[PATCH] tracing: ring_buffer: wait for writers before removing pages

[Haoli Zhang]

A writer can still be using the ring buffer page list when a concurrent
resize removes and frees pages. Disabling recording prevents new writers
from entering, but it does not wait for writers that are already in the
reserve/commit path. The reader lock protects reader-side page operations
and does not provide that writer-side synchronization.

Disable recording before waiting for a grace period, then wait for
pre-existing writers to finish before taking the reader lock and changing
the page list. Keep recording disabled until after the page list has been
updated and the reader lock has been released. The removed pages are
unlinked and subsequently freed.

This adds a grace-period wait to the resize path; it does not add
synchronization to the normal ring-buffer write path.

Reported-by: syzbot+37e1793bdb0061ea3a47@xxxxxxxxxxxxxxxxxxxxxxxxx
Closes: https://syzkaller.appspot.com/bug?extid=37e1793bdb0061ea3a47
Co-developed-by: Jinning Zhang <25031212117@xxxxxxxxxxxxxxxxx>
Signed-off-by: Jinning Zhang <25031212117@xxxxxxxxxxxxxxxxx>
Co-developed-by: Bin Yu <byu@xxxxxxxxxxxxx>
Signed-off-by: Bin Yu <byu@xxxxxxxxxxxxx>
Signed-off-by: Haoli Zhang <26031212468@xxxxxxxxxxxxxxxxx>
---
 kernel/trace/ring_buffer.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 04bb94c..d92e001 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -3078,8 +3078,11 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
 
 	head_bit = 0;
 
-	raw_spin_lock_irq(&cpu_buffer->reader_lock);
 	atomic_inc(&cpu_buffer->record_disabled);
+	/* Wait for in-flight writers to finish before unlinking pages. */
+	synchronize_rcu();
+
+	raw_spin_lock_irq(&cpu_buffer->reader_lock);
 	/*
 	 * We don't race with the readers since we have acquired the reader
 	 * lock. We also don't race with writers after disabling recording.
@@ -3132,8 +3135,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
 						struct buffer_page, list);
 
 	/* pages are removed, resume tracing and then free the pages */
-	atomic_dec(&cpu_buffer->record_disabled);
 	raw_spin_unlock_irq(&cpu_buffer->reader_lock);
+	atomic_dec(&cpu_buffer->record_disabled);
 
 	RB_WARN_ON(cpu_buffer, list_empty(cpu_buffer->pages));