]> git.hungrycats.org Git - linux/commit
tracing: Fix subbuf resize races with trace_pipe_raw readers
authorVincent Donnefort <vdonnefort@google.com>
Fri, 4 Sep 2026 16:44:48 +0000 (17:44 +0100)
committerSteven Rostedt <rostedt@goodmis.org>
Fri, 4 Sep 2026 20:19:07 +0000 (16:19 -0400)
commitdae8dda341d2d9034a90d59e8a7d502e1263813f
tree1a099a92002abc515ef931b9b88baa2239f9cfdf
parentd7dbdd2ee01e12211046d4a535623ac732b749fb
tracing: Fix subbuf resize races with trace_pipe_raw readers

Concurrent subbuffer resizes may crash trace_pipe_raw readers or leak
uninitialized memory to userspace due to stale size values.

Modify ring_buffer_alloc_read_page() to handle the resizing of an
existing buffer_data_read_page if necessary and add a new
ring_buffer_read_page_size(). This new function enables ring-buffer
buffer_data_read_page users to not call the racy
ring_buffer_subbuf_size_get(). This makes the spare_size member of
ftrace_buffer_info redundant.

Finally, handle buffer_data_read_page/reader_page order discrepancy in
ring_buffer_read_page(). On a mismatch simply copy manually the data to
the buffer_data_read_page.

Link: https://lore.kernel.org/all/20260817140812.2C7D41F00A3A@smtp.kernel.org/
Link: https://patch.msgid.link/20260904164450.1345852-3-vdonnefort@google.com
Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
include/linux/ring_buffer.h
kernel/trace/ring_buffer.c
kernel/trace/ring_buffer_benchmark.c
kernel/trace/trace.c
kernel/trace/trace.h