STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Lee Jones]

Dear Stable,

> Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
> uninitialized memory to userspace due to stale size values.
> 
> Modify ring_buffer_alloc_read_page() to let it handle the resizing of
> a previous buffer_data_read_page if necessary and add a new
> ring_buffer_read_page_size() which enable ring-buffer users to not use
> the racy ring_buffer_subbuf_size_get(). This makes the spare_size member
> of ftrace_buffer_info redundant.
> 
> Use those functions in trace_pipe_raw readers and handle in both the
> case where the subbuf order is modified in the middle of the read.
> 
> Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
> Signed-off-by: Vincent Donnefort <vdonnefort@google.com>

Not sure if this is the latest version or not?

I see review comments, but no v6.  Anyway, no matter, it'll do.

Could we have this applied to Stable please:

8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers")

-- 
Lee Jones

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Steven Rostedt]

On Tue, 1 Sep 2026 13:34:44 +0100
Lee Jones <lee@kernel.org> wrote:

> Could we have this applied to Stable please:
> 
> 8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers")

It's marked for stable so it should automatically be backported (if it
applies cleanly). Relax, it was just added last week.

-- Steve

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Lee Jones]

On Tue, 01 Sep 2026, Steven Rostedt wrote:

> On Tue, 1 Sep 2026 13:34:44 +0100
> Lee Jones <lee@kernel.org> wrote:
> 
> > Could we have this applied to Stable please:
> > 
> > 8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers")
> 
> It's marked for stable so it should automatically be backported (if it

Where was it marked for Stable?

> applies cleanly). Relax, it was just added last week.

-- 
Lee Jones

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Greg KH]

On Wed, Sep 02, 2026 at 09:27:17AM +0100, Lee Jones wrote:
> On Tue, 01 Sep 2026, Steven Rostedt wrote:
> 
> > On Tue, 1 Sep 2026 13:34:44 +0100
> > Lee Jones <lee@kernel.org> wrote:
> > 
> > > Could we have this applied to Stable please:
> > > 
> > > 8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers")
> > 
> > It's marked for stable so it should automatically be backported (if it
> 
> Where was it marked for Stable?

It has:
	Cc: stable@vger.kernel.org
in the patch itself.  It is in my queue to get to, along with over 1000+
other patches that people decided to tag for stable and yet wait for the
-rc1 merge window to get to Linus.

It will get there eventually...

thanks,

greg k-h

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Lee Jones]

On Wed, 02 Sep 2026, Greg KH wrote:

> On Wed, Sep 02, 2026 at 09:27:17AM +0100, Lee Jones wrote:
> > On Tue, 01 Sep 2026, Steven Rostedt wrote:
> > 
> > > On Tue, 1 Sep 2026 13:34:44 +0100
> > > Lee Jones <lee@kernel.org> wrote:
> > > 
> > > > Could we have this applied to Stable please:
> > > > 
> > > > 8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers")
> > > 
> > > It's marked for stable so it should automatically be backported (if it
> > 
> > Where was it marked for Stable?
> 
> It has:
> 	Cc: stable@vger.kernel.org
> in the patch itself.  It is in my queue to get to, along with over 1000+
> other patches that people decided to tag for stable and yet wait for the
> -rc1 merge window to get to Linus.

Am I losing the plot?  The patch that I replied to [0] did not Cc:
Stable.  If it had, I wouldn't have made the request.

  From: Vincent Donnefort <vdonnefort@google.com>
  To: rostedt@goodmis.org, mhiramat@kernel.org,
  	 linux-trace-kernel@vger.kernel.org
  Cc: mathieu.desnoyers@efficios.com, kernel-team@android.com,
  	 linux-kernel@vger.kernel.org,
  	Vincent Donnefort <vdonnefort@google.com>
  Subject: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

  [...]

  Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
  Signed-off-by: Vincent Donnefort <vdonnefort@google.com>

> It will get there eventually...

This wasn't an urgent request or a request to expedite.  Take your time.

[0] https://lore.kernel.org/all/20260813131152.3589632-7-vdonnefort@google.com/

-- 
Lee Jones

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Greg KH]

On Wed, Sep 02, 2026 at 10:57:44AM +0100, Lee Jones wrote:
> On Wed, 02 Sep 2026, Greg KH wrote:
> 
> > On Wed, Sep 02, 2026 at 09:27:17AM +0100, Lee Jones wrote:
> > > On Tue, 01 Sep 2026, Steven Rostedt wrote:
> > > 
> > > > On Tue, 1 Sep 2026 13:34:44 +0100
> > > > Lee Jones <lee@kernel.org> wrote:
> > > > 
> > > > > Could we have this applied to Stable please:
> > > > > 
> > > > > 8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers")
> > > > 
> > > > It's marked for stable so it should automatically be backported (if it
> > > 
> > > Where was it marked for Stable?
> > 
> > It has:
> > 	Cc: stable@vger.kernel.org
> > in the patch itself.  It is in my queue to get to, along with over 1000+
> > other patches that people decided to tag for stable and yet wait for the
> > -rc1 merge window to get to Linus.
> 
> Am I losing the plot?  The patch that I replied to [0] did not Cc:
> Stable.  If it had, I wouldn't have made the request.
> 
>   From: Vincent Donnefort <vdonnefort@google.com>
>   To: rostedt@goodmis.org, mhiramat@kernel.org,
>   	 linux-trace-kernel@vger.kernel.org
>   Cc: mathieu.desnoyers@efficios.com, kernel-team@android.com,
>   	 linux-kernel@vger.kernel.org,
>   	Vincent Donnefort <vdonnefort@google.com>
>   Subject: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers
> 
>   [...]
> 
>   Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
>   Signed-off-by: Vincent Donnefort <vdonnefort@google.com>


I'm lost, I was referring to the above git id that was asked about,
sorry.

> > It will get there eventually...
> 
> This wasn't an urgent request or a request to expedite.  Take your time.

Back to the never-ending-queue...

greg k-h

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Lee Jones]

On Wed, 02 Sep 2026, Greg KH wrote:

> On Wed, Sep 02, 2026 at 10:57:44AM +0100, Lee Jones wrote:
> > On Wed, 02 Sep 2026, Greg KH wrote:
> > 
> > > On Wed, Sep 02, 2026 at 09:27:17AM +0100, Lee Jones wrote:
> > > > On Tue, 01 Sep 2026, Steven Rostedt wrote:
> > > > 
> > > > > On Tue, 1 Sep 2026 13:34:44 +0100
> > > > > Lee Jones <lee@kernel.org> wrote:
> > > > > 
> > > > > > Could we have this applied to Stable please:
> > > > > > 
> > > > > > 8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers")
> > > > > 
> > > > > It's marked for stable so it should automatically be backported (if it
> > > > 
> > > > Where was it marked for Stable?
> > > 
> > > It has:
> > > 	Cc: stable@vger.kernel.org
> > > in the patch itself.  It is in my queue to get to, along with over 1000+
> > > other patches that people decided to tag for stable and yet wait for the
> > > -rc1 merge window to get to Linus.
> > 
> > Am I losing the plot?  The patch that I replied to [0] did not Cc:
> > Stable.  If it had, I wouldn't have made the request.
> > 
> >   From: Vincent Donnefort <vdonnefort@google.com>
> >   To: rostedt@goodmis.org, mhiramat@kernel.org,
> >   	 linux-trace-kernel@vger.kernel.org
> >   Cc: mathieu.desnoyers@efficios.com, kernel-team@android.com,
> >   	 linux-kernel@vger.kernel.org,
> >   	Vincent Donnefort <vdonnefort@google.com>
> >   Subject: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers
> > 
> >   [...]
> > 
> >   Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
> >   Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> 
> 
> I'm lost, I was referring to the above git id that was asked about,
> sorry.

Ah, so Steven must have added it to the commit on application.

That makes sense now.  As you were!

> > > It will get there eventually...
> > 
> > This wasn't an urgent request or a request to expedite.  Take your time.
> 
> Back to the never-ending-queue...

Enjoy!

-- 
Lee Jones

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Steven Rostedt]

On Wed, 2 Sep 2026 12:59:44 +0100
Lee Jones <lee@kernel.org> wrote:

> > I'm lost, I was referring to the above git id that was asked about,
> > sorry.  
> 
> Ah, so Steven must have added it to the commit on application.

Right. As the maintainer, I decide what should be marked as stable or not.
I never require a patch submitter to add it. I'll add it if I feel it
should be backported.

There's even been times that I *removed* a Cc to stable because I did not
think it was worth the backport. Of course, I still keep the Fixes tag,
which means it will likely be backported anyway. But that's up to the
stable maintainers to decide ;-)

-- Steve

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Steven Rostedt]

On Wed, 2 Sep 2026 08:21:41 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> There's even been times that I *removed* a Cc to stable because I did not
> think it was worth the backport. Of course, I still keep the Fixes tag,
> which means it will likely be backported anyway. But that's up to the
> stable maintainers to decide ;-)

The big difference between a commit with the Fixes tag and a Cc to stable
verses one with the Fixes tag without the Cc stable, is that the one with
Cc stable will give me a "FAILED" message if it fails to apply. One with
just the Fixes tag and no Cc stable, will not generate that message to me
if it doesn't apply back to the version with the Fixes commit sha.

I do like to know what I marked as stable and fails to apply. Unfortunately
I don't have the time to go fix them. But I keep them in a mail folder in
case I need to do it one day.

-- Steve

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Lee Jones]

On Wed, 02 Sep 2026, Steven Rostedt wrote:

> On Wed, 2 Sep 2026 08:21:41 -0400
> Steven Rostedt <rostedt@goodmis.org> wrote:
> 
> > There's even been times that I *removed* a Cc to stable because I did not
> > think it was worth the backport. Of course, I still keep the Fixes tag,
> > which means it will likely be backported anyway. But that's up to the
> > stable maintainers to decide ;-)

Pretty sure this isn't the case anymore.  RIP AUTOSEL.

> The big difference between a commit with the Fixes tag and a Cc to stable
> verses one with the Fixes tag without the Cc stable, is that the one with
> Cc stable will give me a "FAILED" message if it fails to apply. One with
> just the Fixes tag and no Cc stable, will not generate that message to me
> if it doesn't apply back to the version with the Fixes commit sha.

So what happens when you receive the FAILED message?

And why are you interested to know how far back a fix can be backported?

Personally, I'm _very_ interested in a _small_ number of patches, but
none of which usually emanate from subsystems I maintain.

> I do like to know what I marked as stable and fails to apply. Unfortunately
> I don't have the time to go fix them. But I keep them in a mail folder in
> case I need to do it one day.

We have have such wonderful aspirations.  Maybe we can get around to
those jobs when AI starts doing our jobs for us!  =;-)

-- 
Lee Jones

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Steven Rostedt]

On Wed, 2 Sep 2026 17:22:46 +0100
Lee Jones <lee@kernel.org> wrote:

> So what happens when you receive the FAILED message?
> 
> And why are you interested to know how far back a fix can be backported?
> 
> Personally, I'm _very_ interested in a _small_ number of patches, but
> none of which usually emanate from subsystems I maintain.

I'm interested because they only get backported to kernels that are
maintained for some reason. And since these are in my subsystem, I do like
to know that my code works for all supported kernel releases. ;-)

-- Steve

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Lee Jones]

On Wed, 02 Sep 2026, Steven Rostedt wrote:

> On Wed, 2 Sep 2026 17:22:46 +0100
> Lee Jones <lee@kernel.org> wrote:
> 
> > So what happens when you receive the FAILED message?
> > 
> > And why are you interested to know how far back a fix can be backported?
> > 
> > Personally, I'm _very_ interested in a _small_ number of patches, but
> > none of which usually emanate from subsystems I maintain.
> 
> I'm interested because they only get backported to kernels that are
> maintained for some reason. And since these are in my subsystem, I do like
> to know that my code works for all supported kernel releases. ;-)

Well that's unusually conscientious of you.  I like it.  =:-)

NB: Not that _you_ are unconscientious - I was referring to the rest of us!

-- 
Lee Jones

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Vincent Donnefort]

On Tue, Sep 01, 2026 at 01:34:44PM +0100, Lee Jones wrote:
> Dear Stable,
> 
> > Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
> > uninitialized memory to userspace due to stale size values.
> > 
> > Modify ring_buffer_alloc_read_page() to let it handle the resizing of
> > a previous buffer_data_read_page if necessary and add a new
> > ring_buffer_read_page_size() which enable ring-buffer users to not use
> > the racy ring_buffer_subbuf_size_get(). This makes the spare_size member
> > of ftrace_buffer_info redundant.
> > 
> > Use those functions in trace_pipe_raw readers and handle in both the
> > case where the subbuf order is modified in the middle of the read.
> > 
> > Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
> > Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> 
> Not sure if this is the latest version or not?
> 
> I see review comments, but no v6.  Anyway, no matter, it'll do.
> 
> Could we have this applied to Stable please:
> 
> 8a5f63637890 ("ring-buffer: Fix subbuf resize race with ring buffer readers")
> 
> -- 
> Lee Jones

Steven hasn't taken all the patches from v5, a few of them were not ready yet.

The latest version is v8 [1]... and I am about to send a v9.

[1] https://lore.kernel.org/all/20260826094528.3738023-1-vdonnefort@google.com/ 

-- 
Vincent

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Sasha Levin]

> Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
> uninitialized memory to userspace due to stale size values.
>
> Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
> Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
>
> Not sure if this is the latest version or not?
>
> I see review comments, but no v6.  Anyway, no matter, it'll do.

Queued for 7.2, thanks.

-- 
Thanks,
Sasha

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Vincent Donnefort]

On Wed, Sep 02, 2026 at 06:14:05PM -0400, Sasha Levin wrote:
> > Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
> > uninitialized memory to userspace due to stale size values.
> >
> > Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
> > Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> >
> > Not sure if this is the latest version or not?
> >
> > I see review comments, but no v6.  Anyway, no matter, it'll do.
> 
> Queued for 7.2, thanks.
> 
> -- 
> Thanks,
> Sasha

This isn't the last version of this patch, I have just posted a v9 [1] and
Steven hasn't reviewed it yet.

[1] https://lore.kernel.org/all/20260901155445.1475405-3-vdonnefort@google.com/

-- 
Vincent

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers

[Lee Jones]

On Thu, 03 Sep 2026, Vincent Donnefort wrote:

> On Wed, Sep 02, 2026 at 06:14:05PM -0400, Sasha Levin wrote:
> > > Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
> > > uninitialized memory to userspace due to stale size values.
> > >
> > > Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
> > > Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> > >
> > > Not sure if this is the latest version or not?
> > >
> > > I see review comments, but no v6.  Anyway, no matter, it'll do.
> > 
> > Queued for 7.2, thanks.
> > 
> > -- 
> > Thanks,
> > Sasha
> 
> This isn't the last version of this patch, I have just posted a v9 [1] and
> Steven hasn't reviewed it yet.
> 
> [1] https://lore.kernel.org/all/20260901155445.1475405-3-vdonnefort@google.com/

The confusion  is mine to own.  I responded to the wrong patch mail, sorry!

  `ring-buffer: Fix subbuf resize race with ring buffer readers`

Which is in Mainline with the immutable SHA 8a5f63637890.  My assumption
is that Sasha queued the correct commit or the tools would have
complained loudly.

-- 
Lee Jones

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers\

[Sasha Levin]

On Thu, Sep 03, 2026 at 01:34:55PM +0100, Lee Jones wrote:
>On Thu, 03 Sep 2026, Vincent Donnefort wrote:
>
>> On Wed, Sep 02, 2026 at 06:14:05PM -0400, Sasha Levin wrote:
>> > > Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
>> > > uninitialized memory to userspace due to stale size values.
>> > >
>> > > Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
>> > > Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
>> > >
>> > > Not sure if this is the latest version or not?
>> > >
>> > > I see review comments, but no v6.  Anyway, no matter, it'll do.
>> >
>> > Queued for 7.2, thanks.
>> >
>> > --
>> > Thanks,
>> > Sasha
>>
>> This isn't the last version of this patch, I have just posted a v9 [1] and
>> Steven hasn't reviewed it yet.
>>
>> [1] https://lore.kernel.org/all/20260901155445.1475405-3-vdonnefort@google.com/
>
>The confusion  is mine to own.  I responded to the wrong patch mail, sorry!
>
>  `ring-buffer: Fix subbuf resize race with ring buffer readers`
>
>Which is in Mainline with the immutable SHA 8a5f63637890.  My assumption
>is that Sasha queued the correct commit or the tools would have
>complained loudly.

Indeed, sorry for the confusion! I've queued 8a5f63637890 ("ring-buffer: Fix
subbuf resize race with ring buffer readers") for 7.2.

-- 
Thanks,
Sasha

Re: STABLE REQ: [PATCH v5 06/10] tracing: Fix subbuf resize races with trace_pipe_raw readers\

[Lee Jones]

On Thu, 03 Sep 2026, Sasha Levin wrote:

> On Thu, Sep 03, 2026 at 01:34:55PM +0100, Lee Jones wrote:
> > On Thu, 03 Sep 2026, Vincent Donnefort wrote:
> > 
> > > On Wed, Sep 02, 2026 at 06:14:05PM -0400, Sasha Levin wrote:
> > > > > Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
> > > > > uninitialized memory to userspace due to stale size values.
> > > > >
> > > > > Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
> > > > > Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
> > > > >
> > > > > Not sure if this is the latest version or not?
> > > > >
> > > > > I see review comments, but no v6.  Anyway, no matter, it'll do.
> > > >
> > > > Queued for 7.2, thanks.
> > > >
> > > > --
> > > > Thanks,
> > > > Sasha
> > > 
> > > This isn't the last version of this patch, I have just posted a v9 [1] and
> > > Steven hasn't reviewed it yet.
> > > 
> > > [1] https://lore.kernel.org/all/20260901155445.1475405-3-vdonnefort@google.com/
> > 
> > The confusion  is mine to own.  I responded to the wrong patch mail, sorry!
> > 
> >  `ring-buffer: Fix subbuf resize race with ring buffer readers`
> > 
> > Which is in Mainline with the immutable SHA 8a5f63637890.  My assumption
> > is that Sasha queued the correct commit or the tools would have
> > complained loudly.
> 
> Indeed, sorry for the confusion! I've queued 8a5f63637890 ("ring-buffer: Fix
> subbuf resize race with ring buffer readers") for 7.2.

Super, thanks bud.

-- 
Lee Jones