On Wed, Aug 05, 2026 at 04:32:24PM +0100, Vincent Donnefort wrote:
> Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
> allow it when risizing is disabled. A non-consuming reader is at risk of
> use-after-free (rb_advance_iter()).
>
> Return -EBUSY on resize_disabled, matching ring_buffer_resize()
> behaviour.
>
> Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
> Reported-by: [email protected]
> Signed-off-by: Vincent Donnefort <[email protected]>
>
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 8e2485bb3aa8..414bca2121a7 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -7358,7 +7358,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer
> *buffer, int order)
>
> cpu_buffer = buffer->buffers[cpu];
>
> - if (cpu_buffer->mapped) {
> + if (atomic_read(&cpu_buffer->resize_disabled)) {
Ha, my bad I forgot that mapped is not just "user-space mapped" but also
"range-mapped".
However probably the best is just to record_disable range mapped buffers in
rb_allocate_cpu_buffer()... especially ring_buffer_resize() doesn't use
cpu_buffer->mapped
> err = -EBUSY;
> goto error;
> }
>
> base-commit: 075b74841bd0065a3bda3440873c747938e69b68
> --
> 2.55.0.571.g244d577d93-goog
>
--
Vincent
