From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9E390ECAAA1 for ; Mon, 31 Oct 2022 18:50:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229730AbiJaSu4 (ORCPT ); Mon, 31 Oct 2022 14:50:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44494 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229628AbiJaSux (ORCPT ); Mon, 31 Oct 2022 14:50:53 -0400 Received: from ams.source.kernel.org (ams.source.kernel.org [IPv6:2604:1380:4601:e00::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 7060513EAF for ; Mon, 31 Oct 2022 11:50:51 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by ams.source.kernel.org (Postfix) with ESMTPS id A420FB819B0 for ; Mon, 31 Oct 2022 18:50:50 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D91BDC433D6; Mon, 31 Oct 2022 18:50:48 +0000 (UTC) Date: Mon, 31 Oct 2022 14:50:46 -0400 From: Steven Rostedt To: Roland Ruckerbauer Cc: Masami Hiramatsu , linux-kernel@vger.kernel.org Subject: Re: [BUG] NULL pointer dereference probably caused by kernel/trace/ring_buffer.c Message-ID: <20221031145046.2a7f9d32@rorschach.local.home> In-Reply-To: References: X-Mailer: Claws Mail 3.17.8 (GTK+ 2.24.33; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, 31 Oct 2022 14:02:12 +0100 Roland Ruckerbauer wrote: > For me the crash is easily reproducible. For testing I run 6.0.5 > upstream kernel, but I guess everything since 6.0.3 is affected as > well. I'm looking into a path that calls this function without allocating the buffer (when the file descriptor is released) I'm still looking to find that path, but in the mean time, could you test this? -- Steve diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 199759c73519..c1c7ce4c6ddb 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -937,6 +937,9 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu) struct ring_buffer_per_cpu *cpu_buffer; struct rb_irq_work *rbwork; + if (!buffer) + return; + if (cpu == RING_BUFFER_ALL_CPUS) { /* Wake up individual ones too. One level recursion */