A CPU coming online during ring_buffer_subbuf_order_set() can be added
to buffer->cpumask after the allocation loop, and the install loop then
uses its empty new_pages list, corrupting the buffer.
Take cpus_read_lock() as ring_buffer_resize() does.
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Cc: [email protected]
Signed-off-by: David Carlier <[email protected]>
---
kernel/trace/ring_buffer.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 04bb94c29f58..445931bc9ae0 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7464,6 +7464,12 @@ int ring_buffer_subbuf_order_set(struct trace_buffer
*buffer, int order)
if (psize > RB_WRITE_MASK + 1)
return -EINVAL;
+ /*
+ * Keep CPUs from coming online while changing the order to
+ * synchronize with new per CPU buffers being created.
+ */
+ guard(cpus_read_lock)();
+
/* prevent another thread from changing buffer sizes */
guard(mutex)(&buffer->mutex);
--
2.55.0
