On Tue, Aug 25, 2026 at 01:20:37AM -0400, Ivan Immanuel Shaji via B4 Relay wrote: > From: Ivan Immanuel Shaji <[email protected]> > > simple_ring_buffer_swap_reader_page() starts with retry set to 8 and > post-decrements it only after a failed link replacement. On the final > attempt, a successful replacement leaves retry at zero, while a failed > replacement leaves it at -1. > > The current !retry test reverses both outcomes. It returns an error after > a successful final replacement, leaving the link update complete but the > reader bookkeeping unfinished. After a failed final replacement, it > falls through and updates the head and reader pointers as though the > replacement succeeded, which can corrupt the ring. > > Treat only a negative counter as exhaustion and return the documented > -EBUSY error. > > Fixes: 34e5b958bdad ("tracing: Introduce simple_ring_buffer") > Cc: [email protected] > Assisted-by: LLM sparse > Signed-off-by: Ivan Immanuel Shaji <[email protected]>
Reviewed-by: Vincent Donnefort <[email protected]> > --- > kernel/trace/simple_ring_buffer.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/kernel/trace/simple_ring_buffer.c > b/kernel/trace/simple_ring_buffer.c > index f4642f5adda3..49913bb0057a 100644 > --- a/kernel/trace/simple_ring_buffer.c > +++ b/kernel/trace/simple_ring_buffer.c > @@ -160,8 +160,8 @@ int simple_ring_buffer_swap_reader_page(struct > simple_rb_per_cpu *cpu_buffer) > overrun = cpu_buffer->meta->overrun; > } while (!simple_bpage_unset_head_link(last, reader, > SIMPLE_RB_LINK_NORMAL) && retry--); > > - if (!retry) > - return -EINVAL; > + if (retry < 0) > + return -EBUSY; > > cpu_buffer->head_page = simple_bpage_from_link(reader->link.next); > cpu_buffer->head_page->link.prev = &reader->link; > > -- > 2.53.0 > >
