[PATCH 0/2] tracing: Fix remote reader page swap failures

[PATCH 0/2] tracing: Fix remote reader page swap failures

[Ivan Immanuel Shaji via B4 Relay]

The simple ring buffer's reader-page swap retry loop mishandles its last
attempt. A success at that point is reported as an error, while a failure
is allowed to continue into the pointer updates. The remote ring buffer
consumer compounds callback failures by warning and continuing with stale
reader metadata.

Fix the retry result in the provider, then stop the remote consumer before
it mutates its local page list when the swap fails.

These paths are used by remote tracing, including arm64 nVHE EL2 tracing
and CONFIG_TRACE_REMOTE_TEST.

Testing:

  make C=2 W=1 kernel/trace/simple_ring_buffer.o kernel/trace/ring_buffer.o
  scripts/checkpatch.pl --no-tree (each formatted patch)

No runtime reproducer was run. The two final-attempt outcomes follow from
the retry counter's post-decrement semantics. An arm64 cross-compiler was
not available.

---
Ivan Immanuel Shaji (2):
      tracing: Fix retry exhaustion in simple ring buffer reader swap
      ring-buffer: Stop remote reader update when page swap fails

 kernel/trace/ring_buffer.c        | 5 +++--
 kernel/trace/simple_ring_buffer.c | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)
---
base-commit: 66498c75b4f8017f62d720d9b59675bdf3abce91
change-id: 20260825-kernel-patch-1-d806e3de01a5

Best regards,
-- 
Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

[PATCH 1/2] tracing: Fix retry exhaustion in simple ring buffer reader swap

[Ivan Immanuel Shaji via B4 Relay]

From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link replacement. On the final
attempt, a successful replacement leaves retry at zero, while a failed
replacement leaves it at -1.

The current !retry test reverses both outcomes. It returns an error after
a successful final replacement, leaving the link update complete but the
reader bookkeeping unfinished. After a failed final replacement, it
falls through and updates the head and reader pointers as though the
replacement succeeded, which can corrupt the ring.

Treat only a negative counter as exhaustion and return the documented
-EBUSY error.

Fixes: 34e5b958bdad ("tracing: Introduce simple_ring_buffer")
Cc: stable@vger.kernel.org
Assisted-by: LLM sparse
Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
---
 kernel/trace/simple_ring_buffer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/simple_ring_buffer.c b/kernel/trace/simple_ring_buffer.c
index f4642f5adda3..49913bb0057a 100644
--- a/kernel/trace/simple_ring_buffer.c
+++ b/kernel/trace/simple_ring_buffer.c
@@ -160,8 +160,8 @@ int simple_ring_buffer_swap_reader_page(struct simple_rb_per_cpu *cpu_buffer)
 		overrun = cpu_buffer->meta->overrun;
 	} while (!simple_bpage_unset_head_link(last, reader, SIMPLE_RB_LINK_NORMAL) && retry--);
 
-	if (!retry)
-		return -EINVAL;
+	if (retry < 0)
+		return -EBUSY;
 
 	cpu_buffer->head_page = simple_bpage_from_link(reader->link.next);
 	cpu_buffer->head_page->link.prev = &reader->link;

-- 
2.53.0

Re: [PATCH 1/2] tracing: Fix retry exhaustion in simple ring buffer reader swap

[Vincent Donnefort]

On Tue, Aug 25, 2026 at 01:20:37AM -0400, Ivan Immanuel Shaji via B4 Relay wrote:
> From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
> 
> simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
> post-decrements it only after a failed link replacement. On the final
> attempt, a successful replacement leaves retry at zero, while a failed
> replacement leaves it at -1.
> 
> The current !retry test reverses both outcomes. It returns an error after
> a successful final replacement, leaving the link update complete but the
> reader bookkeeping unfinished. After a failed final replacement, it
> falls through and updates the head and reader pointers as though the
> replacement succeeded, which can corrupt the ring.
> 
> Treat only a negative counter as exhaustion and return the documented
> -EBUSY error.
> 
> Fixes: 34e5b958bdad ("tracing: Introduce simple_ring_buffer")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM sparse
> Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

Reviewed-by: Vincent Donnefort <vdonnefort@google.com>

> ---
>  kernel/trace/simple_ring_buffer.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/simple_ring_buffer.c b/kernel/trace/simple_ring_buffer.c
> index f4642f5adda3..49913bb0057a 100644
> --- a/kernel/trace/simple_ring_buffer.c
> +++ b/kernel/trace/simple_ring_buffer.c
> @@ -160,8 +160,8 @@ int simple_ring_buffer_swap_reader_page(struct simple_rb_per_cpu *cpu_buffer)
>  		overrun = cpu_buffer->meta->overrun;
>  	} while (!simple_bpage_unset_head_link(last, reader, SIMPLE_RB_LINK_NORMAL) && retry--);
>  
> -	if (!retry)
> -		return -EINVAL;
> +	if (retry < 0)
> +		return -EBUSY;
>  
>  	cpu_buffer->head_page = simple_bpage_from_link(reader->link.next);
>  	cpu_buffer->head_page->link.prev = &reader->link;
> 
> -- 
> 2.53.0
> 
> 

[PATCH 2/2] ring-buffer: Stop remote reader update when page swap fails

[Ivan Immanuel Shaji via B4 Relay]

From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

The remote swap_reader_page callback can fail when the writer moves the
head before the remote catches it. __rb_get_reader_page_from_remote()
warns about that failure but continues with the unchanged reader ID and
rearranges the local page list as though the swap succeeded.

Stop immediately after warning. Callers already handle a NULL reader
page as a failed attempt, and this avoids splicing the same page as both
the previous and new reader.

Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
Cc: stable@vger.kernel.org
Assisted-by: LLM sparse
Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
---
 kernel/trace/ring_buffer.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 3c3ed639923d..d11b2759caac 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5805,8 +5805,9 @@ __rb_get_reader_page_from_remote(struct ring_buffer_per_cpu *cpu_buffer)
 
 	prev_reader = cpu_buffer->subbuf_ids[cpu_buffer->meta_page->reader.id];
 
-	WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
-							  cpu_buffer->remote->priv));
+	if (WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
+							      cpu_buffer->remote->priv)))
+		return NULL;
 	/* nr_pages doesn't include the reader page */
 	if (WARN_ON_ONCE(cpu_buffer->meta_page->reader.id > cpu_buffer->nr_pages))
 		return NULL;

-- 
2.53.0

Re: [PATCH 2/2] ring-buffer: Stop remote reader update when page swap fails

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Missing bounds check on shared memory fetch allows out-of-bounds read and Double Fetch (TOCTOU) arbitrary memory write.
- [High] Logic Error: Function fails to abort when remote reader swap succeeds but the reader ID is left unchanged, corrupting the ring buffer.
--

--- Patch [2]: [PATCH 2/2] ring-buffer: Stop remote reader update when page swap fails ---
commit 90c9d4edbac629b3b97121e741bbf3aba71f7d7d
Author: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

ring-buffer: Stop remote reader update when page swap fails

This commit modifies __rb_get_reader_page_from_remote to abort and return
NULL when the remote swap_reader_page callback fails. This prevents the
function from splicing the same page as both the previous and new reader,
avoiding linked-list corruption.

> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -5805,8 +5805,9 @@ __rb_get_reader_page_from_remote(struct ring_buffer_per_cpu *cpu_buffer)
>  
>  	prev_reader = cpu_buffer->subbuf_ids[cpu_buffer->meta_page->reader.id];

[Severity: Critical]
This isn't a bug introduced by this patch, but does the initial fetch of
meta_page->reader.id need a bounds check and READ_ONCE protection?

If a remote entity (such as a guest VM) concurrently writes an
out-of-bounds index to meta_page->reader.id in shared memory, it is used
immediately as an index into the subbuf_ids array. 

If the remote then updates the index to a valid value before the second
fetch lower down, the later bounds check will pass, but prev_reader will
still hold a garbage pointer from the first out-of-bounds read. This
pointer is later used in linked-list manipulations, which could lead to
arbitrary memory corruption.

> -	WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
> -							  cpu_buffer->remote->priv));
> +	if (WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
> +							      cpu_buffer->remote->priv)))
> +		return NULL;
>  	/* nr_pages doesn't include the reader page */
>  	if (WARN_ON_ONCE(cpu_buffer->meta_page->reader.id > cpu_buffer->nr_pages))
>  		return NULL;
>
>  	new_reader = cpu_buffer->subbuf_ids[cpu_buffer->meta_page->reader.id];
>
>  	WARN_ON_ONCE(prev_reader == new_reader);

[Severity: High]
This is a pre-existing issue, but should the code abort here if prev_reader
and new_reader are equal?

If the remote reader swap succeeds but the remote erroneously leaves
meta_page->reader.id unchanged, this condition evaluates to true. 
The function correctly identifies the invalid state with a warning but 
continues execution rather than returning NULL.

By continuing, the code blindly manipulates the list pointers of the same 
page (for example, overwriting new_reader's list.prev to point to itself), 
triggering the same kind of linked list corruption this patch was intended 
to fix.

>  
>  	prev_head = new_reader;  /* New reader was also the previous head */

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825-kernel-patch-1-v1-0-e9349aa0b165@gmail.com?part=2

Re: [PATCH 2/2] ring-buffer: Stop remote reader update when page swap fails

[Vincent Donnefort]

On Tue, Aug 25, 2026 at 01:20:38AM -0400, Ivan Immanuel Shaji via B4 Relay wrote:
> From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
> 
> The remote swap_reader_page callback can fail when the writer moves the
> head before the remote catches it. __rb_get_reader_page_from_remote()
> warns about that failure but continues with the unchanged reader ID and
> rearranges the local page list as though the swap succeeded.
> 
> Stop immediately after warning. Callers already handle a NULL reader
> page as a failed attempt, and this avoids splicing the same page as both
> the previous and new reader.
> 
> Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM sparse
> Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
> ---
>  kernel/trace/ring_buffer.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 3c3ed639923d..d11b2759caac 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -5805,8 +5805,9 @@ __rb_get_reader_page_from_remote(struct ring_buffer_per_cpu *cpu_buffer)
>  
>  	prev_reader = cpu_buffer->subbuf_ids[cpu_buffer->meta_page->reader.id];
>  
> -	WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
> -							  cpu_buffer->remote->priv));
> +	if (WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
> +							      cpu_buffer->remote->priv)))
> +		return NULL;
>  	/* nr_pages doesn't include the reader page */
>  	if (WARN_ON_ONCE(cpu_buffer->meta_page->reader.id > cpu_buffer->nr_pages))
>  		return NULL;
> 
> -- 
> 2.53.0
> 
> 

If handled gracefully and as this can be triggered by a storm of events on small
buffer (when -EBUSY) I wonder if we shouldn't use a pr_warn_ratelimited()
instead of a WARN()?

-- 
Vincent