[PATCH] ring-buffer: Fix possible dereference of uninitialized pointer

[PATCH] ring-buffer: Fix possible dereference of uninitialized pointer

[Daniil Dulov]

There is a pointer head_page in rb_meta_validate_events() which is not
initialized at the beginning of a function. This pointer can be dereferenced
if there is a failure during reader page validation. In this case the control
is passed to "invalid" label where the pointer is dereferenced in a loop.

To fix the issue initialize orig_head and head_page before calling
rb_validate_buffer.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/r/202406130130.JtTGRf7W-lkp@intel.com/
Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events")
Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
---
 kernel/trace/ring_buffer.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 630221b00838..ad08430347b0 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1918,6 +1918,8 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
 	if (!meta || !meta->head_buffer)
 		return;
 
+	orig_head = head_page = cpu_buffer->head_page;
+
 	/* Do the reader page first */
 	ret = rb_validate_buffer(cpu_buffer->reader_page->page, cpu_buffer->cpu);
 	if (ret < 0) {
@@ -1928,7 +1930,6 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
 	entry_bytes += local_read(&cpu_buffer->reader_page->page->commit);
 	local_set(&cpu_buffer->reader_page->entries, ret);
 
-	orig_head = head_page = cpu_buffer->head_page;
 	ts = head_page->page->time_stamp;
 
 	/*
-- 
2.34.1

Re: [PATCH] ring-buffer: Fix possible dereference of uninitialized pointer

[Masami Hiramatsu]

On Fri, 13 Feb 2026 13:01:30 +0300
Daniil Dulov <d.dulov@aladdin.ru> wrote:

> There is a pointer head_page in rb_meta_validate_events() which is not
> initialized at the beginning of a function. This pointer can be dereferenced
> if there is a failure during reader page validation. In this case the control
> is passed to "invalid" label where the pointer is dereferenced in a loop.
> 
> To fix the issue initialize orig_head and head_page before calling
> rb_validate_buffer.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 

Looks good to me.

Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>

Thanks!

> Reported-by: kernel test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/r/202406130130.JtTGRf7W-lkp@intel.com/
> Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events")
> Signed-off-by: Daniil Dulov <d.dulov@aladdin.ru>
> ---
>  kernel/trace/ring_buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 630221b00838..ad08430347b0 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -1918,6 +1918,8 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
>  	if (!meta || !meta->head_buffer)
>  		return;
>  
> +	orig_head = head_page = cpu_buffer->head_page;
> +
>  	/* Do the reader page first */
>  	ret = rb_validate_buffer(cpu_buffer->reader_page->page, cpu_buffer->cpu);
>  	if (ret < 0) {
> @@ -1928,7 +1930,6 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
>  	entry_bytes += local_read(&cpu_buffer->reader_page->page->commit);
>  	local_set(&cpu_buffer->reader_page->entries, ret);
>  
> -	orig_head = head_page = cpu_buffer->head_page;
>  	ts = head_page->page->time_stamp;
>  
>  	/*
> -- 
> 2.34.1
> 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@kernel.org>