The Linux Kernel Mailing List
 help / color / mirror / Atom feed
* [for-linus][PATCH 00/13] tracing: Fixes for 7.2
@ 2026-07-07 13:46 Steven Rostedt
  2026-07-07 13:46 ` [for-linus][PATCH 01/13] tracing/synthetic: Free pending field on error path Steven Rostedt
                   ` (12 more replies)
  0 siblings, 13 replies; 15+ messages in thread
From: Steven Rostedt @ 2026-07-07 13:46 UTC (permalink / raw)
  To: linux-kernel
  Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton


tracing fixes for 7.2:

- Free field in error path of synthetic event parse

  In __create_synth_event() the field was allocated but was not freed in the
  error path.

- Fix ring_buffer_event_length() on 8 byte aligned architectures

  On architectures with CONFIG_HAVE_64BIT_ALIGNED_ACCESS set to y,
  the ring_buffer_event_length() may return the wrong size. This
  is because archs with that config set will always use the "big
  event meta header" as that is 8 bytes keeping the payload 8 bytes
  aligned, even when a 4 byte header could hold the size of the
  event.

  But ring_buffer_event_length() doesn't take this into account and only
  subtracts 4 bytes for the meta header in the length when it should have
  subtracted 8 bytes.

- Have osnoise wait for a full rcu synchronization on unregister

  osnoise_unregister_instance() used to call synchronize_rcu() before
  freeing its copy of the instance but was switched to kfree_rcu().
  The osniose tracer has code that traverses the instances that it
  uses, and inst is just a pointer to that instance. By using kfree_rcu()
  instead of synchronize_rcu(), the instance that the inst pointer is
  pointing to can be freed while the osnoise code is still referencing it.

  That is, a rmdir on an instance first unregisters the tracer. When the
  unregister finishes, the rmdir expects that the tracer is finished with
  the instance that it is using. By putting back the synchronize_rcu()
  in osnoise_unregister_instance() the unregistering of osnoise will now
  return when all the users of the instance have finished.

- Remove an unused setting of "ret" in tracing_set_tracer()

- Fix a race between ring buffer setting subbuf_order and reading it

  When ring_buffer_subbuf_order_set() is called at the same time as
  ring_buffer_read_page(), there is a race that the subbuf_size will change
  and the read_page will allocate one size and then initialize it as another
  size.

  Fix this by moving the reading of the subbuf_size into the locking and use
  a local variable to use it for all other transactions when the lock is
  released. It is OK if it changes, as long as the allocated page is still
  considered the same throughout the read function.

- Fix ring_buffer_read_page() copying events

  The commit that changed ring_buffer_read_page() to show dropped events
  from the buffer itself, split the "commit" variable between the commit
  value (with flags) and "size" that holds the size of the sub-buffer.
  A cut and paste error changed the test of the reading from checking the
  size of the buffer to the size of the event causing reads to only read one
  event at a time.

- Make tracepoint_printk a static variable

  When the tracing sysctl knobs were move from sysctl.c to trace.c, the
  variable tracepoint_printk no longer needed to be global. Make it static.

- Fix user_event use-after-free of enabler descriptor

  When the enabler is removed from the link list, it is freed immediately.
  But it is protected via RCU and needs to be freed via kfree_rcu().

- Fix some typos

- Fix NULL pointer dereference in func_set_flag()

  The flags update of the function tracer first checks if the value of the
  flag is the same and exits if they are, and then it checks if the current
  tracer is the function tracer and exits if it isn't. The problem is that
  these checks need to be in a reversed order, as if the tracer isn't the
  function tracer, then the flag being checked may not exist. Reverse the
  order of these checks.

- Fix ufs core trace events to not dereference a pointer in TP_printk()

  The TP_printk() part of the TRACE_EVENT() macro is called when the user
  reads the "trace" file. This can be seconds, minutes, hours, days, weeks,
  and even months after the data was recorded into the ring buffer. Thus,
  saving a pointer to an object into the ring buffer and then dereferencing
  it from TP_printk() can cause harm as the object the pointer is pointing
  to may no longer exist.

  Fix all the trace events in ufs core to save the device name in the ring
  buffer instead of dereferencing the device descriptor from TP_printk().

- Prevent out-of-bound reads in glob matching of trace events

  The filter logic of events allows simple glob logic to add wild cards to
  filter on strings. But some events have fields that may not have a
  terminating 'nul' character. This may cause the glob matching to go beyond
  the string. Change the logic to always pass in the length of the field
  that is being matched.

- Add no-rcu-check version of trace_##event##_enabled()

  The trace_##event##_enabled() usually wraps trace events to do extra work
  that is only needed when the trace event is enabled. But this can hide
  events that are placed in locations where RCU is not watching, and can
  make lockdep not see these bugs when the event is not enabled.

  The trace_##event##_enabled() was updated to always test to make sure RCU
  is watching to catch locations that may call events without RCU being
  active.

  This caused a false positive for the irq_disabled() and related events. As
  that use trace_irq_disabled_enabled() to force RCU to be watching when the
  event is enabled via the ct_irq_enter() function, calls the event, and
  then calls ct_irq_exit() to put RCU back to its original state.

  The trace_irq_disabled_enabled() should not trigger a warning when RCU is
  not watching because the code within its block handles the case properly.
  Make a __trace_##event##_enabled() version for this event to use that
  doesn't check RCU is watching as it handles the case when it isn't.


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace/fixes

Head SHA1: 9cc30885fbd3a59d81f70414bc7a13cbc148f60e


Ben Dooks (1):
      tracing: make tracepoint_printk static as not exported

Crystal Wood (1):
      tracing/osnoise: Call synchronize_rcu() when unregistering

David Carlier (1):
      ring-buffer: Fix ring_buffer_read_page() copying only one event per page

Hui Wang (1):
      ring-buffer: Fix event length with forced 8-byte alignment

Huihui Huang (1):
      tracing: Prevent out-of-bounds read in glob matching

Michael Bommarito (1):
      tracing/user_events: Fix use-after-free of enabler in user_event_mm_dup()

Steven Rostedt (2):
      ufs: core: tracing: Do not dereference pointers in TP_printk()
      tracing: Add a no-rcu-check version of trace_##event##_enabled()

Wayen.Yan (1):
      tracing: Remove unused ret assignment in tracing_set_tracer()

Yash Suthar (1):
      ring_buffer: Check page order under reader_lock

Yu Peng (1):
      tracing/synthetic: Free pending field on error path

Yuanhe Shu (1):
      tracing: Fix NULL pointer dereference in func_set_flag()

Yudistira Putra (1):
      samples: ftrace: Fix typos in benchmark comment

----
 drivers/ufs/core/ufs_trace.h       | 36 +++++++++++++++++++++++++++---------
 include/linux/glob.h               |  1 +
 include/linux/tracepoint.h         | 12 +++++++++++-
 kernel/trace/ring_buffer.c         | 25 +++++++++++++++++--------
 kernel/trace/trace.c               |  3 +--
 kernel/trace/trace_events_filter.c |  6 ++----
 kernel/trace/trace_events_synth.c  |  6 ++++--
 kernel/trace/trace_events_user.c   | 10 +++++++++-
 kernel/trace/trace_functions.c     |  8 ++++----
 kernel/trace/trace_osnoise.c       |  4 +++-
 kernel/trace/trace_preemptirq.c    |  2 +-
 lib/glob.c                         | 31 +++++++++++++++++++++++++++++--
 samples/ftrace/ftrace-ops.c        |  4 ++--
 13 files changed, 111 insertions(+), 37 deletions(-)

^ permalink raw reply	[flat|nested] 15+ messages in thread
end of thread, other threads:[~2026-07-07 14:37 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-07 13:46 [for-linus][PATCH 00/13] tracing: Fixes for 7.2 Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 01/13] tracing/synthetic: Free pending field on error path Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 02/13] ring-buffer: Fix event length with forced 8-byte alignment Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 03/13] tracing/osnoise: Call synchronize_rcu() when unregistering Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 04/13] tracing: Remove unused ret assignment in tracing_set_tracer() Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 05/13] ring_buffer: Check page order under reader_lock Steven Rostedt
2026-07-07 14:37   ` Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 06/13] ring-buffer: Fix ring_buffer_read_page() copying only one event per page Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 07/13] tracing: make tracepoint_printk static as not exported Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 08/13] tracing/user_events: Fix use-after-free of enabler in user_event_mm_dup() Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 09/13] samples: ftrace: Fix typos in benchmark comment Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 10/13] tracing: Fix NULL pointer dereference in func_set_flag() Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 11/13] ufs: core: tracing: Do not dereference pointers in TP_printk() Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 12/13] tracing: Prevent out-of-bounds read in glob matching Steven Rostedt
2026-07-07 13:46 ` [for-linus][PATCH 13/13] tracing: Add a no-rcu-check version of trace_##event##_enabled() Steven Rostedt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox