github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
f4f2bba28d
linux/kernel/trace
History
Hui Su 91542863ab ring-buffer: Fix crash passing ERR_PTR to kthread_stop() 
In test_ringbuffer()'s out_free cleanup loop, the check
`!rb_threads[cpu]` only catches NULL entries and misses entries that
hold an ERR_PTR.

rb_threads[] is static, so unassigned slots are NULL. But when
kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or
-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.
That entry is non-NULL, so the old `!ptr` check does not break, and the
cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()
then dereferences the bogus pointer, crashing the kernel during the
late_initcall self-test.

crash logs:
  BUG: kernel NULL pointer dereference, address: 000000000000001c
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)
  RIP: 0010:kthread_stop+0x2e/0x220
  RBX: fffffffffffffff4
  CR2: 000000000000001c
  Call Trace:
   <TASK>
   test_ringbuffer+0x1ec/0x650
   do_one_initcall+0x6c/0x2c0
   kernel_init_freeable+0x21d/0x420
   kernel_init+0x15/0x1c0
   ret_from_fork+0x21b/0x320
   </TASK>
  Kernel panic - not syncing: Fatal exception

Cc: stable@vger.kernel.org
Fixes: 64ed3a049e ("ring-buffer: make use of the helper function kthread_run_on_cpu()")
Link: https://patch.msgid.link/20260807154145.2846521-2-sh_def@163.com
Signed-off-by: Hui Su <sh_def@163.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
2026-08-08 22:26:30 -04:00
..
rv rv: Use 0 to check preemption enabled in opid 2026-06-03 12:33:25 +02:00
blktrace.c block-7.0-20260305 2026-03-06 08:36:18 -08:00
bpf_trace.c bpf: Add missing access_ok call to copy_user_syms 2026-06-21 18:01:33 -07:00
bpf_trace.h
error_report-traces.c
fgraph.c fgraph: Do not call handlers direct when not using ftrace_ops 2026-02-19 15:21:22 -05:00
fprobe.c fprobe: Fix module reference count leak on error in register_fprobe() 2026-07-29 22:50:02 +09:00
ftrace_internal.h
ftrace.c ftrace: Fix off-by-one fentry site disable in ftrace_free_mem() 2026-08-08 22:22:41 -04:00
Kconfig ring-buffer: Add persistent ring buffer invalid-page inject test 2026-05-28 22:40:51 -04:00
kprobe_event_gen_test.c
Makefile tracing: Updates for v7.2: 2026-06-18 20:53:00 -07:00
pid_list.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
pid_list.h trace/pid_list: optimize pid_list->lock contention 2025-11-13 15:15:54 -05:00
power-traces.c
preemptirq_delay_test.c
remote_test_events.h tracing: Add a trace remote module for testing 2026-03-09 12:33:55 -04:00
remote_test.c tracing: Fix desc in error path for the trace remote test module 2026-05-16 16:11:04 -04:00
rethook.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
ring_buffer_benchmark.c tracing: Fix typo in ring_buffer_benchmark.c 2025-12-05 15:43:40 -05:00
ring_buffer.c ring-buffer: Fix crash passing ERR_PTR to kthread_stop() 2026-08-08 22:26:30 -04:00
rpm-traces.c
simple_ring_buffer.c tracing: Fix unload_page for simple_ring_buffer init rollback 2026-05-21 08:26:22 -04:00
synth_event_gen_test.c
trace_benchmark.c
trace_benchmark.h
trace_boot.c tracing: Make the backup instance non-reusable 2026-04-02 13:20:38 -04:00
trace_branch.c tracing/branch: Use pr_warn() instead of printk(KERN_WARNING) 2026-05-21 18:03:08 -04:00
trace_btf.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_btf.h
trace_clock.c
trace_dynevent.c tracing: Report wrong dynamic event command 2025-11-10 19:26:14 -05:00
trace_dynevent.h
trace_entries.h tracing: Fix ftrace event field alignments 2026-02-05 09:47:11 -05:00
trace_eprobe.c tracing/eprobe: Fix exact system name matching in eprobe_dyn_event_match() 2026-07-21 10:23:21 +09:00
trace_event_perf.c perf/ftrace: Fix WARNING in __unregister_ftrace_function 2026-05-29 11:27:40 -04:00
trace_events_filter_test.h
trace_events_filter.c tracing/filters: Fix false positive match in regex_match_full() 2026-07-29 14:32:11 -04:00
trace_events_hist.c tracing: Fix use-after-free freeing trigger private data 2026-07-24 18:49:51 -04:00
trace_events_inject.c
trace_events_synth.c tracing/synthetic: Free type string on error path 2026-07-07 13:59:55 -04:00
trace_events_trigger.c tracing: Delay module ref count for "enable_event" trigger 2026-07-24 18:49:51 -04:00
trace_events_user.c tracing/user_events: Fix use-after-free in user_event_mm_dup() 2026-07-07 13:59:35 -04:00
trace_events.c tracing: Check return value of __register_event() in trace_module_add_events() 2026-07-29 14:32:11 -04:00
trace_export.c tracing: Fix ftrace event field alignments 2026-02-05 09:47:11 -05:00
trace_fprobe.c tracing/fprobe: Roll back on enable_trace_fprobe() failure 2026-07-29 00:27:52 +09:00
trace_functions_graph.c fgraph: Fix thresh_return nosleeptime double-adjust 2026-03-03 22:11:20 -05:00
trace_functions.c tracing: Fix NULL pointer dereference in func_set_flag() 2026-07-07 10:42:28 -04:00
trace_hwlat.c tracing: Fix false sharing in hwlat get_sample() 2026-02-10 03:36:39 -05:00
trace_irqsoff.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_kdb.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_kprobe_selftest.c
trace_kprobe_selftest.h
trace_kprobe.c tracing updates for v7.1: 2026-04-17 09:43:12 -07:00
trace_mmiotrace.c tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions 2026-07-29 14:27:55 -04:00
trace_nop.c
trace_osnoise.c tracing/osnoise: Call synchronize_rcu() when unregistering 2026-07-06 14:56:18 -04:00
trace_output.c tracing updates for v7.1: 2026-04-17 09:43:12 -07:00
trace_output.h tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_pid.c tracing: Move pid filtering into trace_pid.c 2026-02-08 21:01:13 -05:00
trace_preemptirq.c tracing: Add a no-rcu-check version of trace_##event##_enabled() 2026-07-07 10:42:29 -04:00
trace_printk.c tracing: move __printf() attribute on __ftrace_vbprintk() 2026-03-23 20:16:45 -04:00
trace_probe_kernel.h
trace_probe_tmpl.h
trace_probe.c tracing/probes: Reject $arg0 in meta argument expansion 2026-07-28 23:58:31 +09:00
trace_probe.h tracing: probes: fix typo in a log message 2026-06-25 08:34:45 +09:00
trace_recursion_record.c tracing: Switch trace_recursion_record.c code over to use guard() 2026-05-21 18:03:07 -04:00
trace_remote.c tracing: Propagate errors from remote event bulk updates 2026-07-23 12:30:07 -04:00
trace_sched_switch.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_sched_wakeup.c tracing: Allow tracer to add more than 32 options 2025-11-04 21:44:00 +09:00
trace_selftest_dynamic.c
trace_selftest.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_seq.c tracing: Add bitmask-list option for human-readable bitmask display 2026-01-26 17:00:50 -05:00
trace_snapshot.c tracing: Remove duplicate latency_fsnotify() stub 2026-03-31 14:58:39 -04:00
trace_stack.c
trace_stat.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
trace_stat.h
trace_synth.h
trace_syscalls.c tracing: perf: Fix stale head for perf syscall tracing 2026-07-24 22:57:56 -04:00
trace_uprobe.c tracing: Replace BUG_ON with lockdep_assert_held in uprobe_buffer functions 2026-06-01 23:35:21 +09:00
trace.c ftrace: Drop extra comma in trace_buffered_event_enable 2026-08-08 11:21:32 -04:00
trace.h tracing: Fix use-after-free freeing trigger private data 2026-07-24 18:49:51 -04:00
tracing_map.c tracing: Simplify pages allocation for tracing_map logic 2026-05-21 18:12:10 -04:00
tracing_map.h tracing: Simplify pages allocation for tracing_map logic 2026-05-21 18:12:10 -04:00
undefsyms_base.c tracing: Make undefsyms_base.c a first-class citizen 2026-04-22 11:24:41 -04:00