[PATCH 0/2] tracing: Fix remote reader page swap failures

[PATCH 0/2] tracing: Fix remote reader page swap failures

[Ivan Immanuel Shaji via B4 Relay]

The simple ring buffer's reader-page swap retry loop mishandles its last
attempt. A success at that point is reported as an error, while a failure
is allowed to continue into the pointer updates. The remote ring buffer
consumer compounds callback failures by warning and continuing with stale
reader metadata.

Fix the retry result in the provider, then stop the remote consumer before
it mutates its local page list when the swap fails.

These paths are used by remote tracing, including arm64 nVHE EL2 tracing
and CONFIG_TRACE_REMOTE_TEST.

Testing:

  make C=2 W=1 kernel/trace/simple_ring_buffer.o kernel/trace/ring_buffer.o
  scripts/checkpatch.pl --no-tree (each formatted patch)

No runtime reproducer was run. The two final-attempt outcomes follow from
the retry counter's post-decrement semantics. An arm64 cross-compiler was
not available.

---
Ivan Immanuel Shaji (2):
      tracing: Fix retry exhaustion in simple ring buffer reader swap
      ring-buffer: Stop remote reader update when page swap fails

 kernel/trace/ring_buffer.c        | 5 +++--
 kernel/trace/simple_ring_buffer.c | 4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)
---
base-commit: 66498c75b4f8017f62d720d9b59675bdf3abce91
change-id: 20260825-kernel-patch-1-d806e3de01a5

Best regards,
-- 
Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

[PATCH 1/2] tracing: Fix retry exhaustion in simple ring buffer reader swap

[Ivan Immanuel Shaji via B4 Relay]

From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
post-decrements it only after a failed link replacement. On the final
attempt, a successful replacement leaves retry at zero, while a failed
replacement leaves it at -1.

The current !retry test reverses both outcomes. It returns an error after
a successful final replacement, leaving the link update complete but the
reader bookkeeping unfinished. After a failed final replacement, it
falls through and updates the head and reader pointers as though the
replacement succeeded, which can corrupt the ring.

Treat only a negative counter as exhaustion and return the documented
-EBUSY error.

Fixes: 34e5b958bdad ("tracing: Introduce simple_ring_buffer")
Cc: stable@vger.kernel.org
Assisted-by: LLM sparse
Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
---
 kernel/trace/simple_ring_buffer.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/simple_ring_buffer.c b/kernel/trace/simple_ring_buffer.c
index f4642f5adda3..49913bb0057a 100644
--- a/kernel/trace/simple_ring_buffer.c
+++ b/kernel/trace/simple_ring_buffer.c
@@ -160,8 +160,8 @@ int simple_ring_buffer_swap_reader_page(struct simple_rb_per_cpu *cpu_buffer)
 		overrun = cpu_buffer->meta->overrun;
 	} while (!simple_bpage_unset_head_link(last, reader, SIMPLE_RB_LINK_NORMAL) && retry--);
 
-	if (!retry)
-		return -EINVAL;
+	if (retry < 0)
+		return -EBUSY;
 
 	cpu_buffer->head_page = simple_bpage_from_link(reader->link.next);
 	cpu_buffer->head_page->link.prev = &reader->link;

-- 
2.53.0

Re: [PATCH 1/2] tracing: Fix retry exhaustion in simple ring buffer reader swap

[Vincent Donnefort]

On Tue, Aug 25, 2026 at 01:20:37AM -0400, Ivan Immanuel Shaji via B4 Relay wrote:
> From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
> 
> simple_ring_buffer_swap_reader_page() starts with retry set to 8 and
> post-decrements it only after a failed link replacement. On the final
> attempt, a successful replacement leaves retry at zero, while a failed
> replacement leaves it at -1.
> 
> The current !retry test reverses both outcomes. It returns an error after
> a successful final replacement, leaving the link update complete but the
> reader bookkeeping unfinished. After a failed final replacement, it
> falls through and updates the head and reader pointers as though the
> replacement succeeded, which can corrupt the ring.
> 
> Treat only a negative counter as exhaustion and return the documented
> -EBUSY error.
> 
> Fixes: 34e5b958bdad ("tracing: Introduce simple_ring_buffer")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM sparse
> Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

Reviewed-by: Vincent Donnefort <vdonnefort@google.com>

> ---
>  kernel/trace/simple_ring_buffer.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/simple_ring_buffer.c b/kernel/trace/simple_ring_buffer.c
> index f4642f5adda3..49913bb0057a 100644
> --- a/kernel/trace/simple_ring_buffer.c
> +++ b/kernel/trace/simple_ring_buffer.c
> @@ -160,8 +160,8 @@ int simple_ring_buffer_swap_reader_page(struct simple_rb_per_cpu *cpu_buffer)
>  		overrun = cpu_buffer->meta->overrun;
>  	} while (!simple_bpage_unset_head_link(last, reader, SIMPLE_RB_LINK_NORMAL) && retry--);
>  
> -	if (!retry)
> -		return -EINVAL;
> +	if (retry < 0)
> +		return -EBUSY;
>  
>  	cpu_buffer->head_page = simple_bpage_from_link(reader->link.next);
>  	cpu_buffer->head_page->link.prev = &reader->link;
> 
> -- 
> 2.53.0
> 
> 

[PATCH 2/2] ring-buffer: Stop remote reader update when page swap fails

[Ivan Immanuel Shaji via B4 Relay]

From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>

The remote swap_reader_page callback can fail when the writer moves the
head before the remote catches it. __rb_get_reader_page_from_remote()
warns about that failure but continues with the unchanged reader ID and
rearranges the local page list as though the swap succeeded.

Stop immediately after warning. Callers already handle a NULL reader
page as a failed attempt, and this avoids splicing the same page as both
the previous and new reader.

Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
Cc: stable@vger.kernel.org
Assisted-by: LLM sparse
Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
---
 kernel/trace/ring_buffer.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 3c3ed639923d..d11b2759caac 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5805,8 +5805,9 @@ __rb_get_reader_page_from_remote(struct ring_buffer_per_cpu *cpu_buffer)
 
 	prev_reader = cpu_buffer->subbuf_ids[cpu_buffer->meta_page->reader.id];
 
-	WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
-							  cpu_buffer->remote->priv));
+	if (WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
+							      cpu_buffer->remote->priv)))
+		return NULL;
 	/* nr_pages doesn't include the reader page */
 	if (WARN_ON_ONCE(cpu_buffer->meta_page->reader.id > cpu_buffer->nr_pages))
 		return NULL;

-- 
2.53.0

Re: [PATCH 2/2] ring-buffer: Stop remote reader update when page swap fails

[Vincent Donnefort]

On Tue, Aug 25, 2026 at 01:20:38AM -0400, Ivan Immanuel Shaji via B4 Relay wrote:
> From: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
> 
> The remote swap_reader_page callback can fail when the writer moves the
> head before the remote catches it. __rb_get_reader_page_from_remote()
> warns about that failure but continues with the unchanged reader ID and
> rearranges the local page list as though the swap succeeded.
> 
> Stop immediately after warning. Callers already handle a NULL reader
> page as a failed attempt, and this avoids splicing the same page as both
> the previous and new reader.
> 
> Fixes: 2e67fabd8b77 ("ring-buffer: Introduce ring-buffer remotes")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM sparse
> Signed-off-by: Ivan Immanuel Shaji <ivanimmanuel1234@gmail.com>
> ---
>  kernel/trace/ring_buffer.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 3c3ed639923d..d11b2759caac 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -5805,8 +5805,9 @@ __rb_get_reader_page_from_remote(struct ring_buffer_per_cpu *cpu_buffer)
>  
>  	prev_reader = cpu_buffer->subbuf_ids[cpu_buffer->meta_page->reader.id];
>  
> -	WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
> -							  cpu_buffer->remote->priv));
> +	if (WARN_ON_ONCE(cpu_buffer->remote->swap_reader_page(cpu_buffer->cpu,
> +							      cpu_buffer->remote->priv)))
> +		return NULL;
>  	/* nr_pages doesn't include the reader page */
>  	if (WARN_ON_ONCE(cpu_buffer->meta_page->reader.id > cpu_buffer->nr_pages))
>  		return NULL;
> 
> -- 
> 2.53.0
> 
> 

If handled gracefully and as this can be triggered by a storm of events on small
buffer (when -EBUSY) I wonder if we shouldn't use a pr_warn_ratelimited()
instead of a WARN()?

-- 
Vincent