diff options
| author | David Carlier <devnexen@gmail.com> | 2026-09-12 11:39:38 +0100 |
|---|---|---|
| committer | Steven Rostedt <rostedt@goodmis.org> | 2026-09-13 13:06:43 -0400 |
| commit | d860c67c051685abb0460b593b193f0f45f4fa92 (patch) | |
| tree | a26aab3d22b87970eb65a593a5feb7d76e7abdbe /scripts/basic/split-include.c | |
| parent | d059d8bf2c9b5d563d15e7552d73e17d7535013a (diff) | |
| download | linux-stable-d860c67c051685abb0460b593b193f0f45f4fa92.tar.gz linux-stable-d860c67c051685abb0460b593b193f0f45f4fa92.zip | |
ring-buffer: Check resize_disabled before publishing the new subbuf order
ring_buffer_subbuf_order_set() stores the new order and only then walks
the CPUs, returning -EBUSY if any of them has resizing disabled. A user
mapped buffer has resizing disabled, and __rb_map_vma() reads
buffer->subbuf_order without buffer->mutex, so an mmap of an already
mapped CPU racing the failing order change sizes the mapping with the
new order and inserts pages past the sub-buffer into the VMA.
Check the CPUs before storing the new order.
Cc: stable@vger.kernel.org
Fixes: 117c39200d9d ("ring-buffer: Introducing ring-buffer mapping functions")
Link: https://patch.msgid.link/20260912103938.1127021-1-devnexen@gmail.com
Signed-off-by: David Carlier <devnexen@gmail.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'scripts/basic/split-include.c')
0 files changed, 0 insertions, 0 deletions