tracing: Fix buffer_meta open paths

Two fixes for per_cpu/cpuN/buffer_meta open. The first drops the trace_array reference under trace_types_lock on the error path. The second fails the open for CPUs that never came online, which would otherwise dereference a NULL cpu_buffer on read. With the second patch, that error path becomes reachable in practice.

Changes since v1:
- Add patch 2 for the NULL dereference Sashiko reported on v1.

v1: https://lore.kernel.org/all/[email protected]/

David Carlier (2):
tracing: Take trace_types_lock when dropping the buffer_meta reference
ring-buffer: Do not show buffer_meta for CPUs without a buffer

 kernel/trace/ring_buffer.c | 3 +++
 kernel/trace/trace.c       | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

2.55.0

tracing_buffer_meta_open() drops the trace_array reference with __trace_array_put() when ring_buffer_meta_seq_init() fails, without holding trace_types_lock. Use trace_array_put() like every other open error path.

---
 kernel/trace/trace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

index 8658cad53cb5..c8295324ffaa 100644
@@ -5881,7 +5881,7 @@ static int tracing_buffer_meta_open(struct inode *inode, struct file *filp)
 
 	ret = ring_buffer_meta_seq_init(filp, tr->array_buffer.buffer, cpu);
 	if (ret < 0)
-		__trace_array_put(tr);
+		trace_array_put(tr);
 	return ret;
 }
 

2.55.0

The per_cpu/cpuN/buffer_meta files are created for every possible CPU, but buffer->buffers[cpu] is only allocated once that CPU comes online. Reading the file of a CPU that never came online dereferences a NULL cpu_buffer in rbm_start().

Fail the open with -ENODEV when the CPU has no buffer, as the other per CPU ring buffer interfaces do.

---
 kernel/trace/ring_buffer.c | 3 +++
 1 file changed, 3 insertions(+)

index 9c03a555a6ba..8833d04b9fee 100644
@@ -2381,6 +2381,9 @@ int ring_buffer_meta_seq_init(struct file *file, struct trace_buffer *buffer, in
 	struct seq_file *m;
 	int ret;
 
+	if (!cpumask_test_cpu(cpu, buffer->cpumask))
+		return -ENODEV;
+
 	ret = seq_open(file, &rb_meta_seq_ops);
 	if (ret)
 		return ret;

2.55.0