This is a note to let you know that I've just added the patch titled tracing/ring-buffer: Only do full wait when cpu != RING_BUFFER_ALL_CPUS to the 5.4-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: tracing-ring-buffer-only-do-full-wait-when-cpu-ring_buffer_all_cpus.patch and it can be found in the queue-5.4 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From ptyadav@xxxxxxxxx Mon Dec 19 13:19:42 2022 From: Pratyush Yadav <ptyadav@xxxxxxxxx> Date: Fri, 16 Dec 2022 14:42:41 +0100 Subject: tracing/ring-buffer: Only do full wait when cpu != RING_BUFFER_ALL_CPUS To: <stable@xxxxxxxxxxxxxxx> Cc: Pratyush Yadav <ptyadav@xxxxxxxxx>, Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>, <patches@xxxxxxxxxxxxxxx>, Linux Trace Kernel <linux-trace-kernel@xxxxxxxxxxxxxxx>, Masami Hiramatsu <mhiramat@xxxxxxxxxx>, Mathieu Desnoyers <mathieu.desnoyers@xxxxxxxxxxxx>, Primiano Tucci <primiano@xxxxxxxxxx>, "Steven Rostedt (Google)" <rostedt@xxxxxxxxxxx> Message-ID: <20221216134241.81381-1-ptyadav@xxxxxxxxx> From: Pratyush Yadav <ptyadav@xxxxxxxxx> full_hit() directly uses cpu as an array index. Since RING_BUFFER_ALL_CPUS == -1, calling full_hit() with cpu == RING_BUFFER_ALL_CPUS will cause an invalid memory access. The upstream commit 42fb0a1e84ff ("tracing/ring-buffer: Have polling block on watermark") already does this. This was missed when backporting to v5.4.y. This bug was discovered and resolved using Coverity Static Analysis Security Testing (SAST) by Synopsys, Inc. Fixes: e65ac2bdda54 ("tracing/ring-buffer: Have polling block on watermark") Signed-off-by: Pratyush Yadav <ptyadav@xxxxxxxxx> Acked-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- kernel/trace/ring_buffer.c | 1 + 1 file changed, 1 insertion(+) --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -727,6 +727,7 @@ __poll_t ring_buffer_poll_wait(struct ri if (cpu == RING_BUFFER_ALL_CPUS) { work = &buffer->irq_work; + full = 0; } else { if (!cpumask_test_cpu(cpu, buffer->cpumask)) return -EINVAL; Patches currently in stable-queue which might be from ptyadav@xxxxxxxxx are queue-5.4/tracing-ring-buffer-only-do-full-wait-when-cpu-ring_buffer_all_cpus.patch