The Linux Kernel Mailing List
 help / color / mirror / Atom feed
* [for-linus][PATCH 0/9] tracing: Fixes for 7.2
@ 2026-07-24 23:18 Steven Rostedt
  2026-07-24 23:18 ` [for-linus][PATCH 1/9] tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer() Steven Rostedt
                   ` (8 more replies)
  0 siblings, 9 replies; 12+ messages in thread
From: Steven Rostedt @ 2026-07-24 23:18 UTC (permalink / raw)
  To: linux-kernel
  Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton

tracing fix for 7.2:

- Move rb_desc->nr_page_va before updating dynamic array

  The rb_descr->page_va is a dynamic array counted by nr_page_va. But the
  updating of the page_va[] is done before the nr_page_va is incremented
  causing a build with CONFIG_UBSAN_BOUNDS to flag it as an overflow.

  Move the increment of the counted by value before the array element is
  updated.

- Propagate errors from remote event bulk updates

  The return value of trace_remote_enable_event() was not being checked by
  remote_events_dir_enable_write() where it would silently fail. Have it
  check the return value and propagate that back up to user space.

- Fix resource leak on mmiotrace trace_pipe close

  The mmiotrace tracer was created in 2008 before the trace_pipe had a close
  callback to allow tracers to do clean up from trace_pipe open. The
  trace_pipe close cleanup callback was added in 2009 but the mmiotrace
  tracer was not updated. It had a hack to do the cleanup in the read call,
  where it may leak if user space did not read the entire buffer.

  Add a callback to mmiotrace trace_pipe close do to the cleanup properly.

- Fix a possible NULL pointer dereference in the mmiotrace tracer

  If the mmio_pipe_open() fails to find a PCI device, it will set the
  hiter->dev pointer to NULL. The read function will blindly dereference
  that pointer. Fix the read call to check to see if that pointer is
  populated before dereferencing it.

- Fix union collision of module and refcnt for dynamic events

  In 'struct trace_event_call', the 'module' pointer and the 'refcnt' atomic
  variable share the same memory space in a union. The filter on module
  logic only checked if the 'module' was set to determine if the event
  belonged to the module. As dynamic events are always builtin, it doesn't
  need the 'module' field of the structure and used a refcount. But the
  module filtering logic would then mistaken these dynamic events as a
  module and call module_name(event->module) on it.

  Add a check to see if the event is a dynamic event and if so, do not check
  it for being part of the given module.

- Reset the top level buffer in selftests before running instances

  The ftracetest selftest initializes each instance before executing the
  tests. But it does not reset the top level buffer. Dynamic events are only
  added and removed by the top level so any left over dynamic events will
  not be removed by the reset in the instances.

  Left over dynamic events can cause the tests to incorrectly fail. Reset
  the top level buffer before running the instances.

- Make the context_switch counter 64 bit

  The code to read user space for a system call trace event or for a
  trace_marker will disable migration, enable preemption, read user space
  into a per CPU buffer, disable preemption and enable migration again.
  It checks if the per CPU context switch counter to see if it changed, and
  if it did not, it would know that the per CPU buffer was not touched by
  another task.

  But the save counter was 32 bit and it would compare it to the 64 bit
  context_switch variable. A long running system could have the
  context_switch variable greater that 1<<32 in which case the compare will
  always fail. The compare will promote the 32 bit int saved value to 64 bit
  and compare it to the full 64 bit counter. Since the top 32 bits of the
  saved value was zero, it would never match.

- Fix a use-after-free of the event_enable trigger

  The event_enable trigger allows for enabling one event when another event
  is triggered. When the trigger is removed, it must go through a
  synchronization phase to make sure it is not triggered again. The trigger
  itself is delayed by the "bulk delay" logic that was recently added.
  But the code that frees the event_enable data used to rely on the trigger
  code to do the synchronization. Now that the code uses the call RCU
  functions (and a workqueue), that delay no longer is there.

  Add a callback private_data_free() function that allows triggers to clean
  up data after the synchronization phase has completed.

- Move the module_ref counter into the delay callback

  Since an event of the event_enable trigger can enable an event for a
  module, it ups the module ref count for that event's module. This prevents
  the event from trying to enable an event that no longer exists and cause a
  use-after-free bug.

  The ref counter was set back down when the trigger was removed but not
  after thy synchronization phase. This could lead to the module data being
  accessed after module was unloaded.

  Move the module ref decrement into the private_data_free() callback of the
  event_enable trigger.


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace/fixes

Head SHA1: e091351b38818ef620d27f44f4bfd625f13afbff


David Carlier (1):
      tracing: Fix use-after-free freeing trigger private data

Fuad Tabba (1):
      tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer()

Jackie Liu (1):
      tracing: Propagate errors from remote event bulk updates

Masami Hiramatsu (Google) (2):
      tracing: Fix union collision of module and refcnt for dynamic events
      selftests/ftrace: Reset triggers at top level before instance loop

Steven Rostedt (2):
      tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev
      tracing: Delay module ref count for "enable_event" trigger

Usama Arif (1):
      tracing: Fix context switch counter truncation

deepakraog (1):
      tracing: Fix resource leak on mmiotrace trace_pipe close

----
 kernel/trace/trace.c                      |  2 +-
 kernel/trace/trace.h                      |  1 +
 kernel/trace/trace_events.c               |  4 +++-
 kernel/trace/trace_events_hist.c          |  2 ++
 kernel/trace/trace_events_trigger.c       | 22 ++++++++++++++++++----
 kernel/trace/trace_mmiotrace.c            |  4 ++--
 kernel/trace/trace_remote.c               | 16 +++++++++++++---
 tools/testing/selftests/ftrace/ftracetest |  1 +
 8 files changed, 41 insertions(+), 11 deletions(-)

^ permalink raw reply	[flat|nested] 12+ messages in thread
end of thread, other threads:[~2026-07-25 11:03 UTC | newest]

Thread overview: 12+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-24 23:18 [for-linus][PATCH 0/9] tracing: Fixes for 7.2 Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 1/9] tracing/remotes: Fix page_va[] access before counter update in trace_remote_alloc_buffer() Steven Rostedt
2026-07-25 10:00   ` David Laight
2026-07-25 11:04     ` Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 2/9] tracing: Propagate errors from remote event bulk updates Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 3/9] tracing: Fix resource leak on mmiotrace trace_pipe close Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 4/9] tracing: Fix mmiotrace possible NULL dereferencing of hiter->dev Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 5/9] tracing: Fix union collision of module and refcnt for dynamic events Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 6/9] selftests/ftrace: Reset triggers at top level before instance loop Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 7/9] tracing: Fix context switch counter truncation Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 8/9] tracing: Fix use-after-free freeing trigger private data Steven Rostedt
2026-07-24 23:18 ` [for-linus][PATCH 9/9] tracing: Delay module ref count for "enable_event" trigger Steven Rostedt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox