Sandro/linux
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-09-18 22:09:30 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

ring-buffer: Check resize_disabled before publishing the new subbuf order

Browse Source 
ring_buffer_subbuf_order_set() stores the new order and only then walks
the CPUs, returning -EBUSY if any of them has resizing disabled. A user
mapped buffer has resizing disabled, and __rb_map_vma() reads
buffer->subbuf_order without buffer->mutex, so an mmap of an already
mapped CPU racing the failing order change sizes the mapping with the
new order and inserts pages past the sub-buffer into the VMA.

Check the CPUs before storing the new order.

Cc: stable@vger.kernel.org
Fixes: 117c39200d ("ring-buffer: Introducing ring-buffer mapping functions")
Link: https://patch.msgid.link/20260912103938.1127021-1-devnexen@gmail.com
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
This commit is contained in:
David Carlier
2026-09-13 13:06:43 -04:00
committed by Steven Rostedt
parent d059d8bf2c
commit d860c67c05
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
kernel/trace/ring_buffer.c
+8
View File
@@ -7473,6 +7473,14 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
old_capacity = rb_subbuf_capacity(buffer);
/* The mmap fast path reads subbuf_order without buffer->mutex. */
for_each_buffer_cpu(buffer, cpu) {
if (!cpumask_test_cpu(cpu, buffer->cpumask))
continue;
if (atomic_read(&buffer->buffers[cpu]->resize_disabled))
return -EBUSY;
}
atomic_inc(&buffer->record_disabled);
/* Make sure all commits have finished */