Steven Rostedt (Google)
d7dd5658ce
ring-buffer: Fix race between reset page and reading page ...
commit a0fcaaed0c46cf9399d3a2d6e0c87ddb3df0e044 upstream.
The ring buffer is broken up into sub buffers (currently of page size).
Each sub buffer has a pointer to its "tail" (the last event written to the
sub buffer). When a new event is requested, the tail is locally
incremented to cover the size of the new event. This is done in a way that
there is no need for locking.
If the tail goes past the end of the sub buffer, the process of moving to
the next sub buffer takes place. After setting the current sub buffer to
the next one, the previous one that had the tail go passed the end of the
sub buffer needs to be reset back to the original tail location (before
the new event was requested) and the rest of the sub buffer needs to be
"padded".
The race happens when a reader takes control of the sub buffer. As readers
do a "swap" of sub buffers from the ring buffer to get exclusive access to
the sub buffer, it replaces the "head" sub buffer with an empty sub buffer
that goes back into the writable portion of the ring buffer. This swap can
happen as soon as the writer moves to the next sub buffer and before it
updates the last sub buffer with padding.
Because the sub buffer can be released to the reader while the writer is
still updating the padding, it is possible for the reader to see the event
that goes past the end of the sub buffer. This can cause obvious issues.
To fix this, add a few memory barriers so that the reader definitely sees
the updates to the sub buffer, and also waits until the writer has put
back the "tail" of the sub buffer back to the last event that was written
on it.
To be paranoid, it will only spin for 1 second, otherwise it will
warn and shutdown the ring buffer code. 1 second should be enough as
the writer does have preemption disabled. If the writer doesn't move
within 1 second (with preemption disabled) something is horribly
wrong. No interrupt should last 1 second!
Link: https://lore.kernel.org/all/20220830120854.7545-1-jiazi.li@transsion.com/
Link: https://bugzilla.kernel.org/show_bug.cgi?id=216369
Link: https://lkml.kernel.org/r/20220929104909.0650a36c@gandalf.local.home
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Fixes: c7b0930857
2022-10-26 13:15:38 +02:00
bpf: fix overflow in prog accounting
2022-08-25 11:09:24 +02:00
config: android: enable CONFIG_SECCOMP
2016-10-11 15:06:32 -07:00
kdb: Make memory allocations more robust
2021-03-03 17:44:31 +01:00
perf/core: Fix data race between perf_event_set_output() and perf_mmap_close()
2022-07-29 17:05:45 +02:00
gcov: add support for GCC 10.1
2020-09-23 08:46:14 +02:00
random: remove unused irq_flags argument from add_interrupt_randomness()
2022-06-25 11:45:04 +02:00
livepatch/module: make TAINT_LIVEPATCH module-specific
2016-08-26 14:42:08 +02:00
locking/lockdep: Avoid RCU-induced noinstr fail
2021-11-26 11:48:27 +01:00
PM: suspend: fix return value of __setup handler
2022-04-20 09:06:31 +02:00
printk: fix return value of printk.devkmsg __setup handler
2022-04-20 09:06:33 +02:00
rcuperf: Fix cleanup path for invalid perf_type strings
2019-05-31 06:48:30 -07:00
sched/debug: Remove mpol_get/put and task_lock/unlock from sched_show_numa
2022-04-20 09:06:32 +02:00
timekeeping: Add raw clock fallback for random_get_entropy()
2022-06-25 11:45:13 +02:00
ring-buffer: Fix race between reset page and reading page
2022-10-26 13:15:38 +02:00
kernel/acct.c: fix the acct->needcheck check in check_free_space()
2018-01-10 09:29:51 +01:00
kernel/async.c: revert "async: simplify lowest_in_progress()"
2018-02-17 13:21:18 +01:00
audit: fix a net reference leak in audit_list_rules_send()
2021-04-07 12:05:41 +02:00
audit: fix a net reference leak in audit_list_rules_send()
2021-04-07 12:05:41 +02:00
audit: CONFIG_CHANGE don't log internal bookkeeping as an event
2020-10-01 20:40:07 +02:00
audit: fix a net reference leak in audit_list_rules_send()
2021-04-07 12:05:41 +02:00
audit: print empty EXECVE args
2019-11-28 18:28:55 +01:00
kbuild: fix kernel/bounds.c 'W=1' warning
2018-11-13 11:16:57 -08:00
ptrace: Capture the ptracer's creds not PT_PTRACE_CAP
2017-01-06 10:40:13 +01:00
cgroup-v1: Require capabilities to set release_agent
2022-02-11 08:41:17 +01:00
cgroup: pids: use atomic64_t for pids->limit
2019-12-21 10:42:02 +01:00
random: clear fast pool, crng, and batches in cpuhp bring up
2022-06-25 11:45:10 +02:00
kernel/cpu_pm: Fix uninitted local in cpu_pm
2020-06-20 10:24:21 +02:00
sched/cpuset/pm: Fix cpuset vs. suspend-resume bugs
2017-10-12 11:51:25 +02:00
memcg: account security cred as well to kmemcg
2020-01-12 11:24:13 +01:00
security,selinux,smack: kill security_task_wait hook
2022-07-29 17:05:44 +02:00
kernel/extable.c: mark core_kernel_text notrace
2017-07-21 07:42:21 +02:00
mm/hugetlb: initialize hugetlb_usage in mm_init
2021-09-22 11:43:08 +02:00
freezer, oom: check TIF_MEMDIE on the correct task
2016-07-28 16:07:41 -07:00
mm, futex: fix shared futex pgoff on shmem huge page
2021-07-11 12:46:40 +02:00
kernel: make groups_sort calling a responsibility group_info allocators
2018-01-10 09:29:52 +01:00
kernel: hung_task.c: disable on suspend
2019-04-20 09:07:52 +02:00
jump_label: Invoke jump_label_test() via early_initcall()
2017-12-14 09:28:24 +01:00
kcov: ensure irq code sees a valid area
2018-08-03 07:55:12 +02:00
kexec: allow architectures to override boot mapping
2016-08-02 19:35:27 -04:00
objtool, x86: Add several functions and files to the objtool whitelist
2018-06-05 10:28:57 +02:00
kexec_file: drop weak attribute from arch_kexec_apply_relocations[_add]
2022-07-02 16:17:16 +02:00
usermodehelper: reset umask to default before executing user process
2020-10-14 09:48:14 +02:00
kprobes: don't call disarm_kprobe() for disabled kprobes
2022-09-05 10:23:58 +02:00
kexec: add a kexec_crash_loaded() function
2016-08-02 19:35:30 -04:00
kthread: prevent deadlock when kthread_mod_delayed_work() races with kthread_cancel_delayed_work_sync()
2021-07-11 12:46:41 +02:00
elfcore: fix building with clang
2021-02-10 09:09:25 +01:00
Fix: Disable sys_membarrier when nohz_full is enabled
2017-03-12 06:41:45 +01:00
mm, devm_memremap_pages: kill mapping "System RAM" support
2019-01-13 10:03:51 +01:00
module: Ignore _GLOBAL_OFFSET_TABLE_ when warning for undefined symbols
2021-03-03 17:44:44 +01:00
x86/mm: split vmalloc_sync_all()
2020-04-02 17:20:26 +02:00
padata: purge get_cpu and reorder_via_wq from padata_do_serial
2020-05-27 16:41:53 +02:00
panic: ensure preemption is disabled during panic()
2019-10-17 13:42:25 -07:00
pidns: disable pid allocation if pid_ns_prepare_proc() is failed in alloc_pid()
2018-04-13 19:47:53 +02:00
memcg: enable accounting for pids in nested pid namespaces
2021-09-22 11:43:08 +02:00
profiling: fix shift-out-of-bounds bugs
2021-09-26 13:36:18 +02:00
ptrace: Reimplement PTRACE_KILL by always sending SIGKILL
2022-06-14 16:52:28 +02:00
reboot: fix overflow parsing reboot cpu number
2020-11-18 18:26:32 +01:00
kernel/relay.c: fix memleak on destroy relay channel
2020-08-26 10:29:03 +02:00
resource: fix integer overflow at reallocation
2018-04-24 09:34:09 +02:00
seccomp: Add missing return in non-void function
2021-03-03 17:44:43 +01:00
signal handling: don't use BUG_ON() for debugging
2022-07-21 20:40:32 +02:00
smp: Fix offline cpu check in flush_smp_call_function_queue()
2022-04-20 09:06:46 +02:00
kthread/smpboot: do not park in kthread_create_on_cpu()
2016-10-11 15:06:33 -07:00
Mark HI and TASKLET softirq synchronous
2018-08-15 18:14:42 +02:00
stacktrace, lockdep: Fix address, newline ugliness
2017-02-14 15:25:42 -08:00
stop_machine: Use raw spinlocks
2018-08-03 07:55:24 +02:00
prctl: allow to setup brk for et_dyn executables
2021-09-26 13:36:18 +02:00
x86/pkeys: Fix pkeys build breakage for some non-x86 arches
2016-09-13 14:41:36 +02:00
x86/speculation: Include unprivileged eBPF status in Spectre v2 mitigation reporting
2022-03-11 10:03:31 +01:00
task_work: use READ_ONCE/lockless_dereference, avoid pi_lock if !task_works
2016-08-02 19:35:02 -04:00
taskstats: fix data-race
2020-01-12 11:24:12 +01:00
torture: Convert torture_shutdown() to hrtimer
2016-08-22 10:01:49 -07:00
tracepoint: Do not fail unregistering a probe due to memory failure
2021-03-03 17:44:38 +01:00
taskstats: Cleanup the use of task->exit_code
2022-02-23 11:56:40 +01:00
kernel/ucount.c: mark user_header with kmemleak_ignore()
2017-06-17 06:41:51 +02:00
kernel: make groups_sort calling a responsibility group_info allocators
2018-01-10 09:29:52 +01:00
smp: Add function to execute a function synchronously on a CPU
2016-09-05 13:52:39 +02:00
userns: move user access out of the mutex
2018-09-09 20:01:24 +02:00
Merge branch 'nsfs-ioctls' into HEAD
2016-09-22 20:00:36 -05:00
sys: don't hold uts_sem while accessing userspace memory
2018-09-09 20:01:24 +02:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
kernel/watchdog: prevent false hardlockup on overloaded system
2017-06-17 06:41:57 +02:00
workqueue: make workqueue available early during boot
2022-06-25 11:45:09 +02:00
workqueue: Fix NULL pointer dereference
2017-11-15 15:53:17 +01:00
d7dd5658ce