7504 Commits

Author	SHA1	Message	Date
Linus Torvalds	17fa96334e	Arm: ... - Fix a couple of embarrassing merge mistakes in kvmarm-7.4 - Cleanup the HCR_EL2 bit fields to exclusively use the generated definitions, fixings a nasty regression introduced in 6.16, where barriers were not upgraded from NSH to ISH anymore - Fix publication of state when a vcpu is forced out of the guest - Let vcpu pausing nest correctly - Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the architecture - Don't warn on SMCCC filter reserved range allocation failure - Prevent GICv5 and TLBI hypercalls to be used from the host when pKVM is active - Enforce that only GICv3 guests are supported for pKVM - Don't try to access GICv5 EL2 sysregs from EL1 - Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E by checking the feature dependencies - Require matching VGIC and ITS model - Cleanup TRACE_REMOTE dependencies - Fix random comments Arm selftests: - selftests: Skip unwritable ID fields in the failed-run test - Move pkvm_selftests() after all CPUs have initialized EL2 RISC-V: - Allow Zicclsm, Ziccamoa, Ziccif, Za64rs for KVM guest - Implement KVM_PRE_FAULT_MEMORY ioctl() - Replace imsic switch-case macros with range checks RISC-V fixes: - Avoid redundant interrupt check for pending timers - Reject vCPU creation after AIA initialization - Fix build with vector support disabled - Fix IPI delivery for out-of-order vcpu_id - Use a raw lock for IMSIC wakeup state - Reject vCPU creation after AIA initialization RISC-V selftests: - Lazy V-extension enablement for KVM selftests - Show sepc/scause/stval CSRs in KVM selftests vcpu dump -----BEGIN PGP SIGNATURE----- iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmrk4AIUHHBib256aW5p QHJlZGhhdC5jb20ACgkQv/vSX3jHroM1yQf+OHsn+QrPUWBv+DDSPcj3iEBVal2/ 3YyJSUaDn295nymw4vk0mviwOD7ntEhVNCeT94x8CTibtQUs37GyQOBI88tX0XeU TZ4oNVrPZByWGd4MEQNpM25hCt5vEXLY6dydZ4GVF2EJKDJ6tT9VqZwX94DJsLgU HKcSDBSQ6Pzd80bVgwIhzKox2b2U8nrQfhtAKTxetKVWBjPULbCIWYG/PugrP21P 4VikMoWGDovGhqy7ud8kZ3i6feVST1cD8To61BRrmGp04b0knGWrINFyRnh0bFPa muZeineILYSDLDKFSk0A0KBPjnM7KoQnwaNpDzS/Xl+7K8kKnPvDGWVwZg== =Zlk1 -----END PGP SIGNATURE----- Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm Pull more KVM updates from Paolo Bonzini: "ARM64: - Fix a couple of embarrassing merge mistakes in kvmarm-7.4 - Cleanup the HCR_EL2 bit fields to exclusively use the generated definitions, fixings a nasty regression introduced in 6.16, where barriers were not upgraded from NSH to ISH anymore - Fix publication of state when a vcpu is forced out of the guest - Let vcpu pausing nest correctly - Sanitise ID_AA64MMFR3_EL1.S1P[IO]E to follow the rules of the architecture - Don't warn on SMCCC filter reserved range allocation failure - Prevent GICv5 and TLBI hypercalls to be used from the host when pKVM is active - Enforce that only GICv3 guests are supported for pKVM - Don't try to access GICv5 EL2 sysregs from EL1 - Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E by checking the feature dependencies - Require matching VGIC and ITS model - Cleanup TRACE_REMOTE dependencies - Fix random comments ARM64 selftests: - selftests: Skip unwritable ID fields in the failed-run test - Move pkvm_selftests() after all CPUs have initialized EL2 RISC-V: - Allow Zicclsm, Ziccamoa, Ziccif, Za64rs for KVM guest - Implement KVM_PRE_FAULT_MEMORY ioctl() - Replace imsic switch-case macros with range checks RISC-V fixes: - Avoid redundant interrupt check for pending timers - Reject vCPU creation after AIA initialization - Fix build with vector support disabled - Fix IPI delivery for out-of-order vcpu_id - Use a raw lock for IMSIC wakeup state - Reject vCPU creation after AIA initialization RISC-V selftests: - Lazy V-extension enablement for KVM selftests - Show sepc/scause/stval CSRs in KVM selftests vcpu dump" * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (42 commits) KVM: selftests: Reject GICv3 ITS with a GICv5 VGIC KVM: arm64: vgic: Require matching VGIC and ITS models KVM: arm64: gic-v5: Drop unused addr variable KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E KVM: arm64: selftests: Skip unwritable ID fields in the failed-run test tracing/remotes: Fix TRACE_REMOTE build when TRACING=n KVM: arm64: Move pkvm_selftests() after all CPUs have initialized EL2 KVM: arm64: Get rid of compatibility HCR_EL2 aliases KVM: arm64: Convert HCR_xyz to HCR_EL2_xyz KVM: arm64: Set HCR_EL2.BSU to Inner Shareable for guests KVM: arm64: Fix stale VGICv3 comments in the nVHE world switch KVM: arm64: vgic: Do not access the GICv5 CPU interface from EL1 KVM: arm64: Validate the host-provided vgic model in pKVM KVM: arm64: Reject the stage-2 flush hypercalls under pKVM KVM: arm64: Return on kvm_gmem_get_pfn() failure in gmem_abort() KVM: riscv: selftest: add Zicclsm, Ziccamoa, Ziccif, Za64rs RISC-V: KVM: Allow Zicclsm, Ziccamoa, Ziccif, Za64rs in guest MAINTAINERS: name the kvm-riscv/linux riscv_kvm_next branch RISC-V: KVM: Don't write MMIO load result to x0 RISC-V: KVM: Use a raw lock for IMSIC wakeup state ...	2026-10-30 09:48:45 -10:00
Linus Torvalds	0c8bf38058	vfs-7.4-rc1.fixes ... Please consider pulling these changes from the signed vfs-7.4-rc1.fixes tag. Thanks! Christian -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCauTJqQAKCRCRxhvAZXjc okLyAP0bHWHQ8CIbegVzZbMVssaMJl1KiqxfkGbS6Nk/j1StkwEA5+UGbFnQ2qG6 uxDILfnlsd834jlOlOauzaSpbAJgwQk= =uPnP -----END PGP SIGNATURE----- Merge tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs Pull vfs fixes from Christian Brauner: - writeback: - Update dirtied_when instead of dirtied_time_when when a wb switch puts an inode at the newest end of the target b_dirty list. The list was left out of order so move_expired_inodes() could stop before older inodes, and the lazytime expiration timestamp was reset - Clear the old wb's dirty-I/O state and bandwidth contribution when a batch of inode switches leaves its dirty lists empty. An empty wb stayed scheduled for periodic writeback and inflated bdi->tot_write_bandwidth - Take wb_switch_rwsem across the inode scan of cleanup_offline_cgwb(). The v7.3-rc5 fix that rotates scanned inodes let a scan racing a sync()'s queue_io() move lazytime inodes past the sync's cutoff, so sync() returned without persisting their timestamps - Don't kick writeback for an IOCB_DONTCACHE write on an inode that has no wb yet. With cgroup writeback an O_DIRECT RWF_DONTCACHE write to a block device dereferenced NULL - statmount/listmount/listns: - Refuse statmount() string requests with a buffer that isn't larger than struct statmount - Don't wrap around with a U64_MAX cursor in listmount() and listns() - Don't end listns() at an inactive namespace - Only add init_ipc_ns and init_net to the namespace trees if CONFIG_IPC_NS and CONFIG_NET_NS are enabled - iomap: - Only mark blocks uptodate in __iomap_write_begin() after reading them and let __iomap_write_end() mark the zeroed blocks uptodate once the copy from userspace succeeded - Check a chunk against max_integrity_io_size() on its own before the bio size check - Only enforce block alignment for direct I/O into holes and unwritten extents if IOMAP_DIO_FSBLOCK_ALIGNED is set - backing-file: - Check S_APPEND and S_IMMUTABLE on the backing inode. FUSE passthrough opens the backing file with vfs_open() which skips may_open(), so anyone who may open the FUSE file for writing could overwrite an append-only backing file anywhere or write to an immutable one. Open, mmap and writes now check the backing inode the way may_open() and do_mmap() do - Always call kiocb_end_write() for a queued write - Let backing files inherit FMODE_NONOTIFY from the user file. The event fds fanotify creates for permission events on a stacked filesystem raised FS_OPEN_PERM on the real path from inside the listener's read() and deadlocked listeners with marks on both layers - pidfs: - Look the task up before checking for exit information in PIDFD_GET_INFO and start over if the task no longer owns the pid once all fields have been read. A caller racing release_task() got neither PIDFD_INFO_PID nor PIDFD_INFO_EXIT or ESRCH although the exit information was available, and a caller racing a sub-thread's exec reported that thread's tid as the pid - Clear the mask bits of fields that lie beyond the struct size the caller passed. The uapi header promises that the mask names no such field but a caller passing PIDFD_INFO_SIZE_VER0 got the coredump and supported mask bits set for fields that were never written - aio: - Give the aio ring a ->read_folio that fails with EIO so a fault on a ring whose file was truncated gets SIGBUS instead of jumping to NULL - Check nr_events against the ring size before doubling it in ioctx_alloc() - splice: - Only write back an implicit file position in do_splice() when the splice helper succeeded. splice doesn't take f_pos_lock so a failed splice restored a stale snapshot over a position that a concurrent getdents() had moved. On ext2 the next readdir then trusted an offset inside a directory entry - Retry tee() when the input pipe was emptied or the output pipe filled between the prep steps and link_pipe() instead of returning 0 while the input pipe still has writers, as splice_pipe_to_pipe() does - ucount: - Take the reference that pins a ucounts level on the 0 -> 1 transition before checking the rlimit - Read the parent ucounts before dropping the rlimit count in do_dec_rlimit_put_ucounts() - inode: - Rotate inodes whose page cache couldn't be dropped to the tail of the LRU - Skip inodes that another LRU walker is isolating - setns: - Set nsset->flags before anything in prepare_nsset() can fail so the error path drops the cred prepared for CLONE_NEWUSER. A failing setns() with CLONE_NEWUSER and CLONE_NEWNS leaked it together with its user namespace - Refuse setns(CLONE_NEWNS) for a task that shares its fs_struct again when more namespaces are requested - minix: - Restore uptodate on the pinned bitmap buffers before redirtying them after a failed writeback instead of tripping the warning in mark_buffer_dirty(), as ext2 and ext4 do for their superblock buffers - Reject rmdir() of a directory with a corrupted link count with EFSCORRUPTED instead of hitting the drop_nlink() warning - userns: Keep the exec securebits and their locks when creating or joining a user namespace. set_cred_user_ns() reset all securebits to SECUREBITS_DEFAULT so anyone who may create a user namespace could shed SECBIT_EXEC_RESTRICT_FILE and SECBIT_EXEC_DENY_INTERACTIVE with a single unshare(CLONE_NEWUSER) - fs: Honor FOP_UNSIGNED_OFFSET in sys_llseek() and in the pread64(), pwrite64(), preadv() and pwritev() wrappers - proc/kcore: Advance the vmalloc retry in read_kcore_iter() by the last vread_iter() copy instead of the running total - eventpoll: Return the error when the wakeup source for EPOLLWAKEUP can't be created in EPOLL_CTL_MOD instead of reporting success without suspend protection - coredump: Mark do_coredump() noinline_for_stack - nsfs: Check the trailing bytes of a namespace file handle in bytes instead of words - netfs: Restore the per-level and per-point decoding of the debug mask - exportfs: Release the directory file get_name() opened with __fput_sync(). From nfsd's kernel threads the deferred fputs arrived faster than delayed_fput retired them and each pinned the directory's readdir state, growing unreclaimable slab by about 90 MB per second under a parallel tree walk - fs: Call ramfs_kill_sb() for a ramfs rootfs. Since rootfs can be unmounted as of v7.0 its struct ramfs_fs_info was leaked - signal: Check the blocked mask for every entry dequeue_synchronous_signal() looks at. The scan could select a blocked synchronous signal and deliver it while blocked - super: Convert the superblock device table from an rhltable to a plain hashtable under a spinlock. This fixes a bug from v7.3 where fs_bdev_freeze() froze a btrfs filesystem through a stale member that open_ctree() had already released while the freeze was waiting for SB_BORN - fork: Leave rcu_users at zero until copy_process() can't fail anymore. bpf_task_acquire() handed out trusted references to the new task from the task_alloc LSM hook and sched_ext's ops.init_task() and a failing fork freed the task behind them - xattr: Always run cap_convert_nscap() for a security.capability write. A zero-length setxattr() skipped it and let an unprivileged caller without CAP_SETFCAP or write permission on the file plant an empty security.capability xattr that made every execve() of the binary fail with EINVAL - namei: Skip the S_ISDIR assertion in - proc: Refuse to mount on entries below /proc/<pid>/net like fd/, fdinfo/ and map_files/. proc_net_d_revalidate() always fails so the first lookup by anyone with search permission ran d_invalidate() on the dentry and detached every mount on it, locked mounts included - libfs: Hold one mount reference for all pins instead of one per pin. The pin count is what keeps the mount alive, so the per-pin reference only cost a mntget() and a mntput() through mntput_no_expire_slowpath() for every debugfs, tracefs, securityfs or configfs file that comes and goes - iov_iter: Return 0 from iov_iter_alignment() for an empty iterator of any type - watch_queue: Give info_id its own storage instead of overlaying it with rcu_head - filelock: Take an active superblock reference while waiting for a delegation break. After a lazy umount closing the delegation holder could shut down the superblock under the waiter whose final iput() then ran shmem_evict_inode() on freed state - fs: Skip the copy_file_range() write limit checks when there is no data to copy - bpf: Allow bpf_d_path() from fentry on filp_close_sync(). Since close_range() became synchronous this cycle close(), close_range() and the closes on exec and exit no longer go through filp_close(). fexit stays rejected since the file may be gone by then - fs_pin: Dequeue the wait entry unconditionally in pin_kill(). A spuriously woken waiter kept its on-stack entry queued, took that as proof that the pin was alive and used the freed acct structure when umount() of the accounting file raced acct(2) - dcache: Don't fail __d_obtain_alias() for an inode without links and aliases. The ESTALE check added this cycle broke open_by_handle_at() and nfsd file handle decoding on NFS and FUSE where i_nlink is just what the server last reported and the handle may well still be valid - selftests/ovl: Fix the mountinfo expectations of the detached layer test which has failed since it was added * tag 'vfs-7.4-rc1.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (60 commits) fs: don't fail __d_obtain_alias() for unlinked inodes ns: don't add init_ipc_ns and init_net without namespace support aio: avoid request count overflow in ioctx_alloc() selftests/ovl: fix detached layer mountinfo expectations bpf: Allow bpf_d_path() from filp_close_sync() fs: skip copy_file_range write limits when there is no data minix: reject rmdir of a directory with a corrupted link count fs_pin: do not trust the pin after a spurious wakeup in pin_kill() ucount: read the parent ucounts before dropping the rlimit count splice: retry tee() instead of returning 0 when it races selftests/pidfd: test that fields beyond the struct size are not reported pidfs: do not report fields that do not fit into the caller's struct fs: let backing files inherit FMODE_NONOTIFY from the user file splice: avoid stale f_pos writeback on error backing-file: always end a queued write filelock: keep superblock active through delegation wait watch_queue: keep info_id separate from rcu_head iomap: only follow dio alignment requirement if specified iov_iter: fix NULL deref in iov_iter_alignment() backing-file: enforce append-only and immutable backing inodes ...	2026-10-30 09:25:01 -10:00
Ihor Solodrai	3a00ecc890	bpf: Allow bpf_d_path() from filp_close_sync() ... The d_path selftest closes its descriptors with close_range() so that its fentry program on filp_close() runs. Commit 056069eb2b ("fs: make close_range() synchronous") switched close_range() to filp_close_sync(), so the program still attaches but is never called: test_d_path_basic:FAIL:close trampoline for filp_close was not called With that series, close(), close_range() and the closes on exec and exit all go through filp_close_sync(). Few paths still reach filp_close(), dup2() being one of them, so a program on filp_close() no longer sees most file closes. Allow bpf_d_path() from filp_close_sync(), but only from fentry. filp_close_sync() drops the last file reference inline, so by the time an fexit program runs, file->f_path may already be freed, with no RCU delay for NORCU dentries such as pipes and sockets. Attach the selftest program to filp_close_sync() and keep triggering it with close_range(). Add a test rejecting bpf_d_path() from fexit/filp_close_sync. Fixes: 056069eb2b ("fs: make close_range() synchronous") Signed-off-by: Ihor Solodrai <ihor.solodrai@linux.dev> Link: https://patch.msgid.link/20261021201400.5409-1-ihor.solodrai@linux.dev Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>	2026-10-30 16:10:05 +01:00
Linus Torvalds	46806af187	bpf-fixes ... -----BEGIN PGP SIGNATURE----- iQJRBAABCgA7FiEE+soXsSLHKoYyzcli6rmadz2vbToFAmrjbZEdHGFsZXhlaS5z dGFyb3ZvaXRvdkBnbWFpbC5jb20ACgkQ6rmadz2vbTqGEQ//bqWuSeYGypshirYQ 4rxejupvJBJmrD+pI3MSDKVDaLgslm2vW8+vYB+rxpwzje4EsBtVqoHVxzk4yMoQ WyuJ7988W3RRZw5x5EEruS65C2pM5H2Ilzj2f8Z5gYUfvB72/TGJD2sDXxlTAtUb ESujBo/M9JRyYZBE5SMJT00r17clwf8NHoT3nr1FKAaDLQopE2zAnE/RwB1lEm3V MtUcnyDWEwu9ITOxMAwymzYI4FHadqxLJ5MCyCFUeqWAkJcPoVGHWN9Z/0cLTBYt 46PZIotJUEio1PsF6/3y0ZAS2whCAzBuuQCcRG1qBoOdczaDN8fl7RAuTvFmSpPJ H5Z1GUAXvoFAPpfb9upwYwrEc5hH7+4w9LsGjEumKZ2kHzPccH8K3jtUJRRvYiL8 W7LH4iiu/yPvYHKsgt89csGy6uoACUTn3Xbgfho4DzMoOO8Q8Ahw3SKMpPLIXPk2 1q8Olv9d2pdaVRVJ4qXGPV4510LXW5KwDBHiztZKij8HvasPJS4goaTRKOSIqYOx GCWCuyM4F22N1suHyUZea507PPVFBKcNBRXWt3nNbKWZNFXpayyS2UI/3kusFFuD +EFcu0sNDENJ04/SGgujswvGGYrahT8AsHSkwM8jMpiajBiI0ozjWyLwVYk17mAY WrPIg+X/Uh5nxk5o5RIbniOJ8l8= =kHds -----END PGP SIGNATURE----- Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf Pull bpf fixes from Alexei Starovoitov: - Remove BPF_F_ARENA_SCALAR flag and .arena.data section in libbpf that were added for rust-bpf in this merge window. We found a cleaner approach that does it on compiler side instead of kernel/libbpf. No released kernel has them (Alexei Starovoitov) - Fix bpf_send_signal_task() returning -EPERM when it is called from a kernel thread (Aditya Sharma) - Various fixes (Alexei Starovoitov): - Use emit_rsb_call() to call bpf_unwind_target() in x86 JIT to fix objtool warning during the build - Fix scalar evolution: clear delta of a widened register, don't widen a pointer to a buffer, don't clamp a register whose type changed in the loop, and reset the range of a clamped packet pointer - Finish the insn in the state that maybe_fork_scalars() splits off, so that pruning doesn't drop it at the head of a counted loop - Preserve the registers that carry stack arguments across arch_bpf_timed_may_goto() on x86-64, arm64 and riscv64 - Don't re-sort subprog_info[] for every new subprogram - Fix flaky map_kptr and rcu_reentry selftests - Use memmove() in bpf_skb_load_bytes(), bpf_skb_load_bytes_relative() and bpf_xdp_load_bytes(), since the destination can be a slice of the same packet (Ayushman Rout) - Fixes and follow-ups for scalar evolution: reject pointer operands in 32-bit recurrences and latches, don't intersect with the current register range on clamp to avoid a false 'verifier bug', avoid false infinite loop reports, and recognize a 32-bit copy of the induction variable (Eduard Zingerman) - Fix out-of-bounds write to btf->types[] for split BTF and propagate btf_add_type() errors in btf_check_all_metas() (Feng Yang) - Fix use-after-free in bpf_timer callback that fires after its inner map was freed (Mani Tofigh) - Fix x86 JIT stopping before jumps converge: size backward jumps by the insns they jump over (Mykyta Yatsenko) - Fix use-after-free of struct_ops trampoline: dissociate struct_ops progs before the grace period of the map (Qiliang Yuan) - Validate stack argument reads against the caller state to fix out-of-bounds read in the verifier, and reject callbacks with stack arguments (Weiming Shi) - Tie borrowed iterator results and pointers loaded from trusted fields to the lifetime of their source, so that iterator next, destroy and reference release invalidate them (Xu Yunxiang) * tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (48 commits) bpf: Don't re-sort subprog_info[] for every new subprogram bpf: Fix out-of-bounds btf->types write for split BTF selftests/bpf: Test stack arguments across may_goto bpf: Keep stack arguments in arch_bpf_timed_may_goto() selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop bpf: Finish the insn in the state that maybe_fork_scalars() splits off selftests/bpf: Test the clamp of pointers in scalar evolution bpf: Reset the range of a packet pointer that scalar evolution clamps bpf: Don't clamp a register whose type changed in the loop selftests/bpf: Test a loop that moves a pointer to a buffer bpf: Don't widen a pointer to a buffer in scalar evolution selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed selftests/bpf: Wait for the last maps of map_kptr to be freed selftests/bpf: Test that a widened register is not linked bpf: Clear delta of a register that scalar evolution widens bpf, x86: Remove r0_on_stack from fetching atomics in arena bpf: Remove BPF_F_ARENA_SCALAR selftests/bpf: Remove tests for arena access through numbers libbpf: Keep format strings of bpf_printk() in .rodata libbpf: Remove .arena.data ...	2026-10-29 08:10:23 -10:00
Linus Torvalds	59a02493f3	tracing updates for v7.4: ... - Add "within" to filter logic Add a way to trace events by what function they fall in. echo 'within == "vfs_read" > events/sched/sched_switch/filter Will only trigger sched_switch events that happen within the vfs_read function. It uses a stacktrace at the event and checks if any entry is within the specified function and if so, it prints the event. - Remove a duplicate definition of ftrace_set_clr_event() from the header - Do not have ftrace_set_clr_event() modify its input buffer Have the buffer passed into ftrace_set_clr_event() to be const char * and not allow modifications to it that might cause side effects. - Add kunit tests for ftrace_parse_event_string() - Add filter argument to __ftrace_set_clr_event() Make it possible to set a filter on an event at the same time it is enabled. - Add event filtering logic to the kernel command line To allow filtering events on boot, allow filtering to be specified on the kernel command line when enabling events. - Rename "ring_buffer_size()" to "ring_buffer_capacity()" "size" refers to how much is allocated whereas the actual return value is the amount of available data in the ring buffer minus its meta data. - Rename "trace_array_entries" to "trace_array_capacity" There's several functions that use "entries" and returns the amount of data that that is usable. "entries" should be only for the number of events, not the amount of data. - Print the histogram "bucket" size as unsigned. If a bucket size is LONG_MAX, then it shows up as a negative number. - Show bucket size in output of histograms The output of what the histogram is shown doesn't show the size of the buckets when buckets are used. The output should be the same as the input and since specifying buckets without a size is an invalid command, the output to display what was entered should also show the size. - Fix stacktrace modifier output Only show the stacktrace modifier when it was specified in creation. - Unregister filed variable histograms when the command fails If one histogram references a variable of another histogram it registers that other histogram. But if the first histogram fails in setup after it registered the other histogram it doesn't unregister it. Have the first histogram add the reference to the other histogram so the failure clean up will unregister the second histogram too. - Fix 64-bit signed histogram fields on 32-bit kernels A fix to convert char * to u64 with added casting also incorrectly added an intermediate cast to convert a long value to u64 which ended up truncating the upper 32 bits for 32-bit kernels. Remove the intermediate typecast. - Print signed histogram keys as signed Histogram keys were being printed as unsigned and with signed keys it was giving the wrong output. - Use copy_from_user() and not __copy_from_user() in syscall tracing The syscall tracing incorrectly was using __copy_from_user() which could be an issue if the system trusts perf doing the trace. - Take trace_types_lock when recording a new module in persistent buffer When a new module is loaded, the persistent ring buffer saves it in its persistent memory. All the trace_arrays are iterated looking for any persistent buffer to add the module to. But it did not hold the trace_types_lock meaning a trace_array could be added or removed while iterating the list. - Only create tracepoint guest_halt_poll_ns when it is used The tracepoint guest_halt_poll_ns is defined in the power management code but it is only used when CONFIG_CPU_IDLE_GOV_HALTPOLL is enabled. This wastes memory when that config isn't enabled so wrap the tracepoint around that as well. - Handle empty fields for events in trace_event_get_offsets() The user events could have empty fields and this causes trace_event_get_offsets() to crash as it expects events to always have fields. Make the function handle events with no fields. - Reject incomplete event filter expressions If a filter has an incomplete expression (common_pid == 1111 || ), it will cause a out-of-bounds bug. Have the predicate_parse() only process the expression if it is complete. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCatwDfRQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qk8TAP9buI4fQRvXGetyth9F/j8qGgTAEv19 sL5B48A/HDx2wgD+O6FcFAwwNKTjJHfHPArJUcQMp/D17rNDFSoF4T0kFQU= =F2J6 -----END PGP SIGNATURE----- Merge tag 'trace-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing updates from Steven Rostedt: - Add "within" to filter logic Add a way to trace events by what function they fall in. echo 'within == "vfs_read" > events/sched/sched_switch/filter Will only trigger sched_switch events that happen within the vfs_read function. It uses a stacktrace at the event and checks if any entry is within the specified function and if so, it prints the event. - Remove a duplicate definition of ftrace_set_clr_event() from the header - Do not have ftrace_set_clr_event() modify its input buffer Have the buffer passed into ftrace_set_clr_event() to be const char * and not allow modifications to it that might cause side effects. - Add kunit tests for ftrace_parse_event_string() - Add filter argument to __ftrace_set_clr_event() Make it possible to set a filter on an event at the same time it is enabled. - Add event filtering logic to the kernel command line To allow filtering events on boot, allow filtering to be specified on the kernel command line when enabling events. - Rename "ring_buffer_size()" to "ring_buffer_capacity()" "size" refers to how much is allocated whereas the actual return value is the amount of available data in the ring buffer minus its meta data. - Rename "trace_array_entries" to "trace_array_capacity" There's several functions that use "entries" and returns the amount of data that that is usable. "entries" should be only for the number of events, not the amount of data. - Print the histogram "bucket" size as unsigned. If a bucket size is LONG_MAX, then it shows up as a negative number. - Show bucket size in output of histograms The output of what the histogram is shown doesn't show the size of the buckets when buckets are used. The output should be the same as the input and since specifying buckets without a size is an invalid command, the output to display what was entered should also show the size. - Fix stacktrace modifier output Only show the stacktrace modifier when it was specified in creation. - Unregister filed variable histograms when the command fails If one histogram references a variable of another histogram it registers that other histogram. But if the first histogram fails in setup after it registered the other histogram it doesn't unregister it. Have the first histogram add the reference to the other histogram so the failure clean up will unregister the second histogram too. - Fix 64-bit signed histogram fields on 32-bit kernels A fix to convert char * to u64 with added casting also incorrectly added an intermediate cast to convert a long value to u64 which ended up truncating the upper 32 bits for 32-bit kernels. Remove the intermediate typecast. - Print signed histogram keys as signed Histogram keys were being printed as unsigned and with signed keys it was giving the wrong output. - Use copy_from_user() and not __copy_from_user() in syscall tracing The syscall tracing incorrectly was using __copy_from_user() which could be an issue if the system trusts perf doing the trace. - Take trace_types_lock when recording a new module in persistent buffer When a new module is loaded, the persistent ring buffer saves it in its persistent memory. All the trace_arrays are iterated looking for any persistent buffer to add the module to. But it did not hold the trace_types_lock meaning a trace_array could be added or removed while iterating the list. - Only create tracepoint guest_halt_poll_ns when it is used The tracepoint guest_halt_poll_ns is defined in the power management code but it is only used when CONFIG_CPU_IDLE_GOV_HALTPOLL is enabled. This wastes memory when that config isn't enabled so wrap the tracepoint around that as well. - Handle empty fields for events in trace_event_get_offsets() The user events could have empty fields and this causes trace_event_get_offsets() to crash as it expects events to always have fields. Make the function handle events with no fields. - Reject incomplete event filter expressions If a filter has an incomplete expression (common_pid == 1111 || ), it will cause a out-of-bounds bug. Have the predicate_parse() only process the expression if it is complete. * tag 'trace-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: (27 commits) tracing: Reject incomplete event filter expressions tracing: Guard trace_event_get_offsets() against an empty fields list cpuidle: haltpoll: Only define guest_halt_poll_ns tracepoint when used tracing/osnoise: Add __printf attribute to osnoise_print() tracing/histograms: Verify event_call identity when updating synth_event refcount tracing: Save the event file instead of the compatible histogram tracing: Hold trace_types_lock when resetting last boot data from readers tracing: Hold trace_types_lock when updating modules in persistent instances tracing/syscalls: Use copy_from_user for the faultable syscall buffer tracing: Print a signed histogram key as signed tracing: Fix 64-bit and signed histogram fields on 32-bit kernels tracing: Clamp the printed end of a histogram bucket at U64_MAX tracing: Unregister field variable histograms when the command fails tracing: Only report the stacktrace modifier on a real field tracing: Add the bucket size to expr_field_str() tracing: Print the bucket size as unsigned tracing: Rename tracing_entries_fops to tracing_capacity_fops tracing: Rename trace_array::entries to capacity ring-buffer: Rename ring_buffer_size() to ring_buffer_capacity() tracing: Parse filter from boot event string ...	2026-10-27 15:01:12 -10:00
Marc Zyngier	9e9283e4c9	Merge branch kvm-arm64/misc-fixes-7.4-1 into kvmarm-master/fixes ... * kvm-arm64/misc-fixes-7.4-1: : \ : Misc fixes: : : - Don't warn on SMCCC filter reserved range allocation failure : : - Correctly prevent GICv5 and some TLBI hypercalls to be used from : the host when pKVM is active : : - Enforce that only GICv3 guests are supported for pKVM : : - Don't try to access GICv5 EL2 sysregs from EL1 : : - Cleanup TRACE_REMOTE dependencies : : - Compute architectrally correct values for ID_AA64MMFR3_EL1.S1P[IO]E : by checking the feature dependencies : : - Fix random comments : / KVM: arm64: Sanitise ID_AA64MMFR3_EL1.S1P[IO]E tracing/remotes: Fix TRACE_REMOTE build when TRACING=n KVM: arm64: Fix stale VGICv3 comments in the nVHE world switch KVM: arm64: vgic: Do not access the GICv5 CPU interface from EL1 KVM: arm64: Validate the host-provided vgic model in pKVM KVM: arm64: Reject the stage-2 flush hypercalls under pKVM KVM: arm64: Reject the GICv5 CPU interface hypercalls under pKVM KVM: arm64: Don't WARN on SMCCC filter reserved range allocation failure Signed-off-by: Marc Zyngier <maz@kernel.org>	2026-10-26 10:57:37 +00:00
Vincent Donnefort	3bb853ad84	tracing/remotes: Fix TRACE_REMOTE build when TRACING=n ... TRACE_REMOTE relies on tracefs, eventfs and ring-buffer which are only built and declared when TRACING is enabled. It is however possible for a config to have FTRACE=y TRACING=n and TRACE_REMOTE=y. To fix this configuration, have TRACE_REMOTE select TRACING directly, just like other FTRACE options do and drop the TRACING dependency from NVHE_EL2_TRACING to avoid a circular Kconfig dependency. Cc: stable@vger.kernel.org Fixes: ea908a2b79 ("tracing: Add a trace remote module for testing") Reported-by: kernel test robot <lkp@intel.com> Closes: https://lore.kernel.org/oe-kbuild-all/202610142301.GBepPVmS-lkp@intel.com/ Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Acked-by: Steven Rostedt <rostedt@goodmis.org> Link: https://patch.msgid.link/20261015112814.332084-1-vdonnefort@google.com Signed-off-by: Marc Zyngier <maz@kernel.org>	2026-10-26 07:58:28 +00:00
Aditya Sharma	93bd472336	bpf: Remove nmi_uaccess_okay() check in bpf_send_signal_common() ... nmi_uaccess_okay() takes no task argument and is a statement about current. When commit 6280cf718d ("bpf: Implement bpf_send_signal_task() kfunc") made the PF_KTHREAD/PF_EXITING and is_global_init() test the supplied task, nmi_uaccess_okay() was left testing current. As a result bpf_send_signal_task() returns -EPERM whenever the calling context happens to be a kernel thread, regardless of which task the signal is aimed at. The same call with the same target succeeds or fails depending only on what the CPU was running: bpf_send_signal_task() from tp_btf/workqueue_execute_start : -EPERM bpf_send_signal_task() from tp_btf/sys_enter : 0 The check was carried over from bpf_probe_write_user() when bpf_send_signal() was added in commit 8b401f9ed2 ("bpf: implement bpf_send_signal() helper"). There it guards a user memory write, but bpf_send_signal_common() does no user memory access, so the check has nothing to guard here. It is also already a no-op outside x86. Remove it, and drop the part of the comment above it that described the memory access checks, as none remain. Fixes: 6280cf718d ("bpf: Implement bpf_send_signal_task() kfunc") Suggested-by: Andrii Nakryiko <andrii@kernel.org> Signed-off-by: Aditya Sharma <adi.sharma@zohomail.in> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://lore.kernel.org/bpf/20260819124324.43162-1-adi.sharma@zohomail.in/T/#u Link: https://patch.msgid.link/20261001072449.1377267-2-adi.sharma@zohomail.in	2026-10-24 04:00:57 +00:00
Kyle Zeng	1fdc4164e4	tracing: Reject incomplete event filter expressions ... A non-empty expression normally finishes in predicate_parse()'s inner loop, which resolves the pending logical operators before jumping to finalization. If the input ends after an operator, possibly followed by unary '!' tokens, the outer loop instead falls through with unresolved operator state. For example, "common_pid == 1 || common_pid == 2 &&" leaves prog[0].target equal to -1. The second pass then reads prog[-1] before the forward-jump check can reject it. Depending on adjacent slab contents, it can also copy an out-of-bounds word into a branch target that passes the forward-only check. A self-targeted perf tracepoint counting event can reach this path through PERF_EVENT_IOC_SET_FILTER. Reject the outer-loop fallthrough when a predicate has already been parsed. This ensures that non-empty expressions only reach finalization after the inner loop has resolved their operators. Keep the existing no-filter error for input that has no predicates. Add a regression test for trailing logical operators and unary negations. Fixes: 80765597bc ("tracing: Rewrite filter logic to be simpler and faster") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261023174620.91969-1-kylebot@openai.com Assisted-by: Codex:gpt-6-astra Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Tested-by: JongHyuk Kim(MalHyuk) <malhyuk97@gmail.com> Signed-off-by: Kyle Zeng <kylebot@openai.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-23 20:45:16 -04:00
Linus Torvalds	55fbedcec6	bpf-next-7.4 ... -----BEGIN PGP SIGNATURE----- iQJRBAABCgA7FiEE+soXsSLHKoYyzcli6rmadz2vbToFAmrY/GYdHGFsZXhlaS5z dGFyb3ZvaXRvdkBnbWFpbC5jb20ACgkQ6rmadz2vbTrF3w//W1IXtb7BHM5DqyRY +IUpLlVdJETLJpdxHGq4SMGU7T+JpBJ7e58HIa9bNfyFaeOFuIvH4dy284RHhr8T 3wPR61KmX4hZlmqz17lSKM4E4cnaYW/NMYfp4acA/VRNcvcM+IiGnuhzcFyIMs3w mPlw/r3rW7Cn7E2Ri2hRV/ZQoT7FyI7LtUEtHU8TUE9kh+T2LTut+FWMJrHe5w0J LDFwhVqZE0dWZ4695PK6cEIh8uxRJBnmIyMtN+zLBOtqAjiOSNNhFssdSCIkjPEe X9Xz1Zvqa8Z5QsyRsrwK4S62pnh0pVshQ8fDjrXKY7fkMPpzTvOfqOGS3qhOlw2y sz853Repug0ZerePFnPnfTIhRIcXagTT11BJUDhUzgy9/Cra3s0vY6c9/MrxTamh 3Xpu/UNl8AIqC/OnbAo8kJ9aKAG6olIBHYIsVOUYk3tH8m2HaVqpKXKRKfqshSDT YyKoGQE8g9gemS44/RSHKi6QI2jUxNwcOI8FBzViDZaeE476Zvv/fHNC5Tv7lwmm 5qGbcem9sakcd+n17aLy0xKYE2kUSQQLi/J80AY7gMR9VlGsbYPZ8KX8HeSaSLRy 7SMn2dBvNmFaFNgWdLQn4dmBFhvuVgZP6A/ZTreCLuXjBcPo1TnYkVwi3eye4eY/ CwgWBoUJTIqMMt+bRyNgBK0+5rQ= =kneb -----END PGP SIGNATURE----- Merge tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next Pull bpf updates from Alexei Starovoitov: "Major changes: - Introduce scalar evolution (SCEV) analysis in the verifier. It infers how registers and stack slots change in a loop and lets the verifier check bounded loops with induction variables as ranges instead of walking every iteration. The number of processed insns drops ten fold in programs with loops (Eduard Zingerman) - Add 'callx' instruction: indirect call of a static BPF subprogram. The address is taken with ld_imm64 or loaded from read-only data. Supported by x86-64, arm64 and riscv64 JITs (Alexei Starovoitov, Pu Lehui) - Add unwind_goto and unwind_exit instructions, so that Rust panic or C++ exception can run destructors of every frame it passes through. The normal path is free of unwind code. Supported by x86-64 and arm64 JITs (Alexei Starovoitov) - Support programs compiled by rust-bpf: treat load and store through a number as arena access with BPF_F_ARENA_SCALAR, accept rust names in BTF (Alexei Starovoitov) - Raise BPF program stack size from 512 bytes to 2 KiB on x86-64 and arm64 (Kumar Kartikeya Dwivedi) - Support struct, union and __int128 up to 16 bytes passed and returned by value in BPF subprograms and kfuncs, and fix x86-64 and arm64 trampolines for such arguments (Yonghong Song) - Introduce a common way to attach struct_ops to a cgroup via bpf_link. bpf_tcp_ops is the first user and mirrors TCP sock_ops callbacks (Martin KaFai Lau, Amery Hung) - Describe inlined functions in BTF. New kinds tell where the inline sites are and how to fetch the arguments there. CONFIG_DEBUG_INFO_BTF_INLINE keeps it apart from the main BTF in .BTF.inline section or in btf_vmlinux_inline.ko (Alan Maguire) - Fix many memory safety, lifetime and locking bugs in BPF core, verifier, iterators, local storage, dynptr, devmap, cpumap and seg6local (Josef Bacik, Alexei Starovoitov) - Diff stat is dominated by selftests and by removal of lib/test_bpf.c. Its 16k lines of instruction tests were converted to BPF selftests that BPF CI runs on every architecture it covers (Daniel Borkmann) Other features and fixes: - Add KASAN checks to memory accesses of JITed programs on x86-64 (Alexis Lothoré) - Complete unification of helper, kfunc and subprog argument checks in the verifier (Amery Hung) - Add bpf_copy_from_user_mm[_str]() kfuncs (Anastasios Papagiannis) - Various features and fixes (Daniel Borkmann): - Add .bpf keyring for program signature verification, modelled after dm-verity keyring, and support ML-DSA in signing tools - Emit shorter and faster code in x86-64 JIT for patterns that LLVM generates - Fix various issues in gotox handling - Let BPF LSM set xattrs at inode creation with bpf_inode_init_xattr() (David Windsor, Daniel Borkmann) - Use sleepable page allocation in sleepable arena paths. Fix races between arena free, allocation and user page fault (Emil Tsalapatis) - Switch BPF crypto from lskcipher to AES-CBC and AES-ECB libraries (Eric Biggers) - Add bpf_proactive_reclaim() kfunc (Hui Zhu) - Render decl_tags in libbpf btf_dump and add tests for bpftool C dump (Ihor Solodrai) - Speed up tracing_multi attach on x86 (Jiri Olsa) - Various features and fixes (Kumar Kartikeya Dwivedi): - Add BPF_PROG_STREAM_OPEN command to read BPF streams through a file descriptor with poll support - Let kernel structs publish arena pointers with __arena type tag - Fix __uninit kfunc output buffers and fastcall rewrite with indirect stack accesses - Refuse CO-RE relocations for signed programs - Add enqueue_rcvq and dequeue_rcvq hooks to bpf_tcp_ops to adjust sk_rcvlowat and avoid unnecessary wakeups (Kuniyuki Iwashima) - Add bpf_ksock_sendto() kfunc and allow ksock connect and send from bpf_wq (Mahe Tardy) - Fix racy plt target update in arm64 bpf_arch_text_poke() (Matthew Wood) - Restructure BPF selftests Makefile as a layered build (Mykola Lysenko) - Speed up hash map lookups for u32 and u64 keys (Mykyta Yatsenko) - Add signed div/mod, movsx, bswap and gotol to MIPS JITs, signed div/mod to parisc JITs (Nicholas Dudar, Johan Almbladh) - Fix stack overflow in build ID parser on 32-bit (Nickolai Zeldovich) - Add stack arguments, signed arena loads and gotox to riscv64 JIT. Pu Lehui is now co-maintainer of riscv BPF JITs (Pu Lehui, Chen Pei, Feng Jiang) - Add bpf_call_rcu() and bpf_call_rcu_tasks_trace() kfuncs. Support fetching and/or/xor atomics in arena on x86-64 (Puranjay Mohan) - Fix flaky selftests, selftests with clang 23 and bpf-gcc (Qiliang Yuan, KaFai Wan, Vineet Gupta) - Fix builds broken by fatal resolve_btfids warnings, BTF generation on ARC, and define arch_cmpxchg_local() on arc, hexagon and openrisc (Sasha Levin) - Reduce memory use of hash maps by up to 50% per element (T.J. Mercier) - Mark pointer fields of sched_ext ops arguments as trusted (Tejun Heo) - Remove legacy bpf_asm, bpf_dbg and bpf_jit_disasm tools (Xia Yan) - Fix index overflow in queue and stack maps, arena range tree after allocation failure, tail call loop after freplace detach, lost signal in bpf_send_signal() (Yuan Chen) - Many more fixes and cleanups" * tag 'bpf-next-7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next: (660 commits) selftests/bpf: Time tc_edt from its first packet with data selftests/bpf: Test unwind_exit of an exception callback selftests/bpf: Tests for 32-bit scalar evolution bounds computation bpf: Reject unwind_goto and unwind_exit in offloaded progs bpf: Support 32-bit linear scalar evolution bpf: Make unwind_exit of an exception callback exit in JITs selftests/bpf: Test forbidden bpf_ksock_sendto() LSM attach selftests/bpf: Test ksock sendto() bpf: Add bpf_ksock_sendto() kfunc selftests/bpf: Test unwinding from R0: R2 subprog selftests/bpf: Add a C++ prog with exceptions selftests/bpf: Add tests for unwind_goto and unwind_exit bpf, arm64: Support unwind_goto and unwind_exit bpf, x86: Support unwind_goto and unwind_exit bpf: Add unwind_goto and unwind_exit insns tools/bpf: Remove legacy BPF tools bpf: Annotate data races on bpf_lru_node type selftests/bpf: Add arena allocation race tests bpf: Fix arena race between page free and alloc leading to incoherency bpf: Revalidate faulted arena pages before installing user mappings ...	2026-10-23 13:08:49 -10:00
Linus Torvalds	3f942403bb	Probes updates for v7.4: ... - kprobes: Asynchronous optprobe optimizer and cleanups . Make optprobe optimizer multi-generational and asynchronous: Rework the optimizer as a state machine to avoid calling time-consuming synchronize_rcu_tasks() while holding kprobe_mutex, text_mutex, and cpus_read_lock(). Uses call_rcu_tasks() and a fixed ring of generation slots instead, so locks are only held during the brief instruction- patching window. . Use DEFINE_DEBUGFS_ATTRIBUTE for the kprobes enabled knob: Replace a hand-rolled debugfs read/write pair (dating from 2007) with the proper DEFINE_DEBUGFS_ATTRIBUTE macro, removing dead code and the stale XXX comment. - tracing/probes: Code quality and documentation cleanups . Add const qualifier to new_argv allocation type in trace_probe.c, preparing for the type-aware kmalloc_obj allocator conversion. . Clarify btf_find_struct_member() container parameter: Rename the misleading @member_type parameter to @container_type and add proper kernel-doc documentation for all parameters and return values. - selftests/ftrace: Boot tracing test framework and testcases . Add a generic boot tracing test framework under tools/testing/selftests/ftrace/boottime/. The test runner builds a minimal initramfs with busybox, boots QEMU, and runs tracefs checker scripts, supporting bootconfig, kernel command-line options, and multi-boot crash/reboot scenarios. . Add boot-time tracing testcases: Verify dynamic kprobe, synthetic events, eprobe, fprobe, tprobe, and trace instance creation via bootconfig. . Add kernel cmdline tracing testcases: Verify ftrace, trace_event, trace_buf_size, trace_options, trace_clock, and trace_instance kernel parameters. . Add persistent ring buffer testcases: Verify memory reservation via reserve_mem= and trace data retention across guest crash/reboot, as well as backup instance creation and boot log preservation. . Change non-unique test symbol from name_show to init_once in kprobe_non_uniq_symbol.tc for more reliable cross-architecture testing. -----BEGIN PGP SIGNATURE----- iQFPBAABCgA5FiEEh7BulGwFlgAOi5DV2/sHvwUrPxsFAmrX9VMbHG1hc2FtaS5o aXJhbWF0c3VAZ21haWwuY29tAAoJENv7B78FKz8bIfUIALyWP9gm/MdQ0jnl/qBg gtQ8Hp6xFVagZ7qbDBX72i8tLucVjQbadRyABeIo7XbTjxZxnKtQo1msbVm4kJS6 y+9YzjHEcfCdJI6oArhvZ1E+QdOyQZrF0+HtZ/IGO4l5oDMp4v4D1uy2SKyg+WDs L+Bq5nPitjAxKw5bbai8WYnmm9gicRur7vcFft6NbShaGpb7ZJ3CKbSaGsD9t7+o qUiJYOuZ3WH+uN8ANPBA7Ckqe5Prk4hqNGZOgRVgDukQ6UGtbpGs+t26pndbPkL2 UsBhvn+Yhs8byzW+99LZG66Wrfab/UC6FbayVCxeEciFp5ojBywRwjSrOPnt8mD7 osY= =K6e/ -----END PGP SIGNATURE----- Merge tag 'probes-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull probes updates from Masami Hiramatsu: "Asynchronous optprobe optimizer and cleanups: - Make optprobe optimizer multi-generational and asynchronous Rework the optimizer as a state machine to avoid calling time-consuming synchronize_rcu_tasks() while holding kprobe_mutex, text_mutex, and cpus_read_lock(). Uses call_rcu_tasks() and a fixed ring of generation slots instead, so locks are only held during the brief instruction- patching window - Use DEFINE_DEBUGFS_ATTRIBUTE for the kprobes enabled knob Replace a hand-rolled debugfs read/write pair (dating from 2007) with the proper DEFINE_DEBUGFS_ATTRIBUTE macro, removing dead code and the stale XXX comment Code quality and documentation cleanups: - Add const qualifier to new_argv allocation type in trace_probe.c, preparing for the type-aware kmalloc_obj allocator conversion - Clarify btf_find_struct_member() container parameter Rename the misleading @member_type parameter to @container_type and add proper kernel-doc documentation for all parameters and return values Boot tracing test framework and testcases: - Add a generic boot tracing test framework under tools/testing/selftests/ftrace/boottime/ The test runner builds a minimal initramfs with busybox, boots QEMU, and runs tracefs checker scripts, supporting bootconfig, kernel command-line options, and multi-boot crash/reboot scenarios - Add boot-time tracing testcases Verify dynamic kprobe, synthetic events, eprobe, fprobe, tprobe, and trace instance creation via bootconfig - Add kernel cmdline tracing testcases Verify ftrace, trace_event, trace_buf_size, trace_options, trace_clock, and trace_instance kernel parameters - Add persistent ring buffer testcases: Verify memory reservation via reserve_mem= and trace data retention across guest crash/reboot, as well as backup instance creation and boot log preservation - Change non-unique test symbol from name_show to init_once in kprobe_non_uniq_symbol.tc for more reliable cross-architecture testing" * tag 'probes-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace/selftests: Change non-unique test symbol to init_once tracing/probes: Clarify btf_find_struct_member() container parameter and add kernel-doc kprobes: Make optprobe optimizer multi-generational and asynchronous tracing/probes: Add const to new_argv allocation type kprobes: use DEFINE_DEBUGFS_ATTRIBUTE for the enabled knob selftests/ftrace: Add persistent ring buffer testcases selftests/ftrace: Add kernel cmdline tracing testcases selftests/ftrace: Add boot-time tracing testcases selftests/ftrace: Add generic boot tracing test framework	2026-10-23 12:12:26 -10:00
Linus Torvalds	d1679c8713	ring-buffer updates for v7.4: ... - Add Vincent Donnefort as ring-buffer maintainer Vincent has been doing a lot of updates to the ftrace ring buffer lately. I'm going to start delegating updates for the ring buffer to him. - Use RING_BUFFER_MIN_NR_PAGES instead of open coding the number 2 Instead of using the number 2 as the minimum number of pages that a ring buffer may have, create and use a macro RING_BUFFER_MIN_NR_PAGES. - Clean up the resize_disabled_checks There's duplication of code to check for resize disabled. Create a helper function rb_resize_disabled() and use that. Not only does it put the code in one place, it also removed a redundant check. - Remove unnecessary cpumask_test_cpu checks The loop for_each_buffer_cpu(buffer, cpu) only loops over CPUs in the buffer->cpumask. There's no reason to test if the CPU is set in that same loop. - Take cpus_read_lock() when changing the subbuf order A CPU coming on line for the first time allocates its CPU buffer. But if this happens while the subbuffer is being resized, it can cause an inconsistent state of subbufer sizes in the buffer. Add a cpus_read_lock() to ring_buffer_subbuf_order_set() to prevent this race. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCatpo/hQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qoK9AQClJpD3Cfvf+4FDCppal3kWFLRfPUM7 hiVID/M3eTRo1QD/YppXrKQyYDahxo5RAUFQOTv8jYiPHum64Pntlo9iEQE= =Y0BI -----END PGP SIGNATURE----- Merge tag 'trace-ringbuffer-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ring-buffer updates from Steven Rostedt: - Add Vincent Donnefort as ring-buffer maintainer Vincent has been doing a lot of updates to the ftrace ring buffer lately. I'm going to start delegating updates for the ring buffer to him. - Use RING_BUFFER_MIN_NR_PAGES instead of open coding the number 2 Instead of using the number 2 as the minimum number of pages that a ring buffer may have, create and use a macro RING_BUFFER_MIN_NR_PAGES. - Clean up the resize_disabled_checks There's duplication of code to check for resize disabled. Create a helper function rb_resize_disabled() and use that. Not only does it put the code in one place, it also removed a redundant check. - Remove unnecessary cpumask_test_cpu checks The loop for_each_buffer_cpu(buffer, cpu) only loops over CPUs in the buffer->cpumask. There's no reason to test if the CPU is set in that same loop. - Take cpus_read_lock() when changing the subbuf order A CPU coming on line for the first time allocates its CPU buffer. But if this happens while the subbuffer is being resized, it can cause an inconsistent state of subbufer sizes in the buffer. Add a cpus_read_lock() to ring_buffer_subbuf_order_set() to prevent this race. * tag 'trace-ringbuffer-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ring-buffer: Take cpus_read_lock() when changing the subbuf order ring-buffer: Remove unnecessary cpumask_test_cpu ring-buffer: Clean up resize_disabled checks ring-buffer: Unify ring buffer minimum page calculations ring-buffer: Add a MAINTAINERS category specific for the tracing ring-buffer	2026-10-23 12:07:27 -10:00
Linus Torvalds	b8a7a86e48	ftrace updates for v7.4: ... - Have the stacktrace option work with func-args The func_stack_trace option has it's own ftrace handler and so does the func-args option. When they are both set, neither would run. The function tracer itself would error out. Allow the stacktrace and function args to work together. - Avoid BTF lookup in atomic context The ftrace_dump() can call function graph tracing output from an atomic context (like an NMI watchdog going off). The BTF lookup is not safe to call from atomic context. Have btf_find_func_proto() return if in atomic context. - Build trace_btf.c when CONFIG_DEBUG_INFO_BTF is enabled New code is depending on trace_btf.c but that only gets built when BPF_SYSCALL is also enabled. As the new code doesn't depend on that, have trace_btf.c get built with just DEBUG_INFO_BTF set. - Have function graph return values have BTF processing Have the return values printed by the function graph tracer use BTF to print the values in better format. For example, if it's a char, short, signed or unsigned, print according to the value defined by BTF. - Add a "max" field to the function profiler stats The function profiler shows all the functions run in the kernel, the number of times they are called, and the total time they took up. Also add a "max" field which holds the longest time a function ran for. - Fix memory leak in module with all skipped functions On module load, the ftrace entries are recorded to keep track of what functions can be traced or not. Some functions may be skipped for various reasons (some defined by the architecture). If all functions in the module are skipped, its data page is not freed and can leak. Catch this case and free the empty page. - Allow architectures to reject functions from being traced Allow architectures to skip a function address by returning zero from ftrace_call_adjust(). - Initialize modname and offset in print_rec() The variables modname and offset are initialized by kallsyms_lookup(). If that fails, the values are not set, but the code continues to print other information. The modname and offset are used later, but if the kallsyms_lookup() failed, they will not be set. If a module is being loaded and unloaded at the same time as reading the available_filter_functions file, it can cause a fault due to the lookup failing and modname and offset being used uninitialized. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCatplBBQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qgAvAQD0xgDPtb6+4T9lB7ZerQwFWHZ2roO7 ghQY+yqcX8s4TwEAn7B85quPdz7XvGzQa3KeKBXMFfpogJx4vljJzpPQoAg= =SgDW -----END PGP SIGNATURE----- Merge tag 'trace-ftrace-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull ftrace updates from Steven Rostedt: - Have the stacktrace option work with func-args The func_stack_trace option has it's own ftrace handler and so does the func-args option. When they are both set, neither would run. The function tracer itself would error out. Allow the stacktrace and function args to work together. - Avoid BTF lookup in atomic context The ftrace_dump() can call function graph tracing output from an atomic context (like an NMI watchdog going off). The BTF lookup is not safe to call from atomic context. Have btf_find_func_proto() return if in atomic context. - Build trace_btf.c when CONFIG_DEBUG_INFO_BTF is enabled New code is depending on trace_btf.c but that only gets built when BPF_SYSCALL is also enabled. As the new code doesn't depend on that, have trace_btf.c get built with just DEBUG_INFO_BTF set. - Have function graph return values have BTF processing Have the return values printed by the function graph tracer use BTF to print the values in better format. For example, if it's a char, short, signed or unsigned, print according to the value defined by BTF. - Add a "max" field to the function profiler stats The function profiler shows all the functions run in the kernel, the number of times they are called, and the total time they took up. Also add a "max" field which holds the longest time a function ran for. - Fix memory leak in module with all skipped functions On module load, the ftrace entries are recorded to keep track of what functions can be traced or not. Some functions may be skipped for various reasons (some defined by the architecture). If all functions in the module are skipped, its data page is not freed and can leak. Catch this case and free the empty page. - Allow architectures to reject functions from being traced Allow architectures to skip a function address by returning zero from ftrace_call_adjust(). - Initialize modname and offset in print_rec() The variables modname and offset are initialized by kallsyms_lookup(). If that fails, the values are not set, but the code continues to print other information. The modname and offset are used later, but if the kallsyms_lookup() failed, they will not be set. If a module is being loaded and unloaded at the same time as reading the available_filter_functions file, it can cause a fault due to the lookup failing and modname and offset being used uninitialized. * tag 'trace-ftrace-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: ftrace: Initialize modname and offset in print_rec() ftrace: Let ftrace_call_adjust() reject a patch site ftrace: Do not leak a module's empty page group ftrace: Add max field to function profiler stats tracing: Update funcgraph-retval documentation fgraph: Enhance funcgraph-retval with BTF-based type-aware output ftrace: Build trace_btf.c when CONFIG_DEBUG_INFO_BTF is enabled tracing: Avoid BTF lookup in atomic context ftrace: Have stacktrace option work with func-args	2026-10-23 12:05:34 -10:00
Linus Torvalds	ff5b1cefb4	runtime verifier updates for v7.4: ... - Improve lockdep annotation for reactors Reactors are not supposed to take locks, so they fit the LD_WAIT_FREE lockdep class. However, reactors may run in preemptible context and if the preempting code (tick or simply the scheduler) takes locks, we see a lockdep splat. Switch to LD_WAIT_SPIN to avoid the splat while documenting that reactors should still not take locks. - Add KUnit tests for reactors Add KUnit test cases to validate registration and reaction, this requires exporting some symbols and other minor fixes. - Use the right rv_this variable in the wakeup monitor LTL monitors were updated to use the generic rv_this static variable but this change wasn't propagated to the newly introduced wakeup monitor. This broke reactors for the monitor: update the it. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCateHQxQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qi1NAP9fv++iAElk3/btNOOQqSv6vEj9xCpE 0sRiGRPoWupqUAEA0tGOB5JQNQM97HYeJoC0VzXZok3ZyDpO/afev576yw0= =X6hG -----END PGP SIGNATURE----- Merge tag 'trace-rv-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull runtime verifier updates from Steven Rostedt: - Improve lockdep annotation for reactors Reactors are not supposed to take locks, so they fit the LD_WAIT_FREE lockdep class. However, reactors may run in preemptible context and if the preempting code (tick or simply the scheduler) takes locks, we see a lockdep splat. Switch to LD_WAIT_SPIN to avoid the splat while documenting that reactors should still not take locks. - Add KUnit tests for reactors Add KUnit test cases to validate registration and reaction, this requires exporting some symbols and other minor fixes. - Use the right rv_this variable in the wakeup monitor LTL monitors were updated to use the generic rv_this static variable but this change wasn't propagated to the newly introduced wakeup monitor. This broke reactors for the monitor: update the it. * tag 'trace-rv-v7.4' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: rv/rtapp/wakeup: Use "rv_this" the rv_monitor variable rv: Add KUnit tests for reactor registration and dispatch rv: Export rv_register_reactor() and rv_unregister_reactor() rv: Propagate rv_register_reactor() error from reactor init rv: Use LD_WAIT_SPIN as the reactor lockdep wait type	2026-10-23 12:02:13 -10:00
Haoran Wang	c0c7c3f9d2	tracing: Guard trace_event_get_offsets() against an empty fields list ... trace_event_get_offsets() dereferences the first entry of the fields list returned by trace_get_fields() via list_first_entry(). list_first_entry() then returns the list head itself, and tail->offset + tail->size reads past it. The corrupted result is used as the BPF context-size bound in __perf_event_set_bpf_prog(): int off = trace_event_get_offsets(event->tp_event); if (prog->aux->max_ctx_offset > off) return -EACCES; so a context-reading BPF program that ought to be rejected can instead be attached to a zero-field tracepoint (which still carries TRACE_EVENT_FL_TRACEPOINT) and read adjacent kernel memory when the tracepoint fires, bypassing the verifier's context-size confinement. This is reachable through user_events: a user can register an event with no fields (e.g. `echo u:my_event > dynamic_events`), which leaves user->fields empty while the event remains a BPF-attachable tracepoint, trace_get_fields() then routes through user_event_get_fields() to that empty list. The corrupted result after list_first_entry is then used as the BPF context-size bound in __perf_event_set_bpf_prog(), which lets context-reading BPF programs attach to a zero-field tracepoint when they should be rejected with -EACCES. Add list empty check to fix this bug. Link: https://patch.msgid.link/6ad1f2ca.6048f038.32d739.a530@mx.google.com Signed-off-by: Haoran Wang <haoranwangsec@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-23 13:31:10 -04:00
Linus Torvalds	864c07de0c	hardening updates for v7.4-rc1 ... - Provide kmalloc_obj*-style API for devm_kmalloc() - Improve seq_buf API for saner C String handling with several bug fixes along the way (Kees Cook, Bill Wendling) - Overflow helper readability improvements (Bill Wendling) - Unexport native_write_cr4() (Dennis Chen) - um: fix CONFIG_GCOV for built-in code (Johannes Berg) - Improve stackinit test coverage (Justin Stitt) - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann) - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim) - signalfd: don't dequeue the forced fatal signals (Oleg Nesterov) - Fix randstruct to recognize new container_of() behavior - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too - Fix a couple remaining allocation return type mismatches -----BEGIN PGP SIGNATURE----- iHUEABYKAB0WIQRSPkdeREjth1dHnSE2KwveOeQkuwUCatpUqAAKCRA2KwveOeQk u6f7AQCmaAF+jGVxeljdguKRrge+bjxpsK+RIyDzf7JMUauxPwD/RvGklH+QCACS xj4tExbgBFOAo48uvqfUiGsJLaCJAQg= =uEMy -----END PGP SIGNATURE----- Merge tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux Pull hardening updates from Kees Cook: - Provide kmalloc_obj*-style API for devm_kmalloc() - Improve seq_buf API for saner C String handling with several bug fixes along the way (Kees Cook, Bill Wendling) - Overflow helper readability improvements (Bill Wendling) - Unexport native_write_cr4() (Dennis Chen) - um: fix CONFIG_GCOV for built-in code (Johannes Berg) - Improve stackinit test coverage (Justin Stitt) - KMSAN: fix memset() when using fortify-source, again (Arnd Bergmann) - lkdtm: use kmalloc() instead of __get_free_page (Mahad Ibrahim) - signalfd: don't dequeue the forced fatal signals (Oleg Nesterov) - Fix randstruct to recognize new container_of() behavior - coccinelle: kmalloc_obj: Convert multi-byte integral allocations too - Fix a couple remaining allocation return type mismatches * tag 'hardening-v7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux: (29 commits) overflow: Match arithmetic in both parts of __builtin_choose_expr lkdtm: Make UNSET_SMEP built-in-only and unexport native_write_cr4() extcon: realtek: Remove const from type_c_cfg allocation type coresight: cti: Add const to con_groups allocation type docs: core-api: Document the seq_buf API nvdimm: ndtest: Return the string length from flags_show() powerpc/papr_scm: Return the string length from the sysfs show functions seq_buf: Add seq_buf_init_append() bpf: Remove dead newline stripping from format_disasm_line() seq_buf: Add seq_buf_terminate() seq_buf: Add seq_buf_strlen() seq_buf: Clear what a writer did not claim when a seq_buf overflows seq_buf: Copy what fits when seq_buf_puts() and seq_buf_putmem() overflow scsi: lpfc: Print rx monitor records straight into the seq_buf seq_buf: Do not pop from an overflowed seq_buf seq_buf: Do not print an empty line from an overflowed seq_buf_do_printk() .get_maintainer.ignore: Add Kees Cook devres: Provide kmalloc_obj*-style API for devm_kmalloc mm: Move default_gfp() into gfp_types.h kunit/stackinit: Clean up XFAIL under instrumentation ...	2026-10-22 15:01:57 -10:00
Linus Torvalds	94905fcbd9	bpf: Use get_user() for kprobe_multi symbols and uprobe_multi arrays ... copy_user_syms() and bpf_uprobe_multi_link_attach() check whole user arrays with access_ok() up front, then read them one element at a time with __get_user(), with other work in between: allocations and strncpy_from_user() in copy_user_syms(), validation in the uprobe_multi loop. Each of those accesses enables and disables user access on its own, so the up-front check saves nothing. On x86, __get_user() is even more expensive than get_user(): it does an lfence, where get_user() checks the address with a couple of plain instructions. Use get_user(). The access_ok() checks stay, because they also make a bad array fail with -EFAULT before anything else is looked up or allocated. Update the comment that said they were there for __get_user(). This is part of getting rid of __get_user() and __put_user() entirely. Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>	2026-10-19 19:23:30 -10:00
Adrián García Casado	f86641ffea	tracing/osnoise: Add __printf attribute to osnoise_print() ... Building kernel/trace/trace_osnoise.o with W=1 triggers the following compiler warning: kernel/trace/trace_osnoise.c:96:17: warning: function 'osnoise_print' might be a candidate for 'gnu_printf' format attribute [-Wsuggest-attribute=format] osnoise_print() forwards its format string and va_list arguments to trace_array_vprintk(), which is annotated with __printf(3, 0). Add the __printf(1, 2) attribute to osnoise_print() to silence the W=1 warning and enable compile-time format string checking for its callers. Link: https://patch.msgid.link/20261019205344.190022-1-adriangarciacasado42@gmail.com Signed-off-by: Adrián García Casado <adriangarciacasado42@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-19 20:07:13 -04:00
Lee Jones	3403d9bb27	tracing/histograms: Verify event_call identity when updating synth_event refcount ... In event_hist_trigger_parse() and hist_unreg_all(), the histogram registration and unregistration paths look up find_synth_event() using trace_event_name(file->event_call) and adjust se->ref if a match is found. Because find_synth_event() only compares the event basename, registering or removing a histogram on a non-synthetic trace event whose basename matches a synthetic event erroneously modifies the synthetic event's reference count. If a histogram is registered on the non-synthetic event before the synthetic event is created and removed afterwards, se->ref is decremented without a matching increment, allowing the synthetic event to be freed while an active histogram action still holds a pointer to it. Introduce find_synth_event_call() to verify that &se->call matches file->event_call before adjusting se->ref. Fixes: 4b147936fa ("tracing: Add support for 'synthetic' events") Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20261019120730.2342739-1-lee@kernel.org Signed-off-by: Lee Jones <lee@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-19 10:47:46 -04:00
Aaron Ahmed	e1f339ff3b	ftrace: Initialize modname and offset in print_rec() ... print_rec() leaves 'modname' and 'offset' uninitialized and kallsyms_lookup() only sets them on success. When the lookup fails like when a module is being loaded or unloaded, 'modname' holds a garbage value, passes the 'if (modname)' check, and is dereferenced by seq_printf(). Oops: general protection fault RIP: 0010:string+0x48/0xe0 Call Trace: vsnprintf+0x1f5/0x650 seq_printf+0x8e/0xb0 print_rec+0x6c/0xc0 t_show+0x4c/0x440 seq_read_iter+0x119/0x480 This can be triggered by reading available_filter_functions while a module is being loaded or unloaded. Initialize both variables so a failed lookup skips the module name. Cc: stable@vger.kernel.org Fixes: b39181f7c6 ("ftrace: Add FTRACE_MCOUNT_MAX_OFFSET to avoid adding weak function") Link: https://patch.msgid.link/20261016230403.4916-1-aarnahmd@amazon.com Tested-by: Gavin Inglis <giinglis@amazon.com> Signed-off-by: Aaron Ahmed <aarnahmd@amazon.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-19 10:46:23 -04:00
Jose Fernandez (Anthropic)	c738829502	ftrace: Let ftrace_call_adjust() reject a patch site ... When ftrace_call_adjust() returns 0 for a patch site, ftrace_process_locs() does not skip the site. The NULL test runs before the adjustment since commit 6eeca746fa ("ftrace: Test mcount_loc addr before calling ftrace_call_addr()"), so the 0 is stored as the record's ip and ftrace_init_nop() later hits the BUG_ON() in arm64's patch_map(). Test the adjusted address too and count the site as skipped. Link: https://patch.msgid.link/20260924-b4-arm64-callops-kcfi-v2-2-587865b6d991@linux.dev Reviewed-by: Ben Cressey <ben@cressey.dev> Reviewed-by: Florent Revest (Anthropic) <florent.revest@linux.dev> Assisted-by: LLM Signed-off-by: Jose Fernandez (Anthropic) <jose.fernandez@linux.dev> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-19 10:28:11 -04:00
Jose Fernandez (Anthropic)	6703ab347f	ftrace: Do not leak a module's empty page group ... When every mcount_loc entry of a module is skipped, ftrace_process_locs() leaves the module's first page group linked with no records. ftrace_release_mod() matches a module's groups by records[0].ip, which is 0 here, so the group is never freed. While it stays linked, ftrace_free_mem() reads pg->records[pg->index - 1] with pg->index == 0 on every later module load, as lookup_rec() did before commit ee92fa4433 ("ftrace: Fix invalid address access in lookup_rec() when index is 0"). Unlink and free the new page groups when none of them got a record. Link: https://patch.msgid.link/20260924-b4-arm64-callops-kcfi-v2-1-587865b6d991@linux.dev Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260904013350.5141B1F000E9@smtp.kernel.org/ Assisted-by: LLM Signed-off-by: Jose Fernandez (Anthropic) <jose.fernandez@linux.dev> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-19 10:27:53 -04:00
Josef Bacik	3ccd700543	bpf: Read the probe of a perf event under event_mutex ... For a perf event on a kprobe or uprobe event which was made in tracefs, bpf_get_kprobe_info() and bpf_get_uprobe_info() look the probe up by name in the list of dynamic events, and hand a pointer to its symbol or file name back to the caller. None of the callers holds event_mutex. The perf event keeps its trace event alive, nothing else. Other dynamic events are removed from the list and freed during the walk. And a probe which shares its event with other probes can be deleted while the event is in use, so even the probe which is found can be freed, together with the string, before the caller has measured and copied it. The result is a use-after-free in the walk, in strlen() and in the copy to user space, or a NULL pointer dereference. The readers are BPF_OBJ_GET_INFO_BY_FD and fdinfo of a perf link, for whoever holds a descriptor of the link, and BPF_TASK_FD_QUERY. The other side is anybody who may write to dynamic_events, kprobe_events or uprobe_events. Take event_mutex in bpf_get_perf_event_info() and give the caller a copy of the name, which it has to free. Fixes: 41bdc4b40e ("bpf: introduce bpf subcommand BPF_TASK_FD_QUERY") Signed-off-by: Josef Bacik <josef@toxicpanda.com> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261017163745.3341787-10-alexei.starovoitov@gmail.com	2026-10-17 21:58:22 +00:00
Linus Torvalds	e2c278bc37	tracing fixes for v7.3: ... - Fix NULL dereference when copying histogram field variable If event_hist_trigger_parse() creates an action that uses one of pseudo fields for its keys, the hist_data field element will have a NULL for its field member. When looking to match that key, the lookup uses key_field->field->name which will dereference a NULL pointer. Instead use the helper function that handles such cases: expr_field_str(). - Take the trace_types_lock when dropping the buffer_meta reference The tracing_buffer_meta_open() error return drops the trace_array reference with __trace_array_put() instead of trace_array_put() where the former doesn't take the lock and the latter does. - Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta These files are created for every possible CPU. But it only contains data for CPUs that have come online. If one is read for a CPU that hasn't come online yet, it triggers a NULL pointer dereference. Have reading of CPUs that have not come on line yet return -ENODEV. - Fix an out-of-bounds shift in the log2 histogram modifier Histograms can take a log2 modifier to have the buckets defined by log2 increments. If a shift is greater than ULONG_MAX or above 2^63, the key falls into a lower order bucket. Use order_base_2() instead of "ilog2(n - 1) + 1" to have all overflowed keys go into the top bucket. - Fix the persistent ring buffer rb_meta_subbuf_idx() accounting The algorithm for finding the index of a sub-buffer in a persistent ring buffer buffer did not take into account the meta data at the beginning of the buffer causing the wrong index to be returned. As rb_subbufs_from_meta() does the proper accounting to find the first sub-buffer, use that function instead of repeating the logic (incorrectly) and make the calculations based off of that. - Fix the symbol name checks for the remote buffer code The remote ring buffer has a build time check to make sure its not using any code that will not be in the hypervisor. For various architectures, there has been false positive reports from this checker. Fix them. - Fix false warning in ring_buffer_map_get_reader() There is a WARN_ON() after rb_get_reader_page() if no reader is returned. But there are legitimate cases where this can happen. Remove the WARN_ON() and also a check that covers one of the legitimate cases that tries to exit out early. There's no need for the check if it just simply allows the return of NULL from rb_get_reader_page(). - Fix the ignored return value from resize_buffer_duplicate_size() Some clean up of the code in tracing_snapshot_write() removed checking the return value of resize_buffer_duplicate_size() and if that failed it would not be detected. - Fix the histogram timestamps for buffered events The histogram timestamps are taken from the events that are recorded. It currently reads ring_buffer_event_time_stamp() but if the event is buffered it does not read it properly. Use tracing_event_time_stamp() which handles both buffered and normal events. - Do not initialize tracefs if tracing is disabled at boot If tracing fails to allocate or some other error is detected, tracing_disabled is set. Do not initialize tracefs in this case as it may expect data to be initialized but is not. - Free eventfs inode after an RCU grace period Currently eventfs_inodes are freed after a SRCU grace period as the iterations in the code use SRCU. There are locations that the inode may still be accessed from the VFS that uses RCU which does not have the same synchronization as SRCU. Add an RCU wait before free eventfs inodes. - Do not fail persistent and remote buffers under memory pressure As persistent and remote buffers have their own pre-allocated memory, there's no reason to check how much memory is available before created them. By checking the memory pressure, these buffers may fail to be created even though their memory is already present. - Account for subbuffer size when checking how much memory is available Before allocating a ring buffer, the size is checked against the current memory pressure of the system. But it assumes every sub-buffer is of page size. This is no longer the case. Use the actual sub-buffer size when calculating how much memory will be used. - Reject non-stack fields for synthetic stacktrace fields Stack traces are special fields and the checks currently do not do enough to make sure that the fields being processed as stack traces are indeed stack traces. Update the logic to properly detect what is or is not a stack trace. - Fix a crash in print_graph_function_event() When a tracer does not define static or default flags the tr->current_trace_flags is set to NULL. If the ring buffer is not cleared when switching tracers, the previous tracers events could be read. The function_graph entries will dereference the tr->current_trace_flags and cause a crash. Set the tr->current_trace_flags to a empty set of flags to prevent it from being NULL. - Separate tracing filter predicate count from allocation The amount allocated for the predicate program is the number of predicates defined plus two for adding "true" and "false" at the end. The nr_preds is incremented by two to accommodate the booleans but is then used as the limit check for number of predicates. This is incorrect as it is now two higher than what is expected. Use a separate variable for the size of the predicate array. - Fix the filter operator stack check The operator stack increments the pointer and then writes the content onto the stack. The check for overflow compared the current pointer to see if it was greater than the stack size before doing so. This is an off by 2 error as the write will be at the size - 1 and the compare is done before the increment. Adjust the check accordingly. -----BEGIN PGP SIGNATURE----- iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCatItoRQccm9zdGVkdEBn b29kbWlzLm9yZwAKCRAp5XQQmuv6qmfsAP9XviDyrl49/PBpuanB2qQzlMGqYQlb CwISmzgWoO1jKQEArNiSpKsIdPLfSJSLfIHAGxAZfmT42SugA4M5jqhW3Qc= =7KiP -----END PGP SIGNATURE----- Merge tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace Pull tracing fixes from Steven Rostedt: - Fix NULL dereference when copying histogram field variable If event_hist_trigger_parse() creates an action that uses one of pseudo fields for its keys, the hist_data field element will have a NULL for its field member. When looking to match that key, the lookup uses key_field->field->name which will dereference a NULL pointer. Instead use the helper function that handles such cases: expr_field_str(). - Take the trace_types_lock when dropping the buffer_meta reference The tracing_buffer_meta_open() error return drops the trace_array reference with __trace_array_put() instead of trace_array_put() where the former doesn't take the lock and the latter does. - Fix NULL pointer dereference when reading per_cpu/cpuN/buffer_meta These files are created for every possible CPU. But it only contains data for CPUs that have come online. If one is read for a CPU that hasn't come online yet, it triggers a NULL pointer dereference. Have reading of CPUs that have not come on line yet return -ENODEV. - Fix an out-of-bounds shift in the log2 histogram modifier Histograms can take a log2 modifier to have the buckets defined by log2 increments. If a shift is greater than ULONG_MAX or above 2^63, the key falls into a lower order bucket. Use order_base_2() instead of "ilog2(n - 1) + 1" to have all overflowed keys go into the top bucket. - Fix the persistent ring buffer rb_meta_subbuf_idx() accounting The algorithm for finding the index of a sub-buffer in a persistent ring buffer buffer did not take into account the meta data at the beginning of the buffer causing the wrong index to be returned. As rb_subbufs_from_meta() does the proper accounting to find the first sub-buffer, use that function instead of repeating the logic (incorrectly) and make the calculations based off of that. - Fix the symbol name checks for the remote buffer code The remote ring buffer has a build time check to make sure its not using any code that will not be in the hypervisor. For various architectures, there has been false positive reports from this checker. Fix them. - Fix false warning in ring_buffer_map_get_reader() There is a WARN_ON() after rb_get_reader_page() if no reader is returned. But there are legitimate cases where this can happen. Remove the WARN_ON() and also a check that covers one of the legitimate cases that tries to exit out early. There's no need for the check if it just simply allows the return of NULL from rb_get_reader_page(). - Fix the ignored return value from resize_buffer_duplicate_size() Some clean up of the code in tracing_snapshot_write() removed checking the return value of resize_buffer_duplicate_size() and if that failed it would not be detected. - Fix the histogram timestamps for buffered events The histogram timestamps are taken from the events that are recorded. It currently reads ring_buffer_event_time_stamp() but if the event is buffered it does not read it properly. Use tracing_event_time_stamp() which handles both buffered and normal events. - Do not initialize tracefs if tracing is disabled at boot If tracing fails to allocate or some other error is detected, tracing_disabled is set. Do not initialize tracefs in this case as it may expect data to be initialized but is not. - Free eventfs inode after an RCU grace period Currently eventfs_inodes are freed after a SRCU grace period as the iterations in the code use SRCU. There are locations that the inode may still be accessed from the VFS that uses RCU which does not have the same synchronization as SRCU. Add an RCU wait before free eventfs inodes. - Do not fail persistent and remote buffers under memory pressure As persistent and remote buffers have their own pre-allocated memory, there's no reason to check how much memory is available before created them. By checking the memory pressure, these buffers may fail to be created even though their memory is already present. - Account for subbuffer size when checking how much memory is available Before allocating a ring buffer, the size is checked against the current memory pressure of the system. But it assumes every sub-buffer is of page size. This is no longer the case. Use the actual sub-buffer size when calculating how much memory will be used. - Reject non-stack fields for synthetic stacktrace fields Stack traces are special fields and the checks currently do not do enough to make sure that the fields being processed as stack traces are indeed stack traces. Update the logic to properly detect what is or is not a stack trace. - Fix a crash in print_graph_function_event() When a tracer does not define static or default flags the tr->current_trace_flags is set to NULL. If the ring buffer is not cleared when switching tracers, the previous tracers events could be read. The function_graph entries will dereference the tr->current_trace_flags and cause a crash. Set the tr->current_trace_flags to a empty set of flags to prevent it from being NULL. - Separate tracing filter predicate count from allocation The amount allocated for the predicate program is the number of predicates defined plus two for adding "true" and "false" at the end. The nr_preds is incremented by two to accommodate the booleans but is then used as the limit check for number of predicates. This is incorrect as it is now two higher than what is expected. Use a separate variable for the size of the predicate array. - Fix the filter operator stack check The operator stack increments the pointer and then writes the content onto the stack. The check for overflow compared the current pointer to see if it was greater than the stack size before doing so. This is an off by 2 error as the write will be at the size - 1 and the compare is done before the increment. Adjust the check accordingly. * tag 'trace-v7.3-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace: tracing: Check operator stack capacity before pushing tracing: Keep the predicate limit separate from program capacity tracing: Fix crash in print_graph_function_event() tracing/histograms: Reject non-stacktrace fields for synthetic stacktrace fields ring-buffer: Use subbuf_order in available memory estimation ring-buffer: Skip si_mem_available() for persistent and remote buffers eventfs: Free the eventfs_inode after an rcu grace period too tracing: Do not initialize tracefs work if tracing is disabled tracing: Fix hist trigger timestamps for buffered events tracing: Fix ignored return value of resize_buffer_duplicate_size() ring-buffer: Fix false warning in ring_buffer_map_get_reader() tracing: Fix simple_ring_buffer undef check on sparc64 tracing: Fix simple_ring_buffer undef check on parisc tracing: Fix empty symbol names in simple_ring_buffer undef check ring-buffer: Fix the sub-buffer array base in rb_meta_subbuf_idx() tracing: Fix the shift out of bounds in the log2 histogram modifier ring-buffer: Do not show buffer_meta for CPUs without a buffer tracing: Take trace_types_lock when dropping the buffer_meta reference tracing: Fix NULL dereference when copying keys for a field variable	2026-10-16 14:27:22 -10:00
Yuan Chen	2d1f101ee6	bpf: Claim the per-CPU send_signal irq_work before filling it ... irq_work_is_busy() cannot see the per-CPU send_signal_work while it is being filled: the check only matches after irq_work_queue() has claimed the work. A concurrent caller therefore passes it, both callers race for the same irq_work, and the loser's signal is silently lost along with its task reference while the queued work runs with a mix of both callers' fields. kprobe, tracepoint and perf_event programs exclude each other on the same CPU through bpf_prog_active, so for two callers to meet, one of the programs has to be a raw tracepoint or an fentry one. And since commit 87c544108b ("bpf: Send signals asynchronously if !preemptible") this path runs with IRQs enabled too, so a hard IRQ can interrupt the fill as well, not only an NMI. Found by code inspection and reproduced with a perf_event NMI program racing an fentry one. Claim the work through work->task itself: cmpxchg() it from NULL to the target task before touching the other fields, and set it back to NULL once the callback has consumed them. A context finding the work claimed returns the documented -EBUSY. Fixes: 1bc7896e9e ("bpf: Fix deadlock with rq_lock in bpf_send_signal()") Signed-off-by: Yuan Chen <chenyuan@kylinos.cn> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20261009022427.968304-1-chenyuan@kylinos.cn	2026-10-16 18:41:07 +00:00
Donggeun Yoo	d5c42664fc	tracing: Save the event file instead of the compatible histogram ... create_field_var_hist() creates a histogram on the matched event to supply a field variable, and records it on the target so it can be torn down later: hist_data = find_compatible_hist(target_hist_data, file); ... /* Save the compatible histogram information */ var_hist->hist_data = hist_data; hist_data is not the histogram it creates. It is one that was already there, whose keys the new one copies. The saved pointer has a single user, unregister_field_var_hists(), which runs when the target is removed: file = hist_data->field_var_hists[i]->hist_data->event_file; find_compatible_hist() matches on keys alone, so it can pick one with no variables of its own. check_var_refs() then returns false and the user can remove it while the target still points at it: BUG: KASAN: slab-use-after-free in event_hist_trigger_free+0x2b2/0x320 Read of size 8 at addr ffff8880093b90e0 by task init/1 Freed by task 1: kfree+0x154/0x420 event_hist_trigger_free+0x1d5/0x320 event_hist_trigger_parse+0x35f3/0x69e0 trigger_process_regex+0x1a6/0x250 Save the event file instead. It is all the dereference ever wanted, and it does not go away when the user removes a trigger. Cc: stable@vger.kernel.org Reported-by: Sashiko <sashiko-bot@kernel.org> Link: https://lore.kernel.org/all/20260914110753.221E61F000FF@smtp.kernel.org/ Link: https://patch.msgid.link/20260914234754.3676905-1-donggeunyoo.kernel@gmail.com Fixes: 02205a6752 ("tracing: Add support for 'field variables'") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Assisted-by: Claude:claude-fable-5 Acked-by: Tom Zanussi <zanussi@kernel.org> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-16 14:00:46 -04:00
David Carlier	5a6bd62f09	tracing: Hold trace_types_lock when resetting last boot data from readers ... update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_read() without trace_types_lock. Two readers can both pass the LAST_BOOT test and free module_delta twice, and a module notifier can update module_delta while it is being freed. Take trace_types_lock in those paths and keep the callers that already hold it on an unlocked variant. Cc: stable@vger.kernel.org Fixes: 32dc004252 ("tracing: Reset last-boot buffers when reading out all cpu buffers") Link: https://patch.msgid.link/20261016061638.214847-2-devnexen@gmail.com Signed-off-by: David Carlier <devnexen@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-16 11:40:17 -04:00
David Carlier	66877a312a	tracing: Hold trace_types_lock when updating modules in persistent instances ... trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent rmdir of an instance removes it from the list and frees it under that lock, so a module load or unload can walk into a freed trace_array. Cc: stable@vger.kernel.org Fixes: 5f3719f697 ("tracing: Update modules to persistent instances when loaded") Link: https://patch.msgid.link/20261016061638.214847-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-16 11:40:05 -04:00
Haoran Wang	097fd00500	tracing/syscalls: Use copy_from_user for the faultable syscall buffer ... syscall_copy_user_array() copies the buffer argument of faultable syscalls (write, pwrite64, ...) with __copy_from_user(), which skips access_ok(). Use copy_from_user() instead so a non-user address is rejected and the entry is recorded as faulted. It could be a security concern for machines that trust perf a bit too much. Cc: stable@vger.kernel.org Fixes: baa031b7bd ("tracing: Allow syscall trace events to read more than one user parameter") Link: https://patch.msgid.link/6ad19afd.a938ce27.16851e.3440@mx.google.com Signed-off-by: Haoran Wang <haoranwangsec@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-16 11:36:30 -04:00
Yun Zhou	1054e526ce	ftrace: Add max field to function profiler stats ... The function profiler (trace_stat/function<cpu>) reports Hit, Time, Avg and s^2 per function. Add a "max" field recording the maximum single-call duration, which is valuable for real-time tuning and for investigating occasional latency spikes. Like Time/Avg, it honors the graph-time and sleep-time options, so it reflects entry-to-return wall-clock latency. Link: https://patch.msgid.link/20260924030108.2673654-1-yun.zhou@windriver.com Signed-off-by: Yun Zhou <yun.zhou@windriver.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 20:12:49 -04:00
Donggeun Yoo	d3e0dfc1ba	tracing: Print a signed histogram key as signed ... A histogram sorts its rows by the key named in sort=, and for a key over a signed event field it sorts them signed: create_tracing_map_fields() picks the comparison function with else cmp_fn = tracing_map_cmp_num(field->size, field->is_signed); hist_trigger_print_key() does not look at is_signed at all. Every numeric key is printed with %llu, so a sorted histogram over a signed field comes out looking unsorted. syscalls/sys_exit_lseek carries "long ret", which SYSCALL_FIELD() marks signed and which is negative on every error: # echo 'hist:keys=ret:sort=ret' > events/syscalls/sys_exit_lseek/trigger # echo 1 > events/syscalls/sys_exit_lseek/enable # (five lseek(2) calls returning -ESPIPE, -EINVAL, -EBADF, 0 and 100) # cat events/syscalls/sys_exit_lseek/hist { ret: 18446744073709551587 } hitcount: 1 { ret: 18446744073709551594 } hitcount: 1 { ret: 18446744073709551607 } hitcount: 1 { ret: 0 } hitcount: 1 { ret: 100 } hitcount: 1 The rows are in ascending order and the numbers are not, because the three leading ones are -29, -22 and -9 rendered as their two's complement. Take the rendering from the same place the sort order comes from: the event field when the key has one, and the hist_field itself when it does not. The same histogram then reads { ret: -29 } hitcount: 1 { ret: -22 } hitcount: 1 { ret: -9 } hitcount: 1 { ret: 0 } hitcount: 1 { ret: 100 } hitcount: 1 A ".buckets" key stays unsigned here, and not because it is right. hist_field_bucket() divides as unsigned, so the group holding S64_MAX also holds S64_MIN, reported at https://lore.kernel.org/all/20260914054614.82A9B1F000FF@smtp.kernel.org/ Printing that group signed would name a range that does not contain S64_MIN, so the grouping has to be fixed with it, in a patch of its own. Link: https://patch.msgid.link/20260917045918.370993-1-donggeunyoo.kernel@gmail.com Fixes: 7ef224d1d0 ("tracing: Add 'hist' event trigger command") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 20:06:53 -04:00
Donggeun Yoo	443d231768	tracing: Fix 64-bit and signed histogram fields on 32-bit kernels ... DEFINE_HIST_FIELD_FN() reads a trace event field and widens it to the u64 the histogram uses as a key or a value: type *addr = (type *)(event + hist_field->field->offset); return (u64)(unsigned long)*addr; unsigned long is 32 bits on a 32-bit kernel, so the intermediate cast discards the upper half of a 64-bit field, and widens a signed field by zero extension from 32 bits rather than sign extension from its own width. Five of the eight instantiations are wrong there: s64, u64, s32, s16 and s8. The cast came in with commit 79e577cbce ("tracing: Support string type key properly"), which also added hist_field_dynstring() and hist_field_pstring(). Those convert a char * to u64 and do warn without an unsigned long in between on 32-bit. DEFINE_HIST_FIELD_FN() converts an integer and never a pointer, so it gains nothing from the cast and only loses information. Drop the intermediate cast and let the usual arithmetic conversions widen *addr according to its own type. unsigned long is 64 bits on LP64, so the two forms are identical there and 64-bit kernels are unaffected. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260917015532.103081-1-donggeunyoo.kernel@gmail.com Fixes: 79e577cbce ("tracing: Support string type key properly") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260914054614.82A9B1F000FF@smtp.kernel.org/ Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 19:59:35 -04:00
David Carlier	453d0f47b1	ring-buffer: Take cpus_read_lock() when changing the subbuf order ... A CPU coming online for the first time gets its per CPU buffer allocated by trace_rb_cpu_prepare(), which then adds it to buffer->cpumask. If that happens while ring_buffer_subbuf_order_set() is running, the CPU shows up after the allocation loop and the install loop walks it with an empty new_pages list, corrupting the buffer. Take cpus_read_lock() as ring_buffer_resize() does. Cc: stable@vger.kernel.org Fixes: f9b94daa54 ("ring-buffer: Set new size of the ring buffer sub page") Link: https://patch.msgid.link/20260916192628.274136-1-devnexen@gmail.com Signed-off-by: David Carlier <devnexen@gmail.com> Reviewed-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 19:53:48 -04:00
Vincent Donnefort	9dce3e2d1f	ring-buffer: Remove unnecessary cpumask_test_cpu ... for_each_buffer_cpu() already iterates over buffer->cpumask. Remove the unnecessary cpumask_test_cpu() found in ring_buffer_subbuf_order_set(). Link: https://patch.msgid.link/20260916152813.105082-3-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 19:51:42 -04:00
Vincent Donnefort	9fd830120f	ring-buffer: Clean up resize_disabled checks ... ring_buffer_subbuf_order_set() checks for resize_disabled twice under the same buffer->mutex hold. Moreover, this check duplicates the logic in ring_buffer_resize(). Create a common helper rb_resize_disabled() to factor out this code. Link: https://patch.msgid.link/20260916152813.105082-2-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 19:51:42 -04:00
pengdonglin	2557f93014	fgraph: Enhance funcgraph-retval with BTF-based type-aware output ... The current funcgraph-retval implementation suffers from two accuracy issues: 1. Void-returning functions still print a return value, creating misleading noise in the trace output. 2. For functions returning narrower types (e.g., char, short), the displayed value can be incorrect because high bits of the register may contain undefined data. This patch addresses both problems by leveraging BTF to obtain the exact return type of each traced kernel function. The key changes are: 1. Void function filtering: Functions with void return type no longer display any return value in the trace output, eliminating unnecessary clutter. 2. Type-aware value formatting: The return value is now properly truncated to match the actual width of the return type before being displayed. Additionally, the value is formatted according to its type for better human readability. Here is an output comparison: Before: # perf ftrace -G vfs_read --graph-opts retval ... 1) | touch_atime() { 1) | atime_needs_update() { 1) 0.069 us | make_vfsuid(); /* ret=0x0 */ 1) 0.067 us | make_vfsgid(); /* ret=0x0 */ 1) | current_time() { 1) 0.197 us | ktime_get_coarse_real_ts64_mg(); /* ret=0x187f886aec3ed6f5 */ 1) 0.352 us | } /* current_time ret=0x69380753 */ 1) 0.792 us | } /* atime_needs_update ret=0x0 */ 1) 0.937 us | } /* touch_atime ret=0x0 */ After: # perf ftrace -G vfs_read --graph-opts retval ... 2) | touch_atime() { 2) | atime_needs_update() { 2) 0.070 us | make_vfsuid(); /* ret=0x0 */ 2) 0.070 us | make_vfsgid(); /* ret=0x0 */ 2) | current_time() { 2) 0.162 us | ktime_get_coarse_real_ts64_mg(); 2) 0.312 us | } /* current_time ret=0x69380649(trunc) */ 2) 0.753 us | } /* atime_needs_update ret=false */ 2) 0.899 us | } /* touch_atime */ Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Xiaoqin Zhang <zhangxiaoqin@xiaomi.com> Link: https://patch.msgid.link/20260916133218.1282590-4-dolinux.peng@gmail.com Signed-off-by: pengdonglin <pengdonglin@xiaomi.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:54:49 -04:00
pengdonglin	ba0ec74274	ftrace: Build trace_btf.c when CONFIG_DEBUG_INFO_BTF is enabled ... The trace_btf.c file provides BTF helper functions used by the ftrace subsystem. Make the compilation of trace_btf.c solely depend on CONFIG_DEBUG_INFO_BTF, allowing features like funcgraph-retval to also utilize these helpers. Additionally, the redundant dependency on CONFIG_PROBE_EVENTS_BTF_ARGS is removed, as CONFIG_DEBUG_INFO_BTF already depends on CONFIG_BPF_SYSCALL. Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Xiaoqin Zhang <zhangxiaoqin@xiaomi.com> Link: https://patch.msgid.link/20260916133218.1282590-3-dolinux.peng@gmail.com Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org> Signed-off-by: pengdonglin <pengdonglin@xiaomi.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:52:53 -04:00
pengdonglin	42643ba35d	tracing: Avoid BTF lookup in atomic context ... The function graph trace formatter can be called from ftrace_dump_one() with interrupts disabled. When ftrace_dump_on_oops is enabled, the trace panic notifier can reach ftrace_dump() from the panic path, including the nmi_panic() path used by the hard lockup detector. btf_find_func_proto() calls bpf_find_btf_id(), which may initialize vmlinux BTF under a mutex. Skip the BTF lookup when running in an atomic context or with interrupts disabled, and fall back to the existing return value formatting. Link: https://patch.msgid.link/20260916133218.1282590-2-dolinux.peng@gmail.com Fixes: ebeed8d4a5 ("tracing/probes: Move finding func-proto API and getting func-param API to trace_btf") Signed-off-by: pengdonglin <pengdonglin@xiaomi.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:52:53 -04:00
Donggeun Yoo	289e2a775d	tracing: Clamp the printed end of a histogram bucket at U64_MAX ... A key with the ".buckets=N" modifier is stored as the start of its bucket, and hist_trigger_print_key() prints the range it covers as start to start + N - 1. That addition overflows once the start is within N of U64_MAX: # echo 'hist:keys=offset.buckets=10' >> \ events/syscalls/sys_enter_lseek/trigger # ./seeker 5 -1 # lseek(0, 5) and lseek(0, -1) # cat events/syscalls/sys_enter_lseek/hist ... { offset: ~ 18446744073709551610-3 } hitcount: 1 { offset: ~ 0-9 } hitcount: 1 ... 18446744073709551610 + 10 - 1 does not fit in 64 bits, so the range ends below where it starts. The bucket does end at U64_MAX: it holds every value hist_field_bucket() maps onto its start, and there is no value above U64_MAX. Clamp the printed end there. Printed honestly the group is shorter than the size asked for, which histogram.rst does not mention, so say it there. Link: https://patch.msgid.link/20260914132346.2234731-1-donggeunyoo.kernel@gmail.com Fixes: de9a48a360 ("tracing: Add linear buckets to histogram logic") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Assisted-by: Claude:claude-fable-5 Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:44:16 -04:00
Donggeun Yoo	91c14d6c13	tracing: Unregister field variable histograms when the command fails ... An action that names a field on another event needs that field as a variable, so create_field_var_hist() registers a second hist trigger on that event to provide it, and records it in target_hist_data->field_var_hists[]. If a later part of the same command fails, create_actions() returns an error and event_hist_trigger_parse() jumps to out_free. The write fails with -EINVAL and sched_switch gets no trigger, but: # echo 'hist:keys=pid:ts0=common_timestamp.usecs' >> \ events/sched/sched_waking/trigger # echo 'my_synth u64 lat; int a; int b' >> synthetic_events # echo 'hist:keys=next_pid:wakeup_lat=common_timestamp.usecs-$ts0:\ onmatch(sched.sched_waking).my_synth($wakeup_lat,prio,nosuchfld)'\ >> events/sched/sched_switch/trigger # cat events/sched/sched_waking/trigger hist:keys=pid:vals=hitcount:ts0=common_timestamp.usecs:sort=hitcount:size=2048:clock=global [active] hist:keys=pid:vals=hitcount:synthetic_prio=prio:sort=hitcount:size=2048 [active] The second histogram is the one created for 'prio'. It is still active and still counting. out_free reaches destroy_field_var_hists(), which frees the field_var_hists[] entries, but never unregister_field_var_hists(), which is what removes the triggers and runs only from event_hist_trigger_free(). The entry is freed and the trigger is left with nothing tracking it. Unregister the field variable histograms in out_free as well, and record each one as soon as its trigger is registered rather than after the lookup that follows it, so no exit can leave a registered trigger untracked. The entry then belongs to field_var_hists[] and is released by destroy_field_var_hists(), so freeing it on that exit would be a double free. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260914104036.1768529-1-donggeunyoo.kernel@gmail.com Fixes: 02205a6752 ("tracing: Add support for 'field variables'") Reported-by: sashiko-bot@kernel.org Closes: https://lore.kernel.org/all/20260913204302.DB2551F000FF@smtp.kernel.org/ Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Assisted-by: Claude:claude-fable-5 Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:42:38 -04:00
Donggeun Yoo	18bb005845	tracing: Only report the stacktrace modifier on a real field ... get_hist_field_flags() returns "stacktrace" for any field carrying HIST_FIELD_FL_STACKTRACE, including the common_stacktrace pseudo-field, which has no ftrace_event_field behind it. parse_field() no longer takes the modifier there: if (stack_modifier && (!field || field->filter_type != FILTER_STACKTRACE)) { hist_err(tr, HIST_ERR_BAD_FIELD_MODIFIER, errpos(field_str)); so expr_field_str() renders "common_stacktrace.stacktrace", a spelling that cannot be parsed back. Report the modifier only when there is a field to report it for. hist_field_print(), the other caller of get_hist_field_flags(), excludes HIST_FIELD_FL_STACKTRACE before it calls, so this is confined to expr_field_str(), whose only key renderer arrives in the next patch. Link: https://patch.msgid.link/20260914053443.981201-4-donggeunyoo.kernel@gmail.com Fixes: a5e70ba87c ("tracing: Fix memory corruption from the histogram stacktrace modifier") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Assisted-by: Claude:claude-fable-5 Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:40:28 -04:00
Donggeun Yoo	c027ed03bc	tracing: Add the bucket size to expr_field_str() ... expr_field_str() renders a HIST_FIELD_FL_BUCKET field as "pid.buckets", dropping the count, and parse_field() rejects that spelling. get_hist_field_flags() returns the bare string "buckets" and keeps the count in hist_field->buckets. hist_field_print() appends it, expr_field_str() never did. Nothing reaches it today, since .buckets is refused on a value and no expression can carry one, but the next patch renders histogram keys with expr_field_str(), where a .buckets key is legal. Append the count, as hist_field_print() does. Cc: stable@vger.kernel.org Link: https://patch.msgid.link/20260914053443.981201-3-donggeunyoo.kernel@gmail.com Fixes: de9a48a360 ("tracing: Add linear buckets to histogram logic") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Assisted-by: Claude:claude-fable-5 Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:40:28 -04:00
Donggeun Yoo	387945e8d2	tracing: Print the bucket size as unsigned ... A key's bucket size reads back negative once it exceeds LONG_MAX: # echo 'hist:keys=next_pid.buckets=18446744073709551615' > trigger # cat trigger hist:keys=next_pid.buckets=-1:vals=hitcount:... parse_field() takes the size with kstrtoul() and rejects only zero, so the whole unsigned long range is accepted and stored, but hist_field_print() renders it with %ld. Print it with %lu. Link: https://patch.msgid.link/20260914053443.981201-2-donggeunyoo.kernel@gmail.com Fixes: de9a48a360 ("tracing: Add linear buckets to histogram logic") Signed-off-by: Donggeun Yoo <donggeunyoo.kernel@gmail.com> Assisted-by: Claude:claude-fable-5 Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:40:28 -04:00
Vincent Donnefort	20d432b445	ring-buffer: Unify ring buffer minimum page calculations ... The codebase scatters hardcoded minimum page limits across multiple places. Introduce RING_BUFFER_MIN_NR_PAGES and rb_calculate_nr_pages() to formalize the requirement of two pages in a ring buffer. Link: https://patch.msgid.link/20260911193937.602202-4-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:31:09 -04:00
Vincent Donnefort	c28bf729dd	tracing: Rename tracing_entries_fops to tracing_capacity_fops ... Since commit 8a5f636378 ("ring-buffer: Fix subbuf resize race with ring buffer readers"), "capacity" refers to the memory available for events, while "entries" refers to the number of events in a ring buffer. As a consequence, rename trace_array::entries to capacity to align with this convention. While at it, rename also tracing_total_entries_fops. It is the aggragate of all ring buffer capacities. Link: https://patch.msgid.link/20260908090937.838544-4-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:28:41 -04:00
Vincent Donnefort	e41338909f	tracing: Rename trace_array::entries to capacity ... Since commit 8a5f636378 ("ring-buffer: Fix subbuf resize race with ring buffer readers"), "capacity" refers to the memory available for events, while "entries" refers to the number of events in a ring buffer. As a consequence, rename trace_array::entries to capacity to align with this convention and avoid any confusion. Rename also the helper functions trace_set_buffer_entries and update_buffer_entries. Link: https://patch.msgid.link/20260908090937.838544-3-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:28:41 -04:00
Vincent Donnefort	4b0c4fb9bc	ring-buffer: Rename ring_buffer_size() to ring_buffer_capacity() ... Since commit 8a5f636378 ("ring-buffer: Fix subbuf resize race with ring buffer readers"), "capacity" refers to the memory available for events (excluding subbuffer headers) while "size" refers to the raw allocation. ring_buffer_size() actually calculates this event capacity. Rename it to ring_buffer_capacity() to align with this convention. Link: https://patch.msgid.link/20260908090937.838544-2-vdonnefort@google.com Signed-off-by: Vincent Donnefort <vdonnefort@google.com> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:28:41 -04:00
Thomas Weißschuh	084100a1b5	tracing: Parse filter from boot event string ... Make it possible to specify a trace event filter from the kernel command line. Example: trace_event=syscalls:sys_enter_clock_nanosleep:filter:which_clock==0 Link: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-7-05396a3fb663@linutronix.de Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:23:35 -04:00
Thomas Weißschuh	d30778dee4	tracing: Add a filter argument to __ftrace_set_clr_event() ... Make it possible to directly enable a filter when enabling an event. For now this is unused, an upcoming patch will wire it up. Link: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-6-05396a3fb663@linutronix.de Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:23:35 -04:00
Thomas Weißschuh	cc879c2b6c	tracing: Add a test for ftrace_parse_event_string() ... The parsing logic is a bit complicated and about to become more so. Add a unit test to avoid regressions. Link: https://patch.msgid.link/20260908-tracing-cli-event-filter-v2-5-05396a3fb663@linutronix.de Signed-off-by: Thomas Weißschuh <thomas.weissschuh@linutronix.de> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>	2026-10-15 18:23:35 -04:00