Re: [PATCH] tracing: Take trace_types_lock when dropping the buffer_meta reference
From: sashiko-bot@kernel.org
Date: 2026-09-13 13:49:06
Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider: Pre-existing issues: - [High] Reading a per-CPU buffer_meta file for an offline or unallocated CPU causes a NULL pointer dereference. -- commit f8d13605bef286fcf84c808917e1ab8eeeade189 Author: David Carlier [off-list ref] tracing: Take trace_types_lock when dropping the buffer_meta reference This commit fixes the error path in tracing_buffer_meta_open() by using trace_array_put() instead of __trace_array_put(). This ensures the trace_types_lock is properly held when dropping the trace array reference if ring_buffer_meta_seq_init() fails.
quoted hunk ↗ jump to hunk
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c --- a/kernel/trace/trace.c +++ b/kernel/trace/trace.c@@ -5881,7 +5881,7 @@ static int tracing_buffer_meta_open(struct inode *inode, struct file *filp) ret = ring_buffer_meta_seq_init(filp, tr->array_buffer.buffer, cpu);
[Severity: High]
This is a pre-existing issue, but reading a per-CPU buffer_meta file for an
offline or unallocated CPU causes a NULL pointer dereference.
A user with privileges to read tracefs can open and read
/sys/kernel/tracing/per_cpu/cpuX/buffer_meta where cpuX is a CPU that has
never been online. This invokes tracing_buffer_meta_open(), which blindly
initializes the seq_file via ring_buffer_meta_seq_init():
kernel/trace/ring_buffer.c:ring_buffer_meta_seq_init() {
...
m = file->private_data;
m->private = buffer->buffers[cpu];
...
}
Because alloc_buffer() only dynamically allocates cpu_buffer structs for
currently online CPUs via CPU hotplug callbacks, this pointer is NULL for
unallocated CPUs. The subsequent read invokes rbm_start(), which immediately
dereferences the NULL pointer:
kernel/trace/ring_buffer.c:rbm_start() {
struct ring_buffer_cpu_meta *meta = cpu_buffer->ring_meta;
...
}
Should there be NULL validation for buffer->buffers[cpu] before allowing
the file to be successfully opened, or perhaps a check inside rbm_start()
to handle it gracefully?
quoted hunk ↗ jump to hunk
if (ret < 0) - __trace_array_put(tr); + trace_array_put(tr); return ret; }
-- Sashiko AI review · https://sashiko.dev/#/patchset/20260913133829.15307-1-devnexen@gmail.com?part=1