Re: [BUG] NULL pointer dereference probably caused by kernel/trace/ring_buffer.c

[Steven Rostedt <rostedt@goodmis.org>]

On Tue, 1 Nov 2022 18:35:12 -0400
Steven Rostedt <rostedt@goodmis.org> wrote:

> OK, this is a great clue. I'll dig deeper.

One more NULL check. And this one is legit, and I'm betting is the fix.

The buffer->buffers is allocated to nr_cpu_ids, but are only
initialized for online CPUs. If you have a CPU that is not yet
initialized (or may never be), then the cpu_buffer will be NULL.

-- Steve

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 199759c73519..4ffcc6e33258 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -937,6 +937,9 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu)
 	struct ring_buffer_per_cpu *cpu_buffer;
 	struct rb_irq_work *rbwork;
 
+	if (!buffer)
+		return;
+
 	if (cpu == RING_BUFFER_ALL_CPUS) {
 
 		/* Wake up individual ones too. One level recursion */
@@ -945,7 +948,14 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu)
 
 		rbwork = &buffer->irq_work;
 	} else {
+		if (WARN_ON_ONCE(!buffer->buffers))
+			return;
+		if (WARN_ON_ONCE(cpu >= nr_cpu_ids))
+			return;
 		cpu_buffer = buffer->buffers[cpu];
+		/* The CPU buffer may not have been initialized yet */
+		if (!cpu_buffer)
+			return;
 		rbwork = &cpu_buffer->irq_work;
 	}