ring-buffer: Take cpus_read_lock() when changing the subbuf order

A CPU coming online for the first time gets its per CPU buffer allocated
by trace_rb_cpu_prepare(), which then adds it to buffer->cpumask. If that
happens while ring_buffer_subbuf_order_set() is running, the CPU shows up
after the allocation loop and the install loop walks it with an empty
new_pages list, corrupting the buffer.

Take cpus_read_lock() as ring_buffer_resize() does.

Cc: stable@vger.kernel.org
Fixes: f9b94daa54 ("ring-buffer: Set new size of the ring buffer sub page")
Link: https://patch.msgid.link/20260916192628.274136-1-devnexen@gmail.com
Signed-off-by: David Carlier <devnexen@gmail.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
This commit is contained in:
David Carlier 2026-09-16 20:26:28 +01:00 committed by Steven Rostedt
parent 9dce3e2d1f
commit 453d0f47b1

View File

@ -7464,6 +7464,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
if (psize > RB_WRITE_MASK + 1)
return -EINVAL;
guard(cpus_read_lock)();
/* prevent another thread from changing buffer sizes */
guard(mutex)(&buffer->mutex);