Patch "tracing: Add NULL checks for buffer in ring_buffer_free_read_page()" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tracing: Add NULL checks for buffer in ring_buffer_free_read_page()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tracing-add-null-checks-for-buffer-in-ring_buffer_fr.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit ec453bc5031c07c86224da3bc464a80cbde41fcb
Author: Jia-Ju Bai <baijiaju1990@xxxxxxxxx>
Date:   Fri Jan 13 20:55:01 2023 +0800

    tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
    
    [ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
    
    In a previous commit 7433632c9ff6, buffer, buffer->buffers and
    buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
    and thus the related checks are added.
    
    However, in the same call stack, these variables are also used in
    ring_buffer_free_read_page():
    
    tracing_buffers_release()
      ring_buffer_wake_waiters(iter->array_buffer->buffer)
        cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
      ring_buffer_free_read_page(iter->array_buffer->buffer)
        cpu_buffer = buffer->buffers[cpu] -> No check
    
    Thus, to avod possible null-pointer derefernces, the related checks
    should be added.
    
    These results are reported by a static tool designed by myself.
    
    Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@xxxxxxxxx
    
    Reported-by: TOTE Robot <oslab@xxxxxxxxxxxxxxx>
    Signed-off-by: Jia-Ju Bai <baijiaju1990@xxxxxxxxx>
    Signed-off-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index c35e08b74014f..361bd8beafdff 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5588,11 +5588,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
  */
 void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, void *data)
 {
-	struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+	struct ring_buffer_per_cpu *cpu_buffer;
 	struct buffer_data_page *bpage = data;
 	struct page *page = virt_to_page(bpage);
 	unsigned long flags;
 
+	if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+		return;
+
+	cpu_buffer = buffer->buffers[cpu];
+
 	/* If the page is still in use someplace else, we can't reuse it */
 	if (page_ref_count(page) > 1)
 		goto out;