: fix stale reader-page link

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] tracing: ring-buffer: reply text in changelog and missing Fixes
  trailer
--

commit c4296f8629e0420816a4b5f1c95a30a1141d5523
Author: Haoli Zhang <26031212468@stu.xidian.edu.cn>

> tracing: ring-buffer: fix stale reader-page link
>
> Hi Steve,
>
> Thanks for reviewing v3. I apologize for adding unnecessary NMI reader
> coordination and skip handling. You noted the report is unrelated to NMI
> reads. The lockless NMI path is only a best-effort crash-dump path.
> I have removed that complexity and dropped the Fixes tag.
>
> The report shows rb_is_reader_page() dereferencing a freed page through
> page->list.prev->next. During shrink, reader_page is detached from the
> ring list and can retain a previous link to a page being removed. Redirect
> that link to the surviving tail page while identifying pages to remove,
> before any removed page is freed.
>
> This change does not add work to the normal writer fast path or alter NMI
> reader behavior.
>
> Reported-by: syzbot+37e1793bdb0061ea3a47@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=37e1793bdb0061ea3a47
> Co-developed-by: Jinning Zhang <25031212117@stu.xidian.edu.cn>
> Signed-off-by: Jinning Zhang <25031212117@stu.xidian.edu.cn>
> Co-developed-by: Bin Yu <byu@xidian.edu.cn>
> Signed-off-by: Bin Yu <byu@xidian.edu.cn>
> Signed-off-by: Haoli Zhang <26031212468@stu.xidian.edu.cn>

[Severity: Low]
The opening paragraph ("Hi Steve, ...") is a personal reply to a reviewer
and should go below the "---" separator line so it is not recorded in git
history.

Also, since commit 83f40318dab0 ("ring-buffer: Make removal of ring buffer
pages atomic") rewrote rb_remove_pages() to unlink pages in place without
calling rb_reset_cpu() to reinitialize cpu_buffer->reader_page->list,
should this include:

  Fixes: 83f40318dab0 ("ring-buffer: Make removal of ring buffer pages atomic")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261113033612.1349-1-26031212468@stu.xidian.edu.cn?part=1