[PATCH v1 4/9] tracing: Cache ring_buffer_max_event_size() for trace_marker

[Vincent Donnefort <vdonnefort@google.com>]

write_marker_to_buffer() calls ring_buffer_max_event_size() twice
without synchronisation against ring_buffer_subbuf_order_set(). If
subbuf_order grows between the two calls, cnt may expand past
TRACE_MARKER_MAX_SIZE. Read the maximum event size once so cnt can only
shrink, and drop the now-unreachable WARN_ON_ONCE().

Fixes: 2808e31ec12e ("ring-buffer: Add interface for configuring trace sub buffer size")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
---
 kernel/trace/trace.c | 9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index e8c4efa8107b..f44bde7c51b7 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5962,15 +5962,14 @@ static ssize_t write_marker_to_buffer(struct trace_array *tr, const char *buf,
 	event = __trace_buffer_lock_reserve(buffer, TRACE_PRINT, size,
 					    tracing_gen_ctx());
 	if (unlikely(!event)) {
+		size_t max_event_size = ring_buffer_max_event_size(buffer);
+
 		/*
 		 * If the size was greater than what was allowed, then
 		 * make it smaller and try again.
 		 */
-		if (size > ring_buffer_max_event_size(buffer)) {
-			cnt = ring_buffer_max_event_size(buffer) - meta_size;
-			/* The above should only happen once */
-			if (WARN_ON_ONCE(cnt + meta_size == size))
-				return -EBADF;
+		if (size > max_event_size) {
+			cnt = max_event_size - meta_size;
 			goto again;
 		}
 
-- 
2.56.0.567.gdb80ae8cd5-goog