[PATCH v1 0/2] ring-buffer: Fix and unify size and page calculations

[PATCH v1 0/2] ring-buffer: Fix and unify size and page calculations

[Vincent Donnefort]

This short series unifies minimum page calculation for ring buffers and
fix a small issue with the number of pages calculation for trace
remotes.

Vincent Donnefort (2):
  tracing/remotes: Account for ring buffer page header in size
    calculation
  ring-buffer: Unify ring buffer minimum page calculations

 include/linux/ring_buffer.h       | 21 ++++++++++++++++++++-
 kernel/trace/ring_buffer.c        | 30 ++++++++++++------------------
 kernel/trace/simple_ring_buffer.c |  4 ++--
 kernel/trace/trace_remote.c       |  6 +++++-
 4 files changed, 39 insertions(+), 22 deletions(-)


base-commit: df2908090cda368b01ff43709f51890076c56157
-- 
2.55.0.979.g7e5102b832-goog

[PATCH v1 1/2] tracing/remotes: Account for ring buffer page header in size calculation

[Vincent Donnefort]

trace_buffer_desc_size() and trace_remote_alloc_buffer undercount the
required pages because every ring buffer page contains a header
(BUF_PAGE_HDR_SIZE). Account for that header to ensure allocated remote
ring buffers aren't smaller than requested by the user.

While at it, ensure those functions catch nr_pages overflow.

Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>

diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index afc7daa6ee7d..7a1a92f87650 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -8,6 +8,8 @@
 
 #include <uapi/linux/trace_mmap.h>
 
+#include <linux/ring_buffer_types.h>
+
 struct trace_buffer;
 struct ring_buffer_iter;
 
@@ -281,9 +283,14 @@ static inline struct ring_buffer_desc *__first_ring_buffer_desc(struct trace_buf
 
 static inline size_t trace_buffer_desc_size(size_t buffer_size, unsigned int nr_cpus)
 {
-	unsigned int nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE), 2UL) + 1;
+	unsigned long nr_pages =
+		max(DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1;
 	struct ring_buffer_desc *rbdesc;
 
+	/* Capped by ring_buffer_desc::nr_page_va */
+	if (nr_pages > UINT_MAX)
+		return SIZE_MAX;
+
 	return size_add(offsetof(struct trace_buffer_desc, __data),
 			size_mul(nr_cpus, struct_size(rbdesc, page_va, nr_pages)));
 }
diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c
index 75fa1ffc4c96..2e0fdbb730b7 100644
--- a/kernel/trace/trace_remote.c
+++ b/kernel/trace/trace_remote.c
@@ -980,9 +980,12 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size,
 			      const struct cpumask *cpumask)
 {
 	size_t min_desc_size = trace_buffer_desc_size(buffer_size, cpumask_weight(cpumask));
-	unsigned int nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE), 2UL) + 1;
 	struct ring_buffer_desc *rb_desc;
 	int cpu, ret = -ENOMEM;
+	unsigned int nr_pages;
+
+	if (min_desc_size == SIZE_MAX)
+		return -E2BIG;
 
 	if (desc_size < min_desc_size)
 		return -EINVAL;
@@ -991,6 +994,7 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size,
 	desc->struct_len = min_desc_size;
 
 	rb_desc = __first_ring_buffer_desc(desc);
+	nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1;
 
 	for_each_cpu(cpu, cpumask) {
 		unsigned int id;
-- 
2.55.0.979.g7e5102b832-goog

Re: [PATCH v1 1/2] tracing/remotes: Account for ring buffer page header in size calculation

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Integer overflow in DIV_ROUND_UP macro when buffer_size is near ULONG_MAX, resulting in silently undersized trace buffer allocation and bypassing the nr_pages overflow check.
--

commit 5b0a9673088fdd2f5832774541f4590e32126561
Author: Vincent Donnefort <vdonnefort@google.com>

tracing/remotes: Account for ring buffer page header in size calculation

This commit adjusts the trace buffer size calculation to account for the ring
buffer page header size. It also introduces bounds checking for the number of
pages to prevent out-of-bounds calculations.

> diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
> index afc7daa6ee7dc..7a1a92f876503 100644
> --- a/include/linux/ring_buffer.h
> +++ b/include/linux/ring_buffer.h
[ ... ]
> @@ -281,9 +283,14 @@ static inline struct ring_buffer_desc *__first_ring_buffer_desc(struct trace_buf
>  
>  static inline size_t trace_buffer_desc_size(size_t buffer_size, unsigned int nr_cpus)
>  {
> -	unsigned int nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE), 2UL) + 1;
> +	unsigned long nr_pages =
> +		max(DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1;

[Severity: High]
This isn't a bug introduced by this patch, but is there an integer overflow
when evaluating DIV_ROUND_UP() with a very large buffer_size?

If a privileged user writes a near-maximum value (like ULONG_MAX - 1023) to
the tracefs buffer_size_kb file, it passes the earlier check_shl_overflow()
because the top 10 bits are zero.

When calculating the pages here:

    DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE)

the macro expands to adding (PAGE_SIZE - BUF_PAGE_HDR_SIZE - 1) to
buffer_size. This addition overflows the 64-bit integer, wrapping around
to a small number.

This causes nr_pages to be miscalculated as a tiny value (like 3), completely
bypassing the newly added "> UINT_MAX" safety check.

Since the backing pages might be sized based on a PAGE_ALIGN() wrap, while
nr_page_va is set to 3, could this discrepancy cause out-of-bounds hypervisor
memory accesses on systems with >= 64 CPUs?

>  	struct ring_buffer_desc *rbdesc;
>  
> +	/* Capped by ring_buffer_desc::nr_page_va */
> +	if (nr_pages > UINT_MAX)
> +		return SIZE_MAX;
> +
>  	return size_add(offsetof(struct trace_buffer_desc, __data),
>  			size_mul(nr_cpus, struct_size(rbdesc, page_va, nr_pages)));
>  }
> diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c
> index 75fa1ffc4c96d..2e0fdbb730b7b 100644
> --- a/kernel/trace/trace_remote.c
> +++ b/kernel/trace/trace_remote.c
[ ... ]
> @@ -991,6 +994,7 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size,
>  	desc->struct_len = min_desc_size;
>  
>  	rb_desc = __first_ring_buffer_desc(desc);
> +	nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1;

[Severity: High]
This is a pre-existing issue, but are we exposing the same wrapping
vulnerability here?

Since the same macro is used to compute the actual page allocation loop
bounds, would it duplicate the same integer overflow when calculating the
loop limit for allocating the buffer?

>  
>  	for_each_cpu(cpu, cpumask) {
>  		unsigned int id;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907192643.42513-1-vdonnefort@google.com?part=1

Re: [PATCH v1 1/2] tracing/remotes: Account for ring buffer page header in size calculation

[Steven Rostedt]

On Mon,  7 Sep 2026 20:26:42 +0100
Vincent Donnefort <vdonnefort@google.com> wrote:

> trace_buffer_desc_size() and trace_remote_alloc_buffer undercount the
> required pages because every ring buffer page contains a header
> (BUF_PAGE_HDR_SIZE). Account for that header to ensure allocated remote
> ring buffers aren't smaller than requested by the user.
> 
> While at it, ensure those functions catch nr_pages overflow.

Fixes patches should never have "while at it". That means it belongs as a
separate patch. The only "while at it" that is acceptable is white space
fixes or other formatting changes along with new code that is not a fix.

> 
> Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
> Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> 
> diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
> index afc7daa6ee7d..7a1a92f87650 100644
> --- a/include/linux/ring_buffer.h
> +++ b/include/linux/ring_buffer.h
> @@ -8,6 +8,8 @@
>  
>  #include <uapi/linux/trace_mmap.h>
>  
> +#include <linux/ring_buffer_types.h>

Hmm, why is this after the uapi header? It should be part of the linux/
headers.

> +
>  struct trace_buffer;
>  struct ring_buffer_iter;
>  
> @@ -281,9 +283,14 @@ static inline struct ring_buffer_desc *__first_ring_buffer_desc(struct trace_buf
>  
>  static inline size_t trace_buffer_desc_size(size_t buffer_size, unsigned int nr_cpus)
>  {
> -	unsigned int nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE), 2UL) + 1;
> +	unsigned long nr_pages =
> +		max(DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1;

This is getting a little unwieldy. Let's break it up:

	unsigned long pages_req = DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE);
	unsigned long nr_pages = max(pages_req, 2UL) + 1;

Or better yet, let's add a new helper function:

static inline unsigned long calculate_nr_pages(size_t buffer_size)
{
	unsigned long req_pages = DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE);
	return max(pages_req, 2UL) + 1;
}

Then this could be simply:

	unsigned long nr_pages = calculate_nr_pages(buffer_size);

>  	struct ring_buffer_desc *rbdesc;
>  
> +	/* Capped by ring_buffer_desc::nr_page_va */
> +	if (nr_pages > UINT_MAX)
> +		return SIZE_MAX;

Separate patch.

> +
>  	return size_add(offsetof(struct trace_buffer_desc, __data),
>  			size_mul(nr_cpus, struct_size(rbdesc, page_va, nr_pages)));
>  }
> diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c
> index 75fa1ffc4c96..2e0fdbb730b7 100644
> --- a/kernel/trace/trace_remote.c
> +++ b/kernel/trace/trace_remote.c
> @@ -980,9 +980,12 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size,
>  			      const struct cpumask *cpumask)
>  {
>  	size_t min_desc_size = trace_buffer_desc_size(buffer_size, cpumask_weight(cpumask));
> -	unsigned int nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE), 2UL) + 1;
>  	struct ring_buffer_desc *rb_desc;
>  	int cpu, ret = -ENOMEM;
> +	unsigned int nr_pages;
> +


> +	if (min_desc_size == SIZE_MAX)
> +		return -E2BIG;

Looks like this should be a separate patch too.

>  
>  	if (desc_size < min_desc_size)
>  		return -EINVAL;
> @@ -991,6 +994,7 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size,
>  	desc->struct_len = min_desc_size;
>  
>  	rb_desc = __first_ring_buffer_desc(desc);
> +	nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1;

And here we can have;

	nr_pages = calculate_nr_pages(buffer_size);

-- Steve

>  
>  	for_each_cpu(cpu, cpumask) {
>  		unsigned int id;

[PATCH v1 2/2] ring-buffer: Unify ring buffer minimum page calculations

[Vincent Donnefort]

The codebase scatters hardcoded minimum page limits across multiple
places. Introduce RING_BUFFER_MIN_NR_PAGES and rb_size_to_nr_pages() to
formalize the requirement of two pages in a ring buffer.

Remote and persistent ring buffers must account for the reader page.

Signed-off-by: Vincent Donnefort <vdonnefort@google.com>

diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index 7a1a92f87650..a9401b8ebc72 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -99,6 +99,13 @@ struct trace_buffer *__ring_buffer_alloc_range(unsigned long size, unsigned flag
 
 void *ring_buffer_meta_scratch(struct trace_buffer *buffer, unsigned int *size);
 
+/*
+ * A minimum of 2 pages ensures we can always swap a page out of the ring
+ * buffer. This does not account for the reader page or any other page
+ * containing meta data used by static ring buffers.
+ */
+#define RING_BUFFER_MIN_NR_PAGES 2UL
+
 /*
  * Because the ring buffer is generic, if other users of the ring buffer get
  * traced by ftrace, it can produce lockdep warnings. We need to keep each
@@ -281,10 +288,15 @@ static inline struct ring_buffer_desc *__first_ring_buffer_desc(struct trace_buf
 	return (struct ring_buffer_desc *)(&desc->__data[0]);
 }
 
+static inline unsigned long __ring_buffer_size_to_desc_pages(size_t size)
+{
+	/* Takes into account the reader page */
+	return max(DIV_ROUND_UP(size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), RING_BUFFER_MIN_NR_PAGES) + 1;
+}
+
 static inline size_t trace_buffer_desc_size(size_t buffer_size, unsigned int nr_cpus)
 {
-	unsigned long nr_pages =
-		max(DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1;
+	unsigned long nr_pages = __ring_buffer_size_to_desc_pages(buffer_size);
 	struct ring_buffer_desc *rbdesc;
 
 	/* Capped by ring_buffer_desc::nr_page_va */
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 9c03a555a6ba..88e39d98332a 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -642,6 +642,11 @@ static __always_inline unsigned int rb_subbuf_max_data_size(struct trace_buffer
 	return rb_subbuf_capacity(buffer) - RB_EVNT_HDR_SIZE - sizeof(event->array[0]);
 }
 
+static unsigned long rb_size_to_nr_pages(struct trace_buffer *buffer, unsigned long size)
+{
+	return max(DIV_ROUND_UP(size, rb_subbuf_capacity(buffer)), RING_BUFFER_MIN_NR_PAGES);
+}
+
 /**
  * rb_subbuf_start - Get the start address of a subbuffer
  * @buffer:	A trace buffer
@@ -2865,7 +2870,7 @@ static struct trace_buffer *alloc_buffer(unsigned long size, unsigned flags,
 			goto fail_free_buffers;
 
 		/* Need at least two pages plus the reader page */
-		if (nr_pages < 3)
+		if (nr_pages < RING_BUFFER_MIN_NR_PAGES + 1)
 			goto fail_free_buffers;
 
  again:
@@ -2877,7 +2882,7 @@ static struct trace_buffer *alloc_buffer(unsigned long size, unsigned flags,
 			ptr += subbuf_size * nr_pages;
 		}
 		if (ptr > end) {
-			if (nr_pages <= 3)
+			if (nr_pages <= RING_BUFFER_MIN_NR_PAGES + 1)
 				goto fail_free_buffers;
 			nr_pages--;
 			goto again;
@@ -2900,13 +2905,10 @@ static struct trace_buffer *alloc_buffer(unsigned long size, unsigned flags,
 		if (nr_pages > rb_static_max_pages())
 			goto fail_free_buffers;
 
-		if (nr_pages < 2)
+		if (nr_pages < RING_BUFFER_MIN_NR_PAGES)
 			goto fail_free_buffers;
 	} else {
-		/* need at least two pages */
-		nr_pages = DIV_ROUND_UP(size, rb_subbuf_capacity(buffer));
-		if (nr_pages < 2)
-			nr_pages = 2;
+		nr_pages = rb_size_to_nr_pages(buffer, size);
 	}
 
 	cpumask_set_cpu(cpu, buffer->cpumask);
@@ -3319,11 +3321,7 @@ int ring_buffer_resize(struct trace_buffer *buffer, unsigned long size,
 	mutex_lock(&buffer->mutex);
 	atomic_inc(&buffer->resizing);
 
-	nr_pages = DIV_ROUND_UP(size, rb_subbuf_capacity(buffer));
-
-	/* we need a minimum of two pages */
-	if (nr_pages < 2)
-		nr_pages = 2;
+	nr_pages = rb_size_to_nr_pages(buffer, size);
 
 	if (cpu_id == RING_BUFFER_ALL_CPUS) {
 		/*
@@ -7495,12 +7493,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
 		}
 
 		/* Update the number of pages to match the new size */
-		nr_pages = old_capacity * buffer->buffers[cpu]->nr_pages;
-		nr_pages = DIV_ROUND_UP(nr_pages, rb_subbuf_capacity(buffer));
-
-		/* we need a minimum of two pages */
-		if (nr_pages < 2)
-			nr_pages = 2;
+		nr_pages = rb_size_to_nr_pages(buffer,
+					       old_capacity * buffer->buffers[cpu]->nr_pages);
 
 		cpu_buffer->nr_pages_to_update = nr_pages;
 
diff --git a/kernel/trace/simple_ring_buffer.c b/kernel/trace/simple_ring_buffer.c
index 49913bb0057a..abfaf9bee12e 100644
--- a/kernel/trace/simple_ring_buffer.c
+++ b/kernel/trace/simple_ring_buffer.c
@@ -383,8 +383,8 @@ int simple_ring_buffer_init_mm(struct simple_rb_per_cpu *cpu_buffer,
 	void *page;
 	int i;
 
-	/* At least 1 reader page and two pages in the ring-buffer */
-	if (desc->nr_page_va < 3)
+	/* At least RING_BUFFER_MIN_NR_PAGES and 1 reader page */
+	if (desc->nr_page_va < RING_BUFFER_MIN_NR_PAGES + 1)
 		return -EINVAL;
 
 	memset(cpu_buffer, 0, sizeof(*cpu_buffer));
diff --git a/kernel/trace/trace_remote.c b/kernel/trace/trace_remote.c
index 2e0fdbb730b7..0d90e02b1f4b 100644
--- a/kernel/trace/trace_remote.c
+++ b/kernel/trace/trace_remote.c
@@ -994,7 +994,7 @@ int trace_remote_alloc_buffer(struct trace_buffer_desc *desc, size_t desc_size,
 	desc->struct_len = min_desc_size;
 
 	rb_desc = __first_ring_buffer_desc(desc);
-	nr_pages = max(DIV_ROUND_UP(buffer_size, PAGE_SIZE - BUF_PAGE_HDR_SIZE), 2UL) + 1;
+	nr_pages = __ring_buffer_size_to_desc_pages(buffer_size);
 
 	for_each_cpu(cpu, cpumask) {
 		unsigned int id;
-- 
2.55.0.979.g7e5102b832-goog

Re: [PATCH v1 2/2] ring-buffer: Unify ring buffer minimum page calculations

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] A hardcoded minimum page limit was missed during refactoring in trace_rb_cpu_prepare().
--

commit 699b707360c7ac89e4a8f2b996c220e5cb22ea93
Author: Vincent Donnefort <vdonnefort@google.com>

ring-buffer: Unify ring buffer minimum page calculations

The commit introduces the RING_BUFFER_MIN_NR_PAGES macro to formalize the
requirement of having at least two pages in a ring buffer. It updates multiple
sites across the codebase to use this new unified calculation instead of
scattered hardcoded values.

> diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
> index 7a1a92f876503..a9401b8ebc721 100644
> --- a/include/linux/ring_buffer.h
> +++ b/include/linux/ring_buffer.h
> @@ -99,6 +99,13 @@ struct trace_buffer *__ring_buffer_alloc_range(unsigned long size, unsigned flag
>  
>  void *ring_buffer_meta_scratch(struct trace_buffer *buffer, unsigned int *size);
>  
> +/*
> + * A minimum of 2 pages ensures we can always swap a page out of the ring
> + * buffer. This does not account for the reader page or any other page
> + * containing meta data used by static ring buffers.
> + */
> +#define RING_BUFFER_MIN_NR_PAGES 2UL
> +

[Severity: Low]
Was a hardcoded minimum page limit missed during this refactoring?

Looking at kernel/trace/ring_buffer.c:trace_rb_cpu_prepare(), when a newly
hotplugged CPU is brought online and detects varying subbuffer sizes across
existing CPUs (!nr_pages_same), it still uses a hardcoded fallback limit:

kernel/trace/ring_buffer.c:trace_rb_cpu_prepare() {
    ...
	/* allocate minimum pages, user can later expand it */
	if (!nr_pages_same)
		nr_pages = 2;
    ...
}

Should this fallback allocation use the newly introduced
RING_BUFFER_MIN_NR_PAGES macro instead to avoid a maintenance hazard if the
minimum requirement changes in the future?

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907192643.42513-1-vdonnefort@google.com?part=2

Re: [PATCH v1 2/2] ring-buffer: Unify ring buffer minimum page calculations

[Steven Rostedt]

On Mon,  7 Sep 2026 20:26:43 +0100
Vincent Donnefort <vdonnefort@google.com> wrote:

> The codebase scatters hardcoded minimum page limits across multiple
> places. Introduce RING_BUFFER_MIN_NR_PAGES and rb_size_to_nr_pages() to
> formalize the requirement of two pages in a ring buffer.

Now I read this after I replied to patch 1 :-)

Anyway, I like my calculate_nr_pages() better than rb_size_to_nr_pages()
but I'm not really picky ;-)

I would make the helper function part of the first patch as you introduce
the duplication of the code there. Whenever I introduce a duplicate code, I
will usually do it by creating a helper function and using that function in
the places of the duplication instead of making it into two steps.

The use of the MIN_NR_PAGES macro can stay as a separate patch.

-- Steve