Re: [PATCH v9 4/4] ring-buffer: Prevent truncation of nr_pages / nr_subbufs

[Steven Rostedt <rostedt@goodmis.org>]

On Tue, 01 Sep 2026 16:48:36 +0000
sashiko-bot@kernel.org wrote:

> [Severity: High]
> This is a pre-existing issue, but does this function overflow the
> subbuf_mask bitmap?
> 
> The size of subbuf_mask is allocated as nr_pages + 1 bits in
> rb_range_meta_init(). However, this function unconditionally uses
> meta->nr_subbufs from the persistent memory mapped region without
> validating it against nr_pages + 1.

Sounds like another validation check. Make sure what's in the meta data
matches nr_pages + 1. I'll add this:

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index ef66f726e2e2..748d4ae8badf 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -1869,6 +1869,11 @@ static bool rb_cpu_meta_valid(struct ring_buffer_cpu_meta *meta, int cpu,
 		return false;
 	}
 
+	if (meta->nr_subbufs != nr_pages + 1) {
+		pr_info("Ring buffer boot meta [%d] invalid nr_subbufs\n", cpu);
+		return false;
+	}
+
 	buffers_start = meta->first_buffer;
 	buffers_end = meta->first_buffer + (subbuf_size * meta->nr_subbufs);
 
-- Steve