On Mon, Aug 17, 2026 at 7:37 PM Deepanshu Kartikey <[email protected]> wrote: > > Writing to buffer_subbuf_size_kb calls ring_buffer_subbuf_order_set(), > which frees every sub-buffer of the ring buffer, including the reader > page, and replaces them with newly allocated ones. > > Readers of trace_pipe hold pointers into those pages. ring_buffer_peek() > looks up an event under cpu_buffer->reader_lock but returns the event > pointer after dropping the lock, and peek_next_entry() then calls > ring_buffer_event_length() and ring_buffer_event_data() on it. If the > sub-buffer order is changed in that window, the reader dereferences > freed memory: > > BUG: KASAN: use-after-free in ring_buffer_peek+0x3e0/0x430 > Read of size 1 at addr ffff88802a4cf010 by task syz-executor989/6002 > > Freed by: > free_buffer_page kernel/trace/ring_buffer.c:398 [inline] > ring_buffer_subbuf_order_set+0x1325/0x18e0 kernel/trace/ring_buffer.c:7444 > buffer_subbuf_size_write+0x182/0x280 kernel/trace/trace.c:8221 > > Take trace_access_lock(RING_BUFFER_ALL_CPUS) around the order change. > This is the lock trace_pipe readers already hold across their entire > peek-and-print loop, so the swap can no longer race with a reader that > is dereferencing a peeked event. > > Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page") > Reported-by: [email protected] > Closes: https://syzkaller.appspot.com/bug?extid=685955db58555575fdd2 > Tested-by: [email protected] > Signed-off-by: Deepanshu Kartikey <[email protected]> > --- > kernel/trace/trace.c | 3 +++ > 1 file changed, 3 insertions(+) > > diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c > index 395238b2b715..c38a5de602e0 100644 > --- a/kernel/trace/trace.c > +++ b/kernel/trace/trace.c > @@ -8214,6 +8214,8 @@ buffer_subbuf_size_write(struct file *filp, const char > __user *ubuf, > /* Do not allow tracing while changing the order of the ring buffer */ > tracing_stop_tr(tr); > > + trace_access_lock(RING_BUFFER_ALL_CPUS); > + > old_order = ring_buffer_subbuf_order_get(tr->array_buffer.buffer); > if (old_order == order) > goto out; > @@ -8253,6 +8255,7 @@ buffer_subbuf_size_write(struct file *filp, const char > __user *ubuf, > #endif > (*ppos)++; > out: > + trace_access_unlock(RING_BUFFER_ALL_CPUS); > if (ret) > cnt = ret; > tracing_start_tr(tr); > -- > 2.43.0 >
Gentle Reminder. Please let me know the status of this patch Thanks Deepanshu
