[v3.0 stable version][PATCH 1/2] ring-buffer: Fix NULL pointer if rb_set_head_page() fails

[v3.0 stable version][PATCH 1/2] ring-buffer: Fix NULL pointer if rb_set_head_page() fails

[Steven Rostedt]

The function rb_set_head_page() searches the list of ring buffer
pages for a the page that has the HEAD page flag set. If it does
not find it, it will do a WARN_ON(), disable the ring buffer and
return NULL, as this should never happen.

But if this bug happens to happen, not all callers of this function
can handle a NULL pointer being returned from it. That needs to be
fixed.

Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
 kernel/trace/ring_buffer.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

Index: linux-test.git/kernel/trace/ring_buffer.c
===================================================================
--- linux-test.git.orig/kernel/trace/ring_buffer.c
+++ linux-test.git/kernel/trace/ring_buffer.c
@@ -2926,6 +2926,8 @@ rb_get_reader_page(struct ring_buffer_pe
 	 * Splice the empty reader page into the list around the head.
 	 */
 	reader = rb_set_head_page(cpu_buffer);
+	if (!reader)
+		goto out;
 	cpu_buffer->reader_page->list.next = rb_list_head(reader->list.next);
 	cpu_buffer->reader_page->list.prev = reader->list.prev;
 

Re: [v3.0 stable version][PATCH 1/2] ring-buffer: Fix NULL pointer if rb_set_head_page() fails

[Greg KH]

On Thu, Dec 06, 2012 at 04:41:55PM -0500, Steven Rostedt wrote:
> On Thu, 2012-12-06 at 12:13 -0800, Greg KH wrote:
> > On Fri, Nov 30, 2012 at 11:16:43AM -0500, Steven Rostedt wrote:
> > > The function rb_set_head_page() searches the list of ring buffer
> > > pages for a the page that has the HEAD page flag set. If it does
> > > not find it, it will do a WARN_ON(), disable the ring buffer and
> > > return NULL, as this should never happen.
> > > 
> > > But if this bug happens to happen, not all callers of this function
> > > can handle a NULL pointer being returned from it. That needs to be
> > > fixed.
> > > 
> > > Cc: stable@vger.kernel.org # 3.0+
> > > Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
> > > ---
> > >  kernel/trace/ring_buffer.c |    9 +++++++--
> > >  1 files changed, 7 insertions(+), 2 deletions(-)
> > 
> > I don't understand why you sent these to stable@ right now, I don't see
> > them in Linus's tree, so why are they needed here?
> 
> Answer below.
> 
> > 
> > Care to resend them when they hit Linus's tree?
> 
> I'll try to remember, but I will most likely forget :-)
> 
> I wrote the patches for each stable version while they were still fresh
> in my mind. I posted them so they would be there when they get into
> mainline and be easier to port for stable. By the time they are in
> mainline, they will be completely out of my mind :-)

Ok, if they are that important, consider them forgotten from my mind as
well :)

greg k-h

Re: [v3.0 stable version][PATCH 1/2] ring-buffer: Fix NULL pointer if rb_set_head_page() fails

[Steven Rostedt]

On Thu, 2012-12-06 at 12:13 -0800, Greg KH wrote:
> On Fri, Nov 30, 2012 at 11:16:43AM -0500, Steven Rostedt wrote:
> > The function rb_set_head_page() searches the list of ring buffer
> > pages for a the page that has the HEAD page flag set. If it does
> > not find it, it will do a WARN_ON(), disable the ring buffer and
> > return NULL, as this should never happen.
> > 
> > But if this bug happens to happen, not all callers of this function
> > can handle a NULL pointer being returned from it. That needs to be
> > fixed.
> > 
> > Cc: stable@vger.kernel.org # 3.0+
> > Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
> > ---
> >  kernel/trace/ring_buffer.c |    9 +++++++--
> >  1 files changed, 7 insertions(+), 2 deletions(-)
> 
> I don't understand why you sent these to stable@ right now, I don't see
> them in Linus's tree, so why are they needed here?

Answer below.

> 
> Care to resend them when they hit Linus's tree?

I'll try to remember, but I will most likely forget :-)

I wrote the patches for each stable version while they were still fresh
in my mind. I posted them so they would be there when they get into
mainline and be easier to port for stable. By the time they are in
mainline, they will be completely out of my mind :-)

Also, it seems that Ingo has been so busy with NUMA, that my patches
have been forgotten about. I may have to push to Linus directly :-/

-- Steve

Re: [v3.0 stable version][PATCH 1/2] ring-buffer: Fix NULL pointer if rb_set_head_page() fails

[Greg KH]

On Fri, Nov 30, 2012 at 11:16:43AM -0500, Steven Rostedt wrote:
> The function rb_set_head_page() searches the list of ring buffer
> pages for a the page that has the HEAD page flag set. If it does
> not find it, it will do a WARN_ON(), disable the ring buffer and
> return NULL, as this should never happen.
> 
> But if this bug happens to happen, not all callers of this function
> can handle a NULL pointer being returned from it. That needs to be
> fixed.
> 
> Cc: stable@vger.kernel.org # 3.0+
> Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
> ---
>  kernel/trace/ring_buffer.c |    9 +++++++--
>  1 files changed, 7 insertions(+), 2 deletions(-)

I don't understand why you sent these to stable@ right now, I don't see
them in Linus's tree, so why are they needed here?

Care to resend them when they hit Linus's tree?

thanks,

greg k-h

[v3.0 stable version][PATCH 1/2] ring-buffer: Fix NULL pointer if rb_set_head_page() fails

[Steven Rostedt]

The function rb_set_head_page() searches the list of ring buffer
pages for a the page that has the HEAD page flag set. If it does
not find it, it will do a WARN_ON(), disable the ring buffer and
return NULL, as this should never happen.

But if this bug happens to happen, not all callers of this function
can handle a NULL pointer being returned from it. That needs to be
fixed.

Cc: stable@vger.kernel.org # 3.0+
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
---
 kernel/trace/ring_buffer.c |    9 +++++++--
 1 files changed, 7 insertions(+), 2 deletions(-)

Index: linux-test.git/kernel/trace/ring_buffer.c
===================================================================
--- linux-test.git.orig/kernel/trace/ring_buffer.c
+++ linux-test.git/kernel/trace/ring_buffer.c
@@ -2926,6 +2926,8 @@ rb_get_reader_page(struct ring_buffer_pe
 	 * Splice the empty reader page into the list around the head.
 	 */
 	reader = rb_set_head_page(cpu_buffer);
+	if (!reader)
+		goto out;
 	cpu_buffer->reader_page->list.next = rb_list_head(reader->list.next);
 	cpu_buffer->reader_page->list.prev = reader->list.prev;