[PATCH v2] ring-buffer: Take cpus_read_lock() when changing the subbuf order
From: David Carlier
Date: Wed Sep 16 2026 - 16:41:11 EST
A CPU coming online for the first time gets its per CPU buffer allocated
by trace_rb_cpu_prepare(), which then adds it to buffer->cpumask. If that
happens while ring_buffer_subbuf_order_set() is running, the CPU shows up
after the allocation loop and the install loop walks it with an empty
new_pages list, corrupting the buffer.
Take cpus_read_lock() as ring_buffer_resize() does.
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: David Carlier <devnexen@xxxxxxxxx>
---
Notes:
v2:
- Reword the changelog: offlined CPUs stay in ->cpumask, so only a CPU
coming online for the first time can appear mid-flight (Vincent)
- Drop the comment above guard(cpus_read_lock)() (Vincent)
v1: https://lore.kernel.org/linux-trace-kernel/20260914182850.21449-1-devnexen@xxxxxxxxx/
kernel/trace/ring_buffer.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 04bb94c29f58..e78fb4bb2195 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7464,6 +7464,8 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)
if (psize > RB_WRITE_MASK + 1)
return -EINVAL;
+ guard(cpus_read_lock)();
+
/* prevent another thread from changing buffer sizes */
guard(mutex)(&buffer->mutex);
--
2.55.0