[GIT PULL] tracing: More fixes for 7.0

From: Steven Rostedt

Date: Sat Mar 07 2026 - 10:33:10 EST



Linus,

tracing fixes for 7.0:

- Fix possible NULL pointer dereference in trace_data_alloc()

On the error path in trace_data_alloc(), it can call trigger_data_free()
with a NULL pointer. This use to be a kfree() but was changed to
trigger_data_free() to clean up any partial initialization. The issue is
that trigger_data_free() does not expect a NULL pointer. Have
trigger_data_free() return safely on NULL pointer.

- Fix multiple events on the command line and bootconfig

If multiple events are enabled on the command line separately and not
grouped, only the last event gets enabled. That is:

trace_event=sched_switch trace_event=sched_waking

Will only enable sched_waking where as:

trace_event=sched_switch,sched_waking

Will enable both.

The bootconfig makes it even worse as the second way is the more common
method.

The issue is that a temporary buffer is used to store the events to enable
later in boot. Each time the cmdline callback is called, it overwrites
what was previously there.

Have the callback append the next value (delimited by a comma) if the
temporary buffer already has content.

- Fix command line trace_buffer_size if >= 2G

The logic to allocate the trace buffer uses "int" for the size parameter
in the command line code causing overflow issues if more that 2G is
specified.


Please pull the latest trace-v7.0-rc2-2 tree, which can be found at:


git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace.git
trace-v7.0-rc2-2

Tag SHA1: e56759cc1100b321b4e8cea18a397f755b960e2f
Head SHA1: d008ba8be8984760e36d7dcd4adbd5a41a645708


Andrei-Alexandru Tachici (1):
tracing: Fix enabling multiple events on the kernel command line and bootconfig

Calvin Owens (1):
tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G

Guenter Roeck (1):
tracing: Add NULL pointer check to trigger_data_free()

----
kernel/trace/trace.c | 6 +++---
kernel/trace/trace_events.c | 6 +++++-
kernel/trace/trace_events_trigger.c | 3 +++
3 files changed, 11 insertions(+), 4 deletions(-)
---------------------------
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 1e7c032a72d2..ebd996f8710e 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -9350,7 +9350,7 @@ static void setup_trace_scratch(struct trace_array *tr,
}

static int
-allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, int size)
+allocate_trace_buffer(struct trace_array *tr, struct array_buffer *buf, unsigned long size)
{
enum ring_buffer_flags rb_flags;
struct trace_scratch *tscratch;
@@ -9405,7 +9405,7 @@ static void free_trace_buffer(struct array_buffer *buf)
}
}

-static int allocate_trace_buffers(struct trace_array *tr, int size)
+static int allocate_trace_buffers(struct trace_array *tr, unsigned long size)
{
int ret;

@@ -10769,7 +10769,7 @@ __init static void enable_instances(void)

__init static int tracer_alloc_buffers(void)
{
- int ring_buf_size;
+ unsigned long ring_buf_size;
int ret = -ENOMEM;


diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index b7343fdfd7b0..249d1cba72c0 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c
@@ -4493,7 +4493,11 @@ static char bootup_event_buf[COMMAND_LINE_SIZE] __initdata;

static __init int setup_trace_event(char *str)
{
- strscpy(bootup_event_buf, str, COMMAND_LINE_SIZE);
+ if (bootup_event_buf[0] != '\0')
+ strlcat(bootup_event_buf, ",", COMMAND_LINE_SIZE);
+
+ strlcat(bootup_event_buf, str, COMMAND_LINE_SIZE);
+
trace_set_ring_buffer_expanded(NULL);
disable_tracing_selftest("running event tracing");

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index fecbd679d432..d5230b759a2d 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -50,6 +50,9 @@ static int trigger_kthread_fn(void *ignore)

void trigger_data_free(struct event_trigger_data *data)
{
+ if (!data)
+ return;
+
if (data->cmd_ops->set_filter)
data->cmd_ops->set_filter(NULL, data, NULL);