public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
* [PATCH] tracing/osnoise: Fix OSN_WORKLOAD-related crash
@ 2026-01-14 12:35 Tomas Glozar
  2026-01-14 19:49 ` Crystal Wood
  0 siblings, 1 reply; 4+ messages in thread
From: Tomas Glozar @ 2026-01-14 12:35 UTC (permalink / raw)
  To: Steven Rostedt, Masami Hiramatsu
  Cc: Mathieu Desnoyers, Crystal Wood, John Kacur, Luis Goncalves, LKML,
	Linux Trace Kernel, Tomas Glozar

A kernel panic was observed in the timerlat tracer with the following
reproducer:

   #!/bin/bash
   while true; do
      rtla timerlat hist -u -d 5s & PID=$!
      sleep 2
      echo OSNOISE_WORKLOAD > /sys/kernel/tracing/osnoise/options
      rtla timerlat hist -k -d 1s
   done

The kernel first displays several WARN traces with the following pattern:

   WARNING: CPU: 1 PID: 1822 at kernel/trace/trace_osnoise.c:1959 stop_kthread+0xb7/0xc0
   ...
   CPU: 1 UID: 0 PID: 1822 Comm: bash
   ..
   Call Trace:
     ...
     ? stop_kthread+0xb7/0xc0
     stop_per_cpu_kthreads+0xf/0x40
     osnoise_options_write+0xda/0x1b0
     vfs_write+0xf5/0x450
     ...
     ksys_write+0x6d/0xf0
     do_syscall_64+0x7d/0x160
     ...
     entry_SYSCALL_64_after_hwframe+0x76/0x7e

Then, it displays a similar pattern, but in start_per_cpu_kthreads():

   WARNING: CPU: 1 PID: 2120 at kernel/trace/trace_osnoise.c:2068 start_per_cpu_kthreads+0xfe/0x110
   ...
   CPU: 1 UID: 0 PID: 2120 Comm: rtla
   ...
   Call Trace:
     ...
     ? start_per_cpu_kthreads+0xfe/0x110
     ...
     osnoise_workload_start+0xb1/0x2d0
     timerlat_tracer_start+0x50/0x70
     rb_simple_write+0x13a/0x160
     vfs_write+0xf5/0x450
     ...
     ksys_write+0x6d/0xf0
     do_syscall_64+0x7d/0x160
     ...
     entry_SYSCALL_64_after_hwframe+0x76/0x7e

and finally a null pointer reference BUG:

   BUG: kernel NULL pointer dereference, address: 0000000000000030
   ...
   CPU: 1 UID: 0 PID: 2155 Comm: timerlatu/1
   ...
   Call Trace:
     ...
     ? timerlat_fd_read+0xf2/0x370
     ? timerlat_fd_read+0xee/0x370
     vfs_read+0xe8/0x370
     ksys_read+0x6d/0xf0
     do_syscall_64+0x7d/0x160
     ...
     entry_SYSCALL_64_after_hwframe+0x76/0x7e

Fix the bug by disallowing OSNOISE_WORKLOAD to be set if timerlat is
running with NO_OSNOISE_WORKLOAD and a user workload is attached to at
least one CPU.

To implement this, a new function osnoise_validate_option() is added.
The function validates any osnoise option change, and return an error
value if the change is not valid. EBUSY is used for this particular
case.

Fixes: 30838fcd8107 ("tracing/osnoise: Add OSNOISE_WORKLOAD option")
Signed-off-by: Tomas Glozar <tglozar@redhat.com>
---
 kernel/trace/trace_osnoise.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/kernel/trace/trace_osnoise.c b/kernel/trace/trace_osnoise.c
index 827104d00bc0..6a6d4f8bc19f 100644
--- a/kernel/trace/trace_osnoise.c
+++ b/kernel/trace/trace_osnoise.c
@@ -2186,6 +2186,31 @@ static const struct seq_operations osnoise_options_seq_ops = {
 	.stop		= s_options_stop
 };
 
+/**
+ * osnoise_validate_option - Check if set option is valid
+ * @option: The index of the option
+ * @enabled: The requested state of the option
+ *
+ * Verify if the requested osnoise option is valid with regards to the current
+ * state of the tracer.
+ *
+ * If valid, return 0, if not, return error number.
+ */
+static int osnoise_validate_option(int option, int enabled)
+{
+	int cpu;
+
+	if (option == OSN_WORKLOAD && enabled &&
+	    !test_bit(OSN_WORKLOAD, &osnoise_options)) {
+		/* Trying to enable kernel threads while user workload is running? */
+		for_each_online_cpu(cpu)
+			if (per_cpu(per_cpu_osnoise_var, cpu).pid)
+				return -EBUSY;
+	}
+
+	return 0;
+}
+
 static int osnoise_options_open(struct inode *inode, struct file *file)
 {
 	return seq_open(file, &osnoise_options_seq_ops);
@@ -2229,6 +2254,10 @@ static ssize_t osnoise_options_write(struct file *filp, const char __user *ubuf,
 	if (option < 0)
 		return -EINVAL;
 
+	retval = osnoise_validate_option(option, enable);
+	if (retval != 0)
+		return retval;
+
 	/*
 	 * trace_types_lock is taken to avoid concurrency on start/stop.
 	 */
-- 
2.52.0


^ permalink raw reply related	[flat|nested] 4+ messages in thread
end of thread, other threads:[~2026-01-15 15:52 UTC | newest]

Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-01-14 12:35 [PATCH] tracing/osnoise: Fix OSN_WORKLOAD-related crash Tomas Glozar
2026-01-14 19:49 ` Crystal Wood
2026-01-15 13:32   ` Tomas Glozar
2026-01-15 15:52     ` Steven Rostedt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox