mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
* [GIT PULL] tracing: Fixes for v7.2
@ 2026-08-01  0:44 Steven Rostedt
  2026-08-01  4:13 ` pr-tracker-bot
  0 siblings, 1 reply; 5+ messages in thread
From: Steven Rostedt @ 2026-08-01  0:44 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: LKML, Masami Hiramatsu (Google),
	Vincent Donnefort, Mathieu Desnoyers, Andrew Morton


Linus,

tracing fixes for v7.2:

- Reset dropped_count in mmio_reset_data()

  When mmio_reset_data() is called, it does not reset the dropped_count
  so that subsequent runs will have incorrect reporting.

- Add NULL check for mmio_trace_array in logging functions

  The functions __trace_mmiotrace_rw() and __trace_mmiotrace_map()
  may have the 'tr' variable passed to it as NULL. But they both
  dereference it without checking if it is NULL first.

- Check return value of __register_event() in trace_module_add_events()

  If __register_event() fails, the call after it (__add_event_to_tracers())
  will create a file for it. If the module fails to load and its memory
  is freed, the file will still point to it and it will not be removed
  as the registering of the event did not complete. Only call
  __add_event_to_tracers() if the __register_event() was successful.

- Fix false positive match in regex_match_full()

  The regex full matching uses a strncmp() to test against the match
  string and the value. It should not match if value is a prefix of
  the string to match. Check to make sure the length of the strings
  match before comparing.

- Fix reader page read offset for remote buffers

  A page swapped in by __rb_get_reader_page_from_remote() retains its
  stale read offset, causing subsequent reads to skip events or read
  past valid data.

- Fix memory leak of subbuf_ids in rb_allocate_cpu_buffer()

  Remote buffers allocate a subbuf_ids array. If the allocator function
  fails after it is allocated, it does not free it, resulting in a
  memory leak.


Please pull the latest trace-v7.2-rc5 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v7.2-rc5

Tag SHA1: f07a8527f1050765a6684e0f0fac7cc6a3ead4b0
Head SHA1: 260b20d9b78bf002f89088fb62d60e8dee98f6f8


Masami Hiramatsu (Google) (5):
      tracing/mmiotrace: Reset dropped_count in mmio_reset_data()
      tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
      tracing: Check return value of __register_event() in trace_module_add_events()
      tracing/filters: Fix false positive match in regex_match_full()
      ring-buffer: Fix subbuf_ids memory leak in rb_allocate_cpu_buffer() error path

Vincent Donnefort (1):
      ring-buffer: Fix reader page read offset for remote buffers

----
 kernel/trace/ring_buffer.c         |  2 ++
 kernel/trace/trace_events.c        |  4 ++--
 kernel/trace/trace_events_filter.c |  3 +++
 kernel/trace/trace_mmiotrace.c     | 13 +++++++++++--
 4 files changed, 18 insertions(+), 4 deletions(-)
---------------------------
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 804ccae694d2..8e2485bb3aa8 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2599,6 +2599,7 @@ rb_allocate_cpu_buffer(struct trace_buffer *buffer, long nr_pages, int cpu)
 	return_ptr(cpu_buffer);
 
  fail_free_reader:
+	kfree(cpu_buffer->subbuf_ids);
 	free_buffer_page(cpu_buffer->reader_page);
 
 	return NULL;
@@ -5783,6 +5784,7 @@ __rb_get_reader_page_from_remote(struct ring_buffer_per_cpu *cpu_buffer)
 
 	cpu_buffer->head_page = new_head;
 	cpu_buffer->reader_page = new_reader;
+	cpu_buffer->reader_page->read = 0;
 	cpu_buffer->pages = &new_head->list;
 	cpu_buffer->read_stamp = new_reader->page->time_stamp;
 	cpu_buffer->lost_events = cpu_buffer->meta_page->reader.lost_events;
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index 956692856fa8..c01b10b99f67 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -3933,8 +3933,8 @@ static void trace_module_add_events(struct module *mod)
 	end = mod->trace_events + mod->num_trace_events;
 
 	for_each_event(call, start, end) {
-		__register_event(*call, mod);
-		__add_event_to_tracers(*call);
+		if (!__register_event(*call, mod))
+			__add_event_to_tracers(*call);
 	}
 
 	update_cache_events(mod);
diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
index 6385cd662d8d..2b46ca536045 100644
--- a/kernel/trace/trace_events_filter.c
+++ b/kernel/trace/trace_events_filter.c
@@ -1027,6 +1027,9 @@ static int regex_match_full(char *str, struct regex *r, int len)
 	if (!len)
 		return strcmp(str, r->pattern) == 0;
 
+	if (len < r->len)
+		return 0;
+
 	return strncmp(str, r->pattern, len) == 0;
 }
 
diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
index b88b8d9923ad..df8692c2dea8 100644
--- a/kernel/trace/trace_mmiotrace.c
+++ b/kernel/trace/trace_mmiotrace.c
@@ -29,6 +29,7 @@ static void mmio_reset_data(struct trace_array *tr)
 {
 	overrun_detected = false;
 	prev_overruns = 0;
+	atomic_set(&dropped_count, 0);
 
 	tracing_reset_online_cpus(&tr->array_buffer);
 }
@@ -293,11 +294,15 @@ device_initcall(init_mmio_trace);
 static void __trace_mmiotrace_rw(struct trace_array *tr,
 				struct mmiotrace_rw *rw)
 {
-	struct trace_buffer *buffer = tr->array_buffer.buffer;
+	struct trace_buffer *buffer;
 	struct ring_buffer_event *event;
 	struct trace_mmiotrace_rw *entry;
 	unsigned int trace_ctx;
 
+	if (!tr)
+		return;
+
+	buffer = tr->array_buffer.buffer;
 	trace_ctx = tracing_gen_ctx_flags(0);
 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
 					  sizeof(*entry), trace_ctx);
@@ -320,11 +325,15 @@ void mmio_trace_rw(struct mmiotrace_rw *rw)
 static void __trace_mmiotrace_map(struct trace_array *tr,
 				struct mmiotrace_map *map)
 {
-	struct trace_buffer *buffer = tr->array_buffer.buffer;
+	struct trace_buffer *buffer;
 	struct ring_buffer_event *event;
 	struct trace_mmiotrace_map *entry;
 	unsigned int trace_ctx;
 
+	if (!tr)
+		return;
+
+	buffer = tr->array_buffer.buffer;
 	trace_ctx = tracing_gen_ctx_flags(0);
 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
 					  sizeof(*entry), trace_ctx);

^ permalink raw reply	[flat|nested] 5+ messages in thread
* [GIT PULL] tracing: Fixes for v7.2
@ 2026-08-13 21:54 Steven Rostedt
  2026-08-13 23:13 ` Linus Torvalds
  2026-08-14  2:12 ` pr-tracker-bot
  0 siblings, 2 replies; 5+ messages in thread
From: Steven Rostedt @ 2026-08-13 21:54 UTC (permalink / raw)
  To: Linus Torvalds
  Cc: LKML, Masami Hiramatsu, Mathieu Desnoyers, Andrew Morton, Hui Su,
	Michael Wu


[
  My ISP *finally* supports DKIM! So hopefully I will not end up in your
  spam folder again.
]

Linus,

tracing fixes for v7.2:

- Fix NULL pointer dereference when matching unloaded module wildcard event

  The set_event can take events for modules that have not been loaded
  yet. This is done by writing '<event>:mod:<module>'.

  If '<event>' is not added, then it means to add all events in <module>.
  This wildcard is represented by a NULL pointer. If one were to try to
  remove the same module item with a named event it would cause a NULL
  pointer dereference when comparing the NULL with the name in strcmp().

  echo ':mod:kvm' > /sys/kernel/tracing/set_event
  echo '!kvm_ack_irq:mod:kvm' >> /sys/kernel/tracing/set_event

  The above will do a strcmp("kvm_ack_irq", NULL) and crash the kernel.

  Test for NULL (wildcard) before doing the strcmp().

- Fix event data field race in loading two modules at the same time

  When a module loads, its trace events get registered. The fields
  of the events are also dynamically created and added to the events
  fields list. It also will call a function that will look at all the
  events for updates that need to be done. If two modules load at the
  same time, the one that scans all events and their fields may read
  the one being added as the scan doesn't take the event_mutex.
  This may cause a data race.

  Have the scan take the event_mutex to prevent the race.

  [
     Note, the scan should only look at the module being loaded.
     I'm working on a patch to fix that for the next merge window.
  ]

Please pull the latest trace-v7.2-rc7 tree, which can be found at:


  git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v7.2-rc7

Tag SHA1: ff59d39a1c59ea1eb204d56ec72f30c72059f303
Head SHA1: c3730b8373bb5059d735509b9e6a00d7eb337d7c


Hui Su (1):
      tracing: Fix NULL pointer dereference in module event cache removal

Michael Wu (1):
      tracing: Fix race between update_event_fields and, event_define_fields

----
 kernel/trace/trace_events.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
---------------------------
diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index c01b10b99f67..3650d84d4f16 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -945,7 +945,7 @@ static int remove_cache_mod(struct trace_array *tr, const char *mod,
 		if (strcmp(event_mod->module, mod) != 0)
 			continue;
 
-		if (match && strcmp(event_mod->match, match) != 0)
+		if (match && (!event_mod->match || strcmp(event_mod->match, match) != 0))
 			continue;
 
 		if (system &&
@@ -3566,6 +3566,7 @@ void trace_event_update_all(struct trace_eval_map **map, int len)
 	int last_i;
 	int i;
 
+	mutex_lock(&event_mutex);
 	down_write(&trace_event_sem);
 	list_for_each_entry_safe(call, p, &ftrace_events, list) {
 		/* events are usually grouped together with systems */
@@ -3604,6 +3605,7 @@ void trace_event_update_all(struct trace_eval_map **map, int len)
 		cond_resched();
 	}
 	up_write(&trace_event_sem);
+	mutex_unlock(&event_mutex);
 }
 
 static bool event_in_systems(struct trace_event_call *call,

^ permalink raw reply	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-08-14  2:13 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-08-01  0:44 [GIT PULL] tracing: Fixes for v7.2 Steven Rostedt
2026-08-01  4:13 ` pr-tracker-bot
2026-08-13 21:54 Steven Rostedt
2026-08-13 23:13 ` Linus Torvalds
2026-08-14  2:12 ` pr-tracker-bot

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®