* [PATCH 5.10] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
@ 2026-09-02 12:28 Alexander Martyniuk
2026-09-04 2:52 ` Sasha Levin
0 siblings, 1 reply; 6+ messages in thread
From: Alexander Martyniuk @ 2026-09-02 12:28 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman
Cc: Alexander Martyniuk, lvc-project, Steven Rostedt, Ingo Molnar,
Karol Herbst, Pekka Paalanen, Thomas Gleixner, linux-kernel,
nouveau, Masami Hiramatsu
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
commit 12b80cdbc54cf615b4717a4e8180063408091ea2 upstream.
mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into
tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map().
If these functions are invoked while mmio_trace_array is NULL (e.g. before
initialization or after disabled), accessing tr->array_buffer.buffer will
result in a NULL pointer dereference crash.
Fix this by adding an explicit NULL check for tr at the beginning of
__trace_mmiotrace_rw() and __trace_mmiotrace_map().
Link: https://patch.msgid.link/178524300062.56416.8362487250709962380.stgit@devnote2
Fixes: f984b51e0779 ("ftrace: add mmiotrace plugin")
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
---
Backport fix for CVE-2026-80689
kernel/trace/trace_mmiotrace.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
index e8ae2d92a678..da63add45faa 100644
--- a/kernel/trace/trace_mmiotrace.c
+++ b/kernel/trace/trace_mmiotrace.c
@@ -298,11 +298,15 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
struct mmiotrace_rw *rw)
{
struct trace_event_call *call = &event_mmiotrace_rw;
- struct trace_buffer *buffer = tr->array_buffer.buffer;
+ struct trace_buffer *buffer;
struct ring_buffer_event *event;
struct trace_mmiotrace_rw *entry;
int pc = preempt_count();
+ if (!tr)
+ return;
+
+ buffer = tr->array_buffer.buffer;
event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
sizeof(*entry), 0, pc);
if (!event) {
@@ -328,11 +332,15 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
struct mmiotrace_map *map)
{
struct trace_event_call *call = &event_mmiotrace_map;
- struct trace_buffer *buffer = tr->array_buffer.buffer;
+ struct trace_buffer *buffer;
struct ring_buffer_event *event;
struct trace_mmiotrace_map *entry;
int pc = preempt_count();
+ if (!tr)
+ return;
+
+ buffer = tr->array_buffer.buffer;
event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
sizeof(*entry), 0, pc);
if (!event) {
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH 5.10] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
2026-09-02 12:28 [PATCH 5.10] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Alexander Martyniuk
@ 2026-09-04 2:52 ` Sasha Levin
2026-09-07 15:07 ` [PATCH v2 5.10 0/2] " Alexander Martyniuk
0 siblings, 1 reply; 6+ messages in thread
From: Sasha Levin @ 2026-09-04 2:52 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman
Cc: Sasha Levin, Alexander Martyniuk, lvc-project, Steven Rostedt,
Ingo Molnar, Karol Herbst, Pekka Paalanen, Thomas Gleixner,
linux-kernel, nouveau, Masami Hiramatsu
> Fix this by adding an explicit NULL check for tr at the beginning of
> __trace_mmiotrace_rw() and __trace_mmiotrace_map().
The callers mmio_trace_rw() and mmio_trace_mapping() still dereference
tr->array_buffer.data via per_cpu_ptr() before reaching the functions this
patch guards, so the new checks never run for the NULL case they target.
Mainline is only safe because of the later commit 6936298393d8
("tracing/mmiotrace: Remove reference to unused per CPU data pointer").
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 5.10 0/2] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
2026-09-04 2:52 ` Sasha Levin
@ 2026-09-07 15:07 ` Alexander Martyniuk
2026-09-07 15:07 ` [PATCH v2 5.10 1/2] tracing/mmiotrace: Remove reference to unused per CPU data pointer Alexander Martyniuk
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Alexander Martyniuk @ 2026-09-07 15:07 UTC (permalink / raw)
To: sashal, stable, Greg Kroah-Hartman
Cc: alexevgmart, karolherbst, linux-kernel, lvc-project, mhiramat,
mingo, nouveau, ppaalanen, rostedt, tglx
Backport fix for CVE-2026-80689.
Masami Hiramatsu (Google) (1):
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
functions
Steven Rostedt (1):
tracing/mmiotrace: Remove reference to unused per CPU data pointer
kernel/trace/trace_mmiotrace.c | 24 ++++++++++++------------
1 file changed, 12 insertions(+), 12 deletions(-)
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 5.10 1/2] tracing/mmiotrace: Remove reference to unused per CPU data pointer
2026-09-07 15:07 ` [PATCH v2 5.10 0/2] " Alexander Martyniuk
@ 2026-09-07 15:07 ` Alexander Martyniuk
2026-09-07 15:07 ` [PATCH v2 5.10 2/2] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Alexander Martyniuk
2026-09-08 0:53 ` [PATCH v2 5.10 0/2] " Sasha Levin
2 siblings, 0 replies; 6+ messages in thread
From: Alexander Martyniuk @ 2026-09-07 15:07 UTC (permalink / raw)
To: sashal, stable, Greg Kroah-Hartman
Cc: alexevgmart, karolherbst, linux-kernel, lvc-project, mhiramat,
mingo, nouveau, ppaalanen, rostedt, tglx, Mark Rutland,
Mathieu Desnoyers, Andrew Morton
From: Steven Rostedt <rostedt@goodmis.org>
commit 6936298393d8d8bc3cec6b704f6a774162cf9bd3 upstream.
The mmiotracer referenced the per CPU array_buffer->data descriptor but
never actually used it. Remove the references to it.
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Link: https://lore.kernel.org/20250505212234.696945463@goodmis.org
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
---
Backport fix for CVE-2026-80689
kernel/trace/trace_mmiotrace.c | 12 ++----------
1 file changed, 2 insertions(+), 10 deletions(-)
diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
index e8ae2d92a678..55ba76bea98b 100644
--- a/kernel/trace/trace_mmiotrace.c
+++ b/kernel/trace/trace_mmiotrace.c
@@ -294,7 +294,6 @@ __init static int init_mmio_trace(void)
device_initcall(init_mmio_trace);
static void __trace_mmiotrace_rw(struct trace_array *tr,
- struct trace_array_cpu *data,
struct mmiotrace_rw *rw)
{
struct trace_event_call *call = &event_mmiotrace_rw;
@@ -319,12 +318,10 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
void mmio_trace_rw(struct mmiotrace_rw *rw)
{
struct trace_array *tr = mmio_trace_array;
- struct trace_array_cpu *data = per_cpu_ptr(tr->array_buffer.data, smp_processor_id());
- __trace_mmiotrace_rw(tr, data, rw);
+ __trace_mmiotrace_rw(tr, rw);
}
static void __trace_mmiotrace_map(struct trace_array *tr,
- struct trace_array_cpu *data,
struct mmiotrace_map *map)
{
struct trace_event_call *call = &event_mmiotrace_map;
@@ -349,12 +346,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
void mmio_trace_mapping(struct mmiotrace_map *map)
{
struct trace_array *tr = mmio_trace_array;
- struct trace_array_cpu *data;
-
- preempt_disable();
- data = per_cpu_ptr(tr->array_buffer.data, smp_processor_id());
- __trace_mmiotrace_map(tr, data, map);
- preempt_enable();
+ __trace_mmiotrace_map(tr, map);
}
int mmio_trace_printk(const char *fmt, va_list args)
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH v2 5.10 2/2] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
2026-09-07 15:07 ` [PATCH v2 5.10 0/2] " Alexander Martyniuk
2026-09-07 15:07 ` [PATCH v2 5.10 1/2] tracing/mmiotrace: Remove reference to unused per CPU data pointer Alexander Martyniuk
@ 2026-09-07 15:07 ` Alexander Martyniuk
2026-09-08 0:53 ` [PATCH v2 5.10 0/2] " Sasha Levin
2 siblings, 0 replies; 6+ messages in thread
From: Alexander Martyniuk @ 2026-09-07 15:07 UTC (permalink / raw)
To: sashal, stable, Greg Kroah-Hartman
Cc: alexevgmart, karolherbst, linux-kernel, lvc-project, mhiramat,
mingo, nouveau, ppaalanen, rostedt, tglx
From: "Masami Hiramatsu (Google)" <mhiramat@kernel.org>
commit 12b80cdbc54cf615b4717a4e8180063408091ea2 upstream.
mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into
tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map().
If these functions are invoked while mmio_trace_array is NULL (e.g. before
initialization or after disabled), accessing tr->array_buffer.buffer will
result in a NULL pointer dereference crash.
Fix this by adding an explicit NULL check for tr at the beginning of
__trace_mmiotrace_rw() and __trace_mmiotrace_map().
Link: https://patch.msgid.link/178524300062.56416.8362487250709962380.stgit@devnote2
Fixes: f984b51e0779 ("ftrace: add mmiotrace plugin")
Assisted-by: Antigravity:gemini-3.6-flash
Signed-off-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Alexander Martyniuk <alexevgmart@gmail.com>
---
Backport fix for CVE-2026-80689
kernel/trace/trace_mmiotrace.c | 12 ++++++++++--
1 file changed, 10 insertions(+), 2 deletions(-)
diff --git a/kernel/trace/trace_mmiotrace.c b/kernel/trace/trace_mmiotrace.c
index 55ba76bea98b..ce45c5ee5227 100644
--- a/kernel/trace/trace_mmiotrace.c
+++ b/kernel/trace/trace_mmiotrace.c
@@ -297,11 +297,15 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
struct mmiotrace_rw *rw)
{
struct trace_event_call *call = &event_mmiotrace_rw;
- struct trace_buffer *buffer = tr->array_buffer.buffer;
+ struct trace_buffer *buffer;
struct ring_buffer_event *event;
struct trace_mmiotrace_rw *entry;
int pc = preempt_count();
+ if (!tr)
+ return;
+
+ buffer = tr->array_buffer.buffer;
event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
sizeof(*entry), 0, pc);
if (!event) {
@@ -325,11 +329,15 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
struct mmiotrace_map *map)
{
struct trace_event_call *call = &event_mmiotrace_map;
- struct trace_buffer *buffer = tr->array_buffer.buffer;
+ struct trace_buffer *buffer;
struct ring_buffer_event *event;
struct trace_mmiotrace_map *entry;
int pc = preempt_count();
+ if (!tr)
+ return;
+
+ buffer = tr->array_buffer.buffer;
event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
sizeof(*entry), 0, pc);
if (!event) {
--
2.43.0
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2 5.10 0/2] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions
2026-09-07 15:07 ` [PATCH v2 5.10 0/2] " Alexander Martyniuk
2026-09-07 15:07 ` [PATCH v2 5.10 1/2] tracing/mmiotrace: Remove reference to unused per CPU data pointer Alexander Martyniuk
2026-09-07 15:07 ` [PATCH v2 5.10 2/2] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Alexander Martyniuk
@ 2026-09-08 0:53 ` Sasha Levin
2 siblings, 0 replies; 6+ messages in thread
From: Sasha Levin @ 2026-09-08 0:53 UTC (permalink / raw)
To: stable, Greg Kroah-Hartman
Cc: Sasha Levin, alexevgmart, karolherbst, linux-kernel, lvc-project,
mhiramat, mingo, nouveau, ppaalanen, rostedt, tglx
> Masami Hiramatsu (Google) (1):
> tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
> functions
>
> Steven Rostedt (1):
> tracing/mmiotrace: Remove reference to unused per CPU data pointer
Queued for 5.10, thanks. Good catch adding the prerequisite.
--
Thanks,
Sasha
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-09-08 0:54 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-02 12:28 [PATCH 5.10] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Alexander Martyniuk
2026-09-04 2:52 ` Sasha Levin
2026-09-07 15:07 ` [PATCH v2 5.10 0/2] " Alexander Martyniuk
2026-09-07 15:07 ` [PATCH v2 5.10 1/2] tracing/mmiotrace: Remove reference to unused per CPU data pointer Alexander Martyniuk
2026-09-07 15:07 ` [PATCH v2 5.10 2/2] tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions Alexander Martyniuk
2026-09-08 0:53 ` [PATCH v2 5.10 0/2] " Sasha Levin
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®