[PATCH v2 0/2] tracing: Fix buffer_meta open paths

[PATCH v2 0/2] tracing: Fix buffer_meta open paths

[David Carlier]

Two fixes for per_cpu/cpuN/buffer_meta open. The first drops the
trace_array reference under trace_types_lock on the error path. The
second fails the open for CPUs that never came online, which would
otherwise dereference a NULL cpu_buffer on read. With the second patch,
that error path becomes reachable in practice.

Changes since v1:
- Add patch 2 for the NULL dereference Sashiko reported on v1.

v1: https://lore.kernel.org/all/20260913133829.15307-1-devnexen@gmail.com/

David Carlier (2):
  tracing: Take trace_types_lock when dropping the buffer_meta reference
  ring-buffer: Do not show buffer_meta for CPUs without a buffer

 kernel/trace/ring_buffer.c | 3 +++
 kernel/trace/trace.c       | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

-- 
2.55.0

[PATCH v2 1/2] tracing: Take trace_types_lock when dropping the buffer_meta reference

[David Carlier]

tracing_buffer_meta_open() drops the trace_array reference with
__trace_array_put() when ring_buffer_meta_seq_init() fails, without
holding trace_types_lock. Use trace_array_put() like every other open
error path.

Fixes: 950032ffcee7 ("ring-buffer: Add output of ring buffer meta page")
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 kernel/trace/trace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 8658cad53cb5..c8295324ffaa 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -5881,7 +5881,7 @@ static int tracing_buffer_meta_open(struct inode *inode, struct file *filp)
 
 	ret = ring_buffer_meta_seq_init(filp, tr->array_buffer.buffer, cpu);
 	if (ret < 0)
-		__trace_array_put(tr);
+		trace_array_put(tr);
 	return ret;
 }
 
-- 
2.55.0

[PATCH v2 2/2] ring-buffer: Do not show buffer_meta for CPUs without a buffer

[David Carlier]

The per_cpu/cpuN/buffer_meta files are created for every possible CPU,
but buffer->buffers[cpu] is only allocated once that CPU comes online.
Reading the file of a CPU that never came online dereferences a NULL
cpu_buffer in rbm_start().

Fail the open with -ENODEV when the CPU has no buffer, as the other
per CPU ring buffer interfaces do.

Cc: stable@vger.kernel.org
Fixes: 950032ffcee7 ("ring-buffer: Add output of ring buffer meta page")
Reported-by: Sashiko <sashiko-bot@kernel.org>
Closes: https://lore.kernel.org/all/20260913134906.6E8A01F000FF@smtp.kernel.org/
Signed-off-by: David Carlier <devnexen@gmail.com>
---
 kernel/trace/ring_buffer.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 9c03a555a6ba..8833d04b9fee 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -2381,6 +2381,9 @@ int ring_buffer_meta_seq_init(struct file *file, struct trace_buffer *buffer, in
 	struct seq_file *m;
 	int ret;
 
+	if (!cpumask_test_cpu(cpu, buffer->cpumask))
+		return -ENODEV;
+
 	ret = seq_open(file, &rb_meta_seq_ops);
 	if (ret)
 		return ret;
-- 
2.55.0