[PATCH] ring-buffer: Prevent subbuf order change when resizing is disabled

[PATCH] ring-buffer: Prevent subbuf order change when resizing is disabled

[Vincent Donnefort]

Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
allow it when risizing is disabled. A non-consuming reader is at risk of
use-after-free (rb_advance_iter()).

Return -EBUSY on resize_disabled, matching ring_buffer_resize()
behaviour.

Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Reported-by: syzbot+e0cc44465d6bae735679@syzkaller.appspotmail.com
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 8e2485bb3aa8..414bca2121a7 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7358,7 +7358,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
 
 		cpu_buffer = buffer->buffers[cpu];
 
-		if (cpu_buffer->mapped) {
+		if (atomic_read(&cpu_buffer->resize_disabled)) {
 			err = -EBUSY;
 			goto error;
 		}

base-commit: 075b74841bd0065a3bda3440873c747938e69b68
-- 
2.55.0.571.g244d577d93-goog

Re: [PATCH] ring-buffer: Prevent subbuf order change when resizing is disabled

[Vincent Donnefort]

On Wed, Aug 05, 2026 at 04:32:24PM +0100, Vincent Donnefort wrote:
> Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
> allow it when risizing is disabled. A non-consuming reader is at risk of
> use-after-free (rb_advance_iter()).
> 
> Return -EBUSY on resize_disabled, matching ring_buffer_resize()
> behaviour.
> 
> Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
> Reported-by: syzbot+e0cc44465d6bae735679@syzkaller.appspotmail.com
> Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> 
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 8e2485bb3aa8..414bca2121a7 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -7358,7 +7358,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
>  
>  		cpu_buffer = buffer->buffers[cpu];
>  
> -		if (cpu_buffer->mapped) {
> +		if (atomic_read(&cpu_buffer->resize_disabled)) {

Ha, my bad I forgot that mapped is not just "user-space mapped" but also
"range-mapped". 

However probably the best is just to record_disable range mapped buffers in
rb_allocate_cpu_buffer()... especially ring_buffer_resize() doesn't use
cpu_buffer->mapped

>  			err = -EBUSY;
>  			goto error;
>  		}
> 
> base-commit: 075b74841bd0065a3bda3440873c747938e69b68
> -- 
> 2.55.0.571.g244d577d93-goog
> 

-- 
Vincent

Re: [PATCH] ring-buffer: Prevent subbuf order change when resizing is disabled

[Vincent Donnefort]

On Wed, Aug 05, 2026 at 05:36:51PM +0100, Vincent Donnefort wrote:
> On Wed, Aug 05, 2026 at 04:32:24PM +0100, Vincent Donnefort wrote:
> > Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
> > allow it when risizing is disabled. A non-consuming reader is at risk of
> > use-after-free (rb_advance_iter()).
> > 
> > Return -EBUSY on resize_disabled, matching ring_buffer_resize()
> > behaviour.
> > 
> > Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
> > Reported-by: syzbot+e0cc44465d6bae735679@syzkaller.appspotmail.com
> > Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> > 
> > diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> > index 8e2485bb3aa8..414bca2121a7 100644
> > --- a/kernel/trace/ring_buffer.c
> > +++ b/kernel/trace/ring_buffer.c
> > @@ -7358,7 +7358,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
> >  
> >  		cpu_buffer = buffer->buffers[cpu];
> >  
> > -		if (cpu_buffer->mapped) {
> > +		if (atomic_read(&cpu_buffer->resize_disabled)) {
> 
> Ha, my bad I forgot that mapped is not just "user-space mapped" but also
> "range-mapped". 
> 
> However probably the best is just to record_disable range mapped buffers in
> rb_allocate_cpu_buffer()... especially ring_buffer_resize() doesn't use
> cpu_buffer->mapped

I am also looking at the other findings from Sashiko. I believe some are legit.


> 
> >  			err = -EBUSY;
> >  			goto error;
> >  		}
> > 
> > base-commit: 075b74841bd0065a3bda3440873c747938e69b68
> > -- 
> > 2.55.0.571.g244d577d93-goog
> > 
> 
> -- 
> Vincent

-- 
Vincent