The Linux Kernel Mailing List
 help / color / mirror / Atom feed
* [for-linus][PATCH 00/12] tracing: Fixes for 7.2
@ 2026-08-09  2:31 Steven Rostedt
  2026-08-09  2:31 ` [for-linus][PATCH 01/12] eventfs: Fix use-after-free in eventfs_remove_rec() Steven Rostedt
                   ` (11 more replies)
  0 siblings, 12 replies; 13+ messages in thread
From: Steven Rostedt @ 2026-08-09  2:31 UTC (permalink / raw)
  To: linux-kernel
  Cc: Masami Hiramatsu, Mark Rutland, Mathieu Desnoyers, Andrew Morton

tracing fixes for 7.2:

- Fix use-after-free in eventfs_remove_rec()

  The freeing of the eventfs_inode children used list_for_each_entry() where
  the child is freed via srcu, but there's still a chance that it gets freed.
  It should be using list_for_each_entry_safe().

- Fix eventfs_inode SRCU use of list in freeing

  The iterator uses an SRCU protected list walk on the eventfs inodes. The
  eventfs inode uses its "list" field in a union with the RCU list head.
  When the inode gets added to the SRCU list it immediately corrupts the
  list pointer and can cause an issue with the iterator. Move the RCU list
  head to be shared with the children list head which allows the iterator to
  check the parent inode if is freed before referencing the child. Have the
  iterator check the parent "is_freed" field and break out if it is set.
  Also add memory barriers to make sure the ordering is correct.

- Fix various RCU synchronization issues with direct_functions

  Updates to direct_functions have some missing RCU protection and
  synchronization. Restructure the code a bit to make sure updates to the
  direct_functions are protected.

- Remove an unneeded comma from a scope_guard()

  There's a spurious comma in a scope_guard(). Remove it.

- Fix race in per CPU buffer swap in the ring buffer

  When a per CPU buffer swap happens, it must make sure that it doesn't
  occur while a writer is active. Instead it returns an -EBUSY. But there's
  a small race window when a writer moves from one sub-buffer to the next
  that it resets the "committing" counter. If a swap happens at that moment,
  the buffer used for the commit of an event will not match the buffer the
  event is actually on. Instead of using the "committing" counter, use the
  recursive detection counter that does not get reset when the writer
  crosses sub-buffers.

- Fix off-by-one in ftrace_free_mem()

  The function ftrace_free_mem() gets an "end_ptr" as a parameter that is
  exclusive to the rang to be freed. But its value is used to search for the
  records that expects an inclusive value. Subtract one from the parameter
  to convert it to an inclusive range.

- Disable resizing of the ring buffer for persistent buffers

  Resizing the persistent buffer has undefined behavior. Prevent it from
  being resized.

- Disable changing ring buffer subbuf order when resizing is disabled

  The ring buffer subbuffer order can not be changed during resizing. Use
  that instead of just checking if the buffer is mapped as mapped buffers
  also have resizing disabled.

- Initialize subbuf_order of reader pages when they are created

  In rb_allocate_cpu_buffer() the bpage->order is not updated to the current
  subbuf_order leaving it as zero. This value is used when the page is freed.

- Fix test_ringbuffer() to test for ERR_PTR before calling kthread_stop()

  The rb_threads[] array is assigned the output of kthread_run_on_cpu()
  which could return an ERR_PTR. At the end of the test, all threads in the
  array are cleaned up by kthread_stop() passing in the value in the array
  if it isn't zero. But if the array contains an ERR_PTR, kthread_stop()
  will not be able to handle it properly.

  

Please pull the latest trace/fixes tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace/fixes

Head SHA1: 91542863abade2fd4f2b361991f5386ad9d19c8c


Hui Su (1):
      ring-buffer: Fix crash passing ERR_PTR to kthread_stop()

Josh Poimboeuf (1):
      ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()

Leon Hwang (4):
      ftrace: Protect direct_functions in ftrace_find_rec_direct
      ftrace: Protect direct_functions in update_ftrace_direct_del
      ftrace: Protect direct_functions in update_ftrace_direct_mod
      ftrace: Drop extra comma in trace_buffered_event_enable

Shuangpeng Bai (1):
      eventfs: Fix use-after-free in eventfs_remove_rec()

Steven Rostedt (1):
      eventfs: Use children field for rcu head and add memory barriers

Tengda Wu (1):
      ring-buffer: Use current_context for safe per-CPU buffer swap

Vincent Donnefort (3):
      ring-buffer: Prevent resizing of persistent ring buffer
      ring-buffer: Prevent subbuf order change when resizing is disabled
      ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()

----
 fs/tracefs/event_inode.c   | 28 ++++++++++++++++++++++++++--
 fs/tracefs/internal.h      |  4 ++--
 kernel/trace/ftrace.c      | 33 +++++++++++++++++++++++----------
 kernel/trace/ring_buffer.c | 15 +++++++++------
 kernel/trace/trace.c       |  2 +-
 5 files changed, 61 insertions(+), 21 deletions(-)

^ permalink raw reply	[flat|nested] 13+ messages in thread
end of thread, other threads:[~2026-08-09  2:32 UTC | newest]

Thread overview: 13+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-09  2:31 [for-linus][PATCH 00/12] tracing: Fixes for 7.2 Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 01/12] eventfs: Fix use-after-free in eventfs_remove_rec() Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 02/12] eventfs: Use children field for rcu head and add memory barriers Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 03/12] ftrace: Protect direct_functions in ftrace_find_rec_direct Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 04/12] ftrace: Protect direct_functions in update_ftrace_direct_del Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 05/12] ftrace: Protect direct_functions in update_ftrace_direct_mod Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 06/12] ftrace: Drop extra comma in trace_buffered_event_enable Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 07/12] ring-buffer: Use current_context for safe per-CPU buffer swap Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 08/12] ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 09/12] ring-buffer: Prevent resizing of persistent ring buffer Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 10/12] ring-buffer: Prevent subbuf order change when resizing is disabled Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 11/12] ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() Steven Rostedt
2026-08-09  2:31 ` [for-linus][PATCH 12/12] ring-buffer: Fix crash passing ERR_PTR to kthread_stop() Steven Rostedt

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox