From: sashiko-bot@kernel.org
To: "Vincent Donnefort" <vdonnefort@google.com>,
linux-trace-kernel@vger.kernel.org
Subject: Re: [PATCH v1 8/9] ring-buffer: Enable context analysis
Date: Thu, 12 Nov 2026 14:28:24 +0000 [thread overview]
Message-ID: <sashiko-outbox-211316@kernel.org> (raw)
In-Reply-To: <20261112141440.3050124-9-vdonnefort@google.com>
Thank you for your contribution! Sashiko AI review found no new issues
in this patch, but noticed 1 related pre-existing issue it does not
introduce:
- [Medium] ring-buffer: overwritten lost events count in
__rb_get_reader_page() [1]
--
commit 07222abe396def21c907e79ee32f4784cd985857
Author: Vincent Donnefort <vdonnefort@google.com>
ring-buffer: Enable context analysis
This commit enables compiler context analysis for kernel/trace/ring_buffer.c,
adding lock annotations and inlining rb_get_mapped_buffer() and
rb_put_mapped_buffer() into ring_buffer_map_get_reader().
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 82f6e3df46276..99ade8b41b536 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
[ ... ]
> @@ -8031,7 +8023,7 @@ int ring_buffer_map_get_reader(struct trace_buffer *buffer, int cpu)
> rb_update_meta_page(cpu_buffer);
>
> raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
> - rb_put_mapped_buffer(cpu_buffer);
> + mutex_unlock(&cpu_buffer->mapping_lock);
>
> return 0;
> }
[Severity: Medium]
This problem wasn't introduced by this patch, but can __rb_get_reader_page()
overwrite an unconsumed cpu_buffer->lost_events count [1]?
When __rb_get_reader_page() swaps in a new reader page after an overrun, it
assigns the delta directly to cpu_buffer->lost_events and loops back to
"again:":
kernel/trace/ring_buffer.c:__rb_get_reader_page() {
...
if (overwrite != cpu_buffer->last_overrun) {
cpu_buffer->lost_events = overwrite - cpu_buffer->last_overrun;
cpu_buffer->last_overrun = overwrite;
}
goto again;
}
If the swapped page is empty (or the reader catches up to commit_page on the
next iteration), __rb_get_reader_page() returns NULL with
cpu_buffer->lost_events still non-zero. Callers such as
ring_buffer_map_get_reader() and ring_buffer_read_page() then jump to their
"out:" paths without consuming or clearing cpu_buffer->lost_events. If
another overrun happens before the next page swap, the direct assignment in
__rb_get_reader_page() overwrites the earlier unconsumed count instead of
accumulating it with +=, under-reporting dropped events to trace readers and
user-space meta-page mappings.
[1] https://sashiko.dev/#/bug/linux-6817998d-f7d9-427c-82e8-fac5ea6dfa8c
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261112141440.3050124-1-vdonnefort@google.com?part=8
next prev parent reply other threads:[~2026-11-12 14:28 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-12 14:14 [PATCH v1 0/9] ring-buffer: Enable Clang context analysis Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 1/9] ring-buffer: Always read buffer->buffers after testing the cpumask Vincent Donnefort
2026-11-12 14:22 ` sashiko-bot
2026-11-12 14:14 ` [PATCH v1 2/9] ring-buffer: Drop cpus_read_lock() from ring_buffer_poll_remote() Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 3/9] ring-buffer: Hold buffer->mutex in trace_rb_cpu_prepare() Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 4/9] tracing: Cache ring_buffer_max_event_size() for trace_marker Vincent Donnefort
2026-11-12 14:25 ` sashiko-bot
2026-11-12 14:14 ` [PATCH v1 5/9] ring-buffer: Validate event length against rb_page_capacity() Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 6/9] ring-buffer: Introduce rb_start_write() and rb_end_write() Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 7/9] ring-buffer: Avoid reading buffer::subbuf_order on the write path Vincent Donnefort
2026-11-12 14:14 ` [PATCH v1 8/9] ring-buffer: Enable context analysis Vincent Donnefort
2026-11-12 14:28 ` sashiko-bot [this message]
2026-11-12 14:14 ` [PATCH v1 9/9] ring-buffer: Annotate subbuf_order with __guarded_by(&mutex) Vincent Donnefort
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=sashiko-outbox-211316@kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
--cc=vdonnefort@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox