[PATCH] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G

[PATCH] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G

[Calvin Owens]

Some of the sizing logic through tracer_alloc_buffers() uses int
internally, causing unexpected behavior if the user passes a value that
does not fit in an int (on my x86 machine, the result is uselessly tiny
buffers).

Fix by plumbing the parameter's real type (unsigned long) through to the
ring buffer allocation functions, which already use unsigned long. Also,
tweak ring_buffer_meta_scratch() to avoid void pointer arithmetic.

It has always been possible to create larger ring buffers via the sysfs
interface: this only affects the cmdline parameter.

Fixes: 73c5162aa362 ("tracing: keep ring buffer to minimum size till used")
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
---
 include/linux/ring_buffer.h |  3 ++-
 kernel/trace/ring_buffer.c  | 10 +++++-----
 kernel/trace/trace.c        | 13 +++++++------
 3 files changed, 14 insertions(+), 12 deletions(-)

diff --git a/include/linux/ring_buffer.h b/include/linux/ring_buffer.h
index d862fa610270..c07eb463ca1c 100644
--- a/include/linux/ring_buffer.h
+++ b/include/linux/ring_buffer.h
@@ -95,7 +95,8 @@ struct trace_buffer *__ring_buffer_alloc_range(unsigned long size, unsigned flag
 					       unsigned long scratch_size,
 					       struct lock_class_key *key);
 
-void *ring_buffer_meta_scratch(struct trace_buffer *buffer, unsigned int *size);
+void *ring_buffer_meta_scratch(struct trace_buffer *buffer,
+			       unsigned long *size);
 
 /*
  * Because the ring buffer is generic, if other users of the ring buffer get
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 17d0ea0cc3e6..30e579fd6b9d 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2650,22 +2650,22 @@ struct trace_buffer *__ring_buffer_alloc_range(unsigned long size, unsigned flag
 			    scratch_size, key);
 }
 
-void *ring_buffer_meta_scratch(struct trace_buffer *buffer, unsigned int *size)
+void *ring_buffer_meta_scratch(struct trace_buffer *buffer, unsigned long *size)
 {
 	struct ring_buffer_meta *meta;
-	void *ptr;
+	unsigned long ptr;
 
 	if (!buffer || !buffer->meta)
 		return NULL;
 
 	meta = buffer->meta;
 
-	ptr = (void *)ALIGN((unsigned long)meta + sizeof(*meta), sizeof(long));
+	ptr = ALIGN((unsigned long)meta + sizeof(*meta), sizeof(unsigned long));
 
 	if (size)
-		*size = (void *)meta + meta->buffers_offset - ptr;
+		*size = (unsigned long)meta + meta->buffers_offset - ptr;
 
-	return ptr;
+	return (void *)ptr;
 }
 
 /**
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 1e7c032a72d2..f6f5c44ddbf7 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -9282,11 +9282,12 @@ static int mod_addr_comp(const void *a, const void *b, const void *data)
 }
 
 static void setup_trace_scratch(struct trace_array *tr,
-				struct trace_scratch *tscratch, unsigned int size)
+				struct trace_scratch *tscratch,
+				unsigned long size)
 {
 	struct trace_module_delta *module_delta;
 	struct trace_mod_entry *entry;
-	int i, nr_entries;
+	unsigned long i, nr_entries;
 
 	if (!tscratch)
 		return;
@@ -9350,11 +9351,11 @@ static void setup_trace_scratch(struct trace_array *tr,
 }
 
 static int
-allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, int size)
+allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, unsigned long size)
 {
 	enum ring_buffer_flags rb_flags;
 	struct trace_scratch *tscratch;
-	unsigned int scratch_size = 0;
+	unsigned long scratch_size = 0;
 
 	rb_flags = tr->trace_flags & TRACE_ITER(OVERWRITE) ? RB_FL_OVERWRITE : 0;
 
@@ -9405,7 +9406,7 @@ static void free_trace_buffer(struct array_buffer *buf)
 	}
 }
 
-static int allocate_trace_buffers(struct trace_array *tr, int size)
+static int allocate_trace_buffers(struct trace_array *tr, unsigned long size)
 {
 	int ret;
 
@@ -10769,7 +10770,7 @@ __init static void enable_instances(void)
 
 __init static int tracer_alloc_buffers(void)
 {
-	int ring_buf_size;
+	unsigned long ring_buf_size;
 	int ret = -ENOMEM;
 
 
-- 
2.47.3

Re: [PATCH] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G

[Steven Rostedt]

On Fri,  6 Mar 2026 18:28:38 -0800
Calvin Owens <calvin@wbinvd.org> wrote:

> Some of the sizing logic through tracer_alloc_buffers() uses int
> internally, causing unexpected behavior if the user passes a value that
> does not fit in an int (on my x86 machine, the result is uselessly tiny
> buffers).
> 
> Fix by plumbing the parameter's real type (unsigned long) through to the
> ring buffer allocation functions, which already use unsigned long. Also,
> tweak ring_buffer_meta_scratch() to avoid void pointer arithmetic.

Let's make this only fix the problem at hand and leave scratch alone.
Scratch is seldom more than a page size and int should be plenty.

> 
> It has always been possible to create larger ring buffers via the sysfs
> interface: this only affects the cmdline parameter.
> 
> Fixes: 73c5162aa362 ("tracing: keep ring buffer to minimum size till used")

Another reason not to touch scratch, is because it's a very new
feature, and this fix goes back to 2009. If you want this to hit stable
trees, only fix what is needed.

Generally, you should only fix the problem anyway in one patch, and use
other patches to make other updates.

-- Steve


> Signed-off-by: Calvin Owens <calvin@wbinvd.org>

[PATCH v2] tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G

[Calvin Owens]

Some of the sizing logic through tracer_alloc_buffers() uses int
internally, causing unexpected behavior if the user passes a value that
does not fit in an int (on my x86 machine, the result is uselessly tiny
buffers).

Fix by plumbing the parameter's real type (unsigned long) through to the
ring buffer allocation functions, which already use unsigned long.

It has always been possible to create larger ring buffers via the sysfs
interface: this only affects the cmdline parameter.

Fixes: 73c5162aa362 ("tracing: keep ring buffer to minimum size till used")
Signed-off-by: Calvin Owens <calvin@wbinvd.org>
---
Changes in v2:
* Leave scratch_size as an int in allocate_trace_buffer(), undo callee
  changes required after making it unsigned long [Steven]

 kernel/trace/trace.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 1e7c032a72d2..ebd996f8710e 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -9350,7 +9350,7 @@ static void setup_trace_scratch(struct trace_array *tr,
 }
 
 static int
-allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, int size)
+allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, unsigned long size)
 {
 	enum ring_buffer_flags rb_flags;
 	struct trace_scratch *tscratch;
@@ -9405,7 +9405,7 @@ static void free_trace_buffer(struct array_buffer *buf)
 	}
 }
 
-static int allocate_trace_buffers(struct trace_array *tr, int size)
+static int allocate_trace_buffers(struct trace_array *tr, unsigned long size)
 {
 	int ret;
 
@@ -10769,7 +10769,7 @@ __init static void enable_instances(void)
 
 __init static int tracer_alloc_buffers(void)
 {
-	int ring_buf_size;
+	unsigned long ring_buf_size;
 	int ret = -ENOMEM;
 
 
-- 
2.47.3