Re: [PATCH] ring-buffer: Fix possible dereference of uninitialized pointer

[Google]

On Fri, 13 Feb 2026 13:01:30 +0300
Daniil Dulov <d.dulov@xxxxxxxxxx> wrote:

> There is a pointer head_page in rb_meta_validate_events() which is not
> initialized at the beginning of a function. This pointer can be dereferenced
> if there is a failure during reader page validation. In this case the control
> is passed to "invalid" label where the pointer is dereferenced in a loop.
> 
> To fix the issue initialize orig_head and head_page before calling
> rb_validate_buffer.
> 
> Found by Linux Verification Center (linuxtesting.org) with SVACE.
> 

Looks good to me.

Acked-by: Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>

Thanks!

> Reported-by: kernel test robot <lkp@xxxxxxxxx>
> Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx>
> Closes: https://lore.kernel.org/r/202406130130.JtTGRf7W-lkp@xxxxxxxxx/
> Fixes: 5f3b6e839f3c ("ring-buffer: Validate boot range memory events")
> Signed-off-by: Daniil Dulov <d.dulov@xxxxxxxxxx>
> ---
>  kernel/trace/ring_buffer.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
> index 630221b00838..ad08430347b0 100644
> --- a/kernel/trace/ring_buffer.c
> +++ b/kernel/trace/ring_buffer.c
> @@ -1918,6 +1918,8 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
>  	if (!meta || !meta->head_buffer)
>  		return;
>  
> +	orig_head = head_page = cpu_buffer->head_page;
> +
>  	/* Do the reader page first */
>  	ret = rb_validate_buffer(cpu_buffer->reader_page->page, cpu_buffer->cpu);
>  	if (ret < 0) {
> @@ -1928,7 +1930,6 @@ static void rb_meta_validate_events(struct ring_buffer_per_cpu *cpu_buffer)
>  	entry_bytes += local_read(&cpu_buffer->reader_page->page->commit);
>  	local_set(&cpu_buffer->reader_page->entries, ret);
>  
> -	orig_head = head_page = cpu_buffer->head_page;
>  	ts = head_page->page->time_stamp;
>  
>  	/*
> -- 
> 2.34.1
> 
> 


-- 
Masami Hiramatsu (Google) <mhiramat@xxxxxxxxxx>