From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f70.google.com (mail-wm1-f70.google.com [209.85.128.70]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 3177A47CA9E for ; Thu, 13 Aug 2026 13:12:01 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.70 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786626727; cv=none; b=nnPTPuSjmNjhxr+Jmhp/fHti4L/2WXsMIJKNw3PEm83aB9ztW+oqK94dG4yD1GZRjWazfi53fBXXBzJ23SmtTEidesjZAvy8X0/b6nmCElsrqSuPJRJDtaasRcW8Fft5bfqn+HkxLom9FKTjC1y5A423oICUDjq14sMjvjPmf9Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786626727; c=relaxed/simple; bh=lKMK0MfkDIfSeWvC4wCnKzYYxJQHB+XsLd1+t3UjMIw=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=Tfo24W2gbrC5lWYogTs+8SfY91vGhQ5qa2+dYBQYJu3Rfb6DpUnpf9dHkkksm5w25g0v5dTo9Hi+GDFGyPfMUigynQbX1k+EPza6P7yDA7kkPKf57rIcQsyszUkqlQSLn4iyN52v6LtorQKWEwwfsBMtlmzoHtyqAnzlAXA6zJs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--vdonnefort.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=nBe93dNL; arc=none smtp.client-ip=209.85.128.70 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--vdonnefort.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="nBe93dNL" Received: by mail-wm1-f70.google.com with SMTP id 5b1f17b1804b1-4957287363bso5142155e9.0 for ; Thu, 13 Aug 2026 06:12:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1786626719; x=1787231519; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=lGl2apXV5AfDfhGS4nKvuLOa4mDzXiM6MBzztIw4crA=; b=nBe93dNLmKC4MkCYH0jzf1JNJHc21nuXJdDAfvP6O+Q0BmulnyidLdq4qXk2ofcGja xuWTJKYEiiFgp0pmBNQm96rbiKIJjW2MJvhLyUVlMr8x/fSi3uIVI4x9nee7u5aQFEEv JVOAuV/aiD6uq4vQChgjNVWOtTsrxtZqkHRkYrBei3CX/0VxuPqsgQdL0YpTf67n5MZW H41OAOWk4NIaf1yN0t1GrntxFMjV3RtAht9In3LU5Cku3mkk4SBpR+9Tv6aXissZofek WAhFL6E8jJK6En7GxqNvIb9gFtsLVCHLgNvTDiY243lwwY78Fly7U0c1nqgbnX6SNIdV ElYQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786626719; x=1787231519; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=lGl2apXV5AfDfhGS4nKvuLOa4mDzXiM6MBzztIw4crA=; b=mvBpgOJgp/Q6wdxOTPzQYSjGeHgzJOvhibZ5sLiQlESkPEYUB8x+w812NQ6wpq+/9x jcRjILMqttojQloIYTvo1BSPdmMZ5mqDpkajoZnkivTClNRkeG0m3RPEln/U6XM/qU9T Kk8ETWLU+pI4bE3RFjw945psn11eGU6xzLgVNNH9OGjXKL7tMyBm5T4oddJOc1coyn0W RdjUzBa0dPy8A0V6LNKZ+IYl5G1CDBniFBE/2+j961IPoOC9r7pfzztEScg2vUkgcma4 L87eyczNHOzRSLFHVi8J69EMUmLEq0J1CUiKRF4NpMf/OtgUM4Nr/5UmfdTkNlM2ROW0 v30A== X-Forwarded-Encrypted: i=1; AHgh+Rrpd7zRFaMbrupDcdIWTNF3/cqVOS5DfV7wt26wYEpaJVpM+6FQds9LxK/3oK+kWasV8+f5lD5UulnjLsw=@vger.kernel.org X-Gm-Message-State: AOJu0YyqMVC+wQpU+X7jEoAH1SP9RO9VN3tv4YMEH0PFF9ktsQHsvaT1 7PNTaWZJ+WsvRc6EZ6eDkU6/4BVvEoduWrBz0MqV3nMfIMJ8id9zFgFtpEY+vhFWRVvBASh8cSZ NqrdUIZcG6E2OhmP8Nj86hg== X-Received: from wmbje11.prod.google.com ([2002:a05:600c:1f8b:b0:495:779a:eb54]) (user=vdonnefort job=prod-delivery.src-stubby-dispatcher) by 2002:a05:600c:470d:b0:499:484a:81d0 with SMTP id 5b1f17b1804b1-499821f1ebbmr58742035e9.9.1786626718832; Thu, 13 Aug 2026 06:11:58 -0700 (PDT) Date: Thu, 13 Aug 2026 14:11:45 +0100 In-Reply-To: <20260813131152.3589632-1-vdonnefort@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260813131152.3589632-1-vdonnefort@google.com> X-Mailer: git-send-email 2.55.0.691.gc56d675ccc-goog Message-ID: <20260813131152.3589632-4-vdonnefort@google.com> Subject: [PATCH v5 03/10] ring-buffer: Make cpu_buffer::free_page a buffer_data_read_page From: Vincent Donnefort To: rostedt@goodmis.org, mhiramat@kernel.org, linux-trace-kernel@vger.kernel.org Cc: mathieu.desnoyers@efficios.com, kernel-team@android.com, linux-kernel@vger.kernel.org, Vincent Donnefort Content-Type: text/plain; charset="UTF-8" Discarding a cached reader page after a concurrent ring buffer resize uses the new global subbuf_order for the free_pages() call. This mismatched order may crashes the kernel or leaks memory because the cached page was allocated under the old size. Save the actual free_page order alongside the page address to ensure we always refer to the correct value and do not rely on the potentially stalled cpu_buffer->subbuf_order value. The simplest is to make free_page a buffer_data_read_page which already covers exactly what we need: a page address and a page order. Fixes: 8e7b58c27b3c ("ring-buffer: Just update the subbuffers when changing their allocation order") Signed-off-by: Vincent Donnefort diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index ec4f5a0c93e8..b6fa258aafe2 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -507,7 +507,7 @@ struct ring_buffer_per_cpu { raw_spinlock_t reader_lock; /* serialize readers */ arch_spinlock_t lock; struct lock_class_key lock_key; - struct buffer_data_page *free_page; + struct buffer_data_read_page free_page; unsigned long nr_pages; unsigned int current_context; struct list_head *pages; @@ -2631,7 +2631,7 @@ static void rb_free_cpu_buffer(struct ring_buffer_per_cpu *cpu_buffer) free_buffer_page(bpage); } - free_pages((unsigned long)cpu_buffer->free_page, cpu_buffer->buffer->subbuf_order); + free_pages((unsigned long)cpu_buffer->free_page.data, cpu_buffer->free_page.order); kfree(cpu_buffer); } @@ -6962,9 +6962,9 @@ ring_buffer_alloc_read_page(struct trace_buffer *buffer, int cpu) local_irq_save(flags); arch_spin_lock(&cpu_buffer->lock); - if (cpu_buffer->free_page) { - bpage->data = cpu_buffer->free_page; - cpu_buffer->free_page = NULL; + if (cpu_buffer->free_page.data) { + *bpage = cpu_buffer->free_page; + cpu_buffer->free_page.data = NULL; } arch_spin_unlock(&cpu_buffer->lock); @@ -7016,8 +7016,8 @@ void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, local_irq_save(flags); arch_spin_lock(&cpu_buffer->lock); - if (!cpu_buffer->free_page) { - cpu_buffer->free_page = dpage; + if (!cpu_buffer->free_page.data) { + cpu_buffer->free_page = *data_page; dpage = NULL; } @@ -7390,7 +7390,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order) } for_each_buffer_cpu(buffer, cpu) { - struct buffer_data_page *old_free_data_page; + struct buffer_data_read_page old_free_data_page; struct list_head old_pages; unsigned long flags; @@ -7433,7 +7433,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order) arch_spin_lock(&cpu_buffer->lock); old_free_data_page = cpu_buffer->free_page; - cpu_buffer->free_page = NULL; + cpu_buffer->free_page.data = NULL; arch_spin_unlock(&cpu_buffer->lock); rb_head_page_activate(cpu_buffer); @@ -7445,7 +7445,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order) list_del_init(&bpage->list); free_buffer_page(bpage); } - free_pages((unsigned long)old_free_data_page, old_order); + free_pages((unsigned long)old_free_data_page.data, old_free_data_page.order); rb_check_pages(cpu_buffer); } -- 2.55.0.691.gc56d675ccc-goog