From: Steven Rostedt <rostedt@kernel.org>
To: linux-kernel@vger.kernel.org
Cc: Masami Hiramatsu <mhiramat@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Mathieu Desnoyers <mathieu.desnoyers@efficios.com>,
Andrew Morton <akpm@linux-foundation.org>,
stable@vger.kernel.org, Hui Su <sh_def@163.com>,
Vincent Donnefort <vdonnefort@google.com>
Subject: [for-linus][PATCH 12/12] ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
Date: Sat, 08 Aug 2026 22:31:56 -0400 [thread overview]
Message-ID: <20260809023223.100369362@kernel.org> (raw)
In-Reply-To: 20260809023144.852271250@kernel.org
From: Hui Su <sh_def@163.com>
In test_ringbuffer()'s out_free cleanup loop, the check
`!rb_threads[cpu]` only catches NULL entries and misses entries that
hold an ERR_PTR.
rb_threads[] is static, so unassigned slots are NULL. But when
kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or
-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.
That entry is non-NULL, so the old `!ptr` check does not break, and the
cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()
then dereferences the bogus pointer, crashing the kernel during the
late_initcall self-test.
crash logs:
BUG: kernel NULL pointer dereference, address: 000000000000001c
Oops: 0002 [#1] SMP NOPTI
CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)
RIP: 0010:kthread_stop+0x2e/0x220
RBX: fffffffffffffff4
CR2: 000000000000001c
Call Trace:
<TASK>
test_ringbuffer+0x1ec/0x650
do_one_initcall+0x6c/0x2c0
kernel_init_freeable+0x21d/0x420
kernel_init+0x15/0x1c0
ret_from_fork+0x21b/0x320
</TASK>
Kernel panic - not syncing: Fatal exception
Cc: stable@vger.kernel.org
Fixes: 64ed3a049e3e ("ring-buffer: make use of the helper function kthread_run_on_cpu()")
Link: https://patch.msgid.link/20260807154145.2846521-2-sh_def@163.com
Signed-off-by: Hui Su <sh_def@163.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
kernel/trace/ring_buffer.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 760a00e8505c..2667992f0aa2 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -8217,7 +8217,7 @@ static __init int test_ringbuffer(void)
out_free:
for_each_online_cpu(cpu) {
- if (!rb_threads[cpu])
+ if (IS_ERR_OR_NULL(rb_threads[cpu]))
break;
kthread_stop(rb_threads[cpu]);
}
--
2.53.0
prev parent reply other threads:[~2026-08-09 2:32 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-09 2:31 [for-linus][PATCH 00/12] tracing: Fixes for 7.2 Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 01/12] eventfs: Fix use-after-free in eventfs_remove_rec() Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 02/12] eventfs: Use children field for rcu head and add memory barriers Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 03/12] ftrace: Protect direct_functions in ftrace_find_rec_direct Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 04/12] ftrace: Protect direct_functions in update_ftrace_direct_del Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 05/12] ftrace: Protect direct_functions in update_ftrace_direct_mod Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 06/12] ftrace: Drop extra comma in trace_buffered_event_enable Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 07/12] ring-buffer: Use current_context for safe per-CPU buffer swap Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 08/12] ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 09/12] ring-buffer: Prevent resizing of persistent ring buffer Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 10/12] ring-buffer: Prevent subbuf order change when resizing is disabled Steven Rostedt
2026-08-09 2:31 ` [for-linus][PATCH 11/12] ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer() Steven Rostedt
2026-08-09 2:31 ` Steven Rostedt [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260809023223.100369362@kernel.org \
--to=rostedt@kernel.org \
--cc=akpm@linux-foundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mark.rutland@arm.com \
--cc=mathieu.desnoyers@efficios.com \
--cc=mhiramat@kernel.org \
--cc=sh_def@163.com \
--cc=stable@vger.kernel.org \
--cc=vdonnefort@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox