pstore: publish big_oops_buf after max_compressed_size

allocate_buf_for_compression() stores big_oops_buf and then
max_compressed_size, both with plain stores. pstore_dump() runs from
kmsg_dump on any CPU, tests big_oops_buf without psinfo_lock and then
reads max_compressed_size.

Store the size first and publish the buffer with smp_store_release(),
paired with smp_load_acquire() in pstore_dump().

Found with MBCheck, a static herd7-based memory consistency checker.

Signed-off-by: Jaidev Shastri <jaidevshastri@vt.edu>
Link: https://patch.msgid.link/20260921-mb-pstore-v1-1-46f9a6129d58@vt.edu
Signed-off-by: Kees Cook <kees@kernel.org>
This commit is contained in:
Jaidev Shastri 2026-09-21 21:16:54 -04:00 committed by Kees Cook
parent 1b30df8662
commit 7c75618117

View File

@ -240,9 +240,14 @@ static void allocate_buf_for_compression(void)
return;
}
/* A non-NULL big_oops_buf indicates compression is available. */
big_oops_buf = buf;
max_compressed_size = compressed_size;
/*
* A non-NULL big_oops_buf indicates compression is available.
* pstore_dump() tests it without psinfo_lock and then reads
* max_compressed_size, which is stored above. Publish the buffer
* with release semantics.
*/
smp_store_release(&big_oops_buf, buf);
pr_info("Using crash dump compression: %s\n", compress);
}
@ -316,7 +321,8 @@ static void pstore_dump(struct kmsg_dumper *dumper,
record.part = part;
record.buf = psinfo->buf;
dst = big_oops_buf ?: psinfo->buf;
/* Pairs with the smp_store_release() in allocate_buf_for_compression(). */
dst = smp_load_acquire(&big_oops_buf) ?: psinfo->buf;
dst_size = max_compressed_size ?: psinfo->bufsize;
/* Write dump header. */