Patch "ring-buffer: Make reading page consistent with the code logic" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    ring-buffer: Make reading page consistent with the code logic

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ring-buffer-make-reading-page-consistent-with-the-co.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 4918d6339a1c6c154c627fb2c15b7c1de7682eda
Author: Jeongjun Park <aha310510@xxxxxxxxx>
Date:   Sat Jan 11 01:26:12 2025 +0900

    ring-buffer: Make reading page consistent with the code logic
    
    [ Upstream commit 6e31b759b076eebb4184117234f0c4eb9e4bc460 ]
    
    In the loop of __rb_map_vma(), the 's' variable is calculated from the
    same logic that nr_pages is and they both come from nr_subbufs. But the
    relationship is not obvious and there's a WARN_ON_ONCE() around the 's'
    variable to make sure it never becomes equal to nr_subbufs within the
    loop. If that happens, then the code is buggy and needs to be fixed.
    
    The 'page' variable is calculated from cpu_buffer->subbuf_ids[s] which is
    an array of 'nr_subbufs' entries. If the code becomes buggy and 's'
    becomes equal to or greater than 'nr_subbufs' then this will be an out of
    bounds hit before the WARN_ON() is triggered and the code exiting safely.
    
    Make the 'page' initialization consistent with the code logic and assign
    it after the out of bounds check.
    
    Link: https://lore.kernel.org/20250110162612.13983-1-aha310510@xxxxxxxxx
    Signed-off-by: Jeongjun Park <aha310510@xxxxxxxxx>
    [ sdr: rewrote change log ]
    Signed-off-by: Steven Rostedt (Google) <rostedt@xxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 703978b2d557d..28fad7bcfcf86 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7059,7 +7059,7 @@ static int __rb_map_vma(struct ring_buffer_per_cpu *cpu_buffer,
 	}
 
 	while (p < nr_pages) {
-		struct page *page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]);
+		struct page *page;
 		int off = 0;
 
 		if (WARN_ON_ONCE(s >= nr_subbufs)) {
@@ -7067,6 +7067,8 @@ static int __rb_map_vma(struct ring_buffer_per_cpu *cpu_buffer,
 			goto out;
 		}
 
+		page = virt_to_page((void *)cpu_buffer->subbuf_ids[s]);
+
 		for (; off < (1 << (subbuf_order)); off++, page++) {
 			if (p >= nr_pages)
 				break;