Re: [for-linus][PATCH 05/13] ring_buffer: Check page order under reader_lock

[Steven Rostedt]

On Tue, 07 Jul 2026 09:46:09 -0400
Steven Rostedt <rostedt@xxxxxxxxxx> wrote:

> From: Yash Suthar <yashsuthar983@xxxxxxxxx>
> 
> When the ring_buffer_subbuf_order_set() is called the same time as the
> ring_buffer_read_page(), the wrong buffer->subbuf_size can be used as
> there is nothing keeping that in sync. This can cause an incorrect
> allocation and initialization that can cause a crash.
> 
> Move the saving of the subbuf_size into a variable within the
> cpu_buffer->reader_lock, and use that throughout the function.
> The size only needs to be consistent throughout the allocation and
> initialization. If the buffer->subbuf_size changes when used, the reader
> data page will be found to be invalid and the read function will return an
> error (this is as expected).
> 
> syzbot did not provide a reproducer for this crash, the race
> condition is logically sound and found via code inspection of the
> trace.
> 
> Cc: stable@xxxxxxxxxxxxxxx
> Link: https://patch.msgid.link/20260611151736.255767-1-yashsuthar983@xxxxxxxxx
> Fixes: bce761d75745 ("ring-buffer: Read and write to ring buffers with custom sub buffer size")
> Reported-by: syzbot+2dd9d02f60775ce5c1fb@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=2dd9d02f60775ce5c1fb
> Signed-off-by: Yash Suthar <yashsuthar983@xxxxxxxxx>
> [ Rebased to 7.2-rc2 ]
> Signed-off-by: Steven Rostedt <rostedt@xxxxxxxxxxx>

I'm actually dropping this. It's not enough, and there is work to fix it
properly:

  https://lore.kernel.org/all/20260628004653.28065-1-alhouseenyousef@xxxxxxxxx/

-- Steve