tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

PATCH Superseded Alexander Martyniuk 2 participants 6 messages Sep 2 – Sep 8 Stable branch

lore

Share & tools

lore

Alexander Martyniuk

author

2026-09-02 12:28 UTC #0 lore raw

PATCH 1/1 tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

From: "Masami Hiramatsu (Google)" <[email protected]>

commit 12b80cdbc54cf615b4717a4e8180063408091ea2 upstream.

mmio_trace_rw() and mmio_trace_mapping() retrieve mmio_trace_array into tr and pass it to __trace_mmiotrace_rw() and __trace_mmiotrace_map(). If these functions are invoked while mmio_trace_array is NULL (e.g. before initialization or after disabled), accessing tr->array_buffer.buffer will result in a NULL pointer dereference crash.

Fix this by adding an explicit NULL check for tr at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map().

Link https://patch.msgid.link/178524300062.56416.8362487250709962380.stgit@devnote2 open here

Fixes f984b51e0779 ("ftrace: add mmiotrace plugin")

Assisted-by Antigravity:gemini-3.6-flash

Signed-off-by Masami Hiramatsu (Google) <[email protected]>

Signed-off-by Steven Rostedt <[email protected]>

Signed-off-by Alexander Martyniuk <[email protected]>

---
Backport fix for CVE-2026-80689

 kernel/trace/trace_mmiotrace.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

kernel/trace/trace_mmiotrace.c +10 -2

index e8ae2d92a678..da63add45faa 100644
@@ -298,11 +298,15 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
 				struct mmiotrace_rw *rw)
 {
 	struct trace_event_call *call = &event_mmiotrace_rw;
-	struct trace_buffer *buffer = tr->array_buffer.buffer;
+	struct trace_buffer *buffer;
 	struct ring_buffer_event *event;
 	struct trace_mmiotrace_rw *entry;
 	int pc = preempt_count();
 
+	if (!tr)
+		return;
+
+	buffer = tr->array_buffer.buffer;
 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
 					  sizeof(*entry), 0, pc);
 	if (!event) {

@@ -328,11 +332,15 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
 				struct mmiotrace_map *map)
 {
 	struct trace_event_call *call = &event_mmiotrace_map;
-	struct trace_buffer *buffer = tr->array_buffer.buffer;
+	struct trace_buffer *buffer;
 	struct ring_buffer_event *event;
 	struct trace_mmiotrace_map *entry;
 	int pc = preempt_count();
 
+	if (!tr)
+		return;
+
+	buffer = tr->array_buffer.buffer;
 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
 					  sizeof(*entry), 0, pc);
 	if (!event) {

Signature · 1 line

2.43.0

Sasha Levin

maintainer

2026-09-04 02:53 UTC #1 lore raw

Quoted 2 lines

Fix this by adding an explicit NULL check for tr at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map().

The callers mmio_trace_rw() and mmio_trace_mapping() still dereference tr->array_buffer.data via per_cpu_ptr() before reaching the functions this patch guards, so the new checks never run for the NULL case they target. Mainline is only safe because of the later commit 6936298393d8 ("tracing/mmiotrace: Remove reference to unused per CPU data pointer").

Signature · 2 lines

Thanks,
Sasha

Alexander Martyniuk

author

2026-09-07 15:07 UTC #2 lore raw

v2 cover tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

Backport fix for CVE-2026-80689.

Masami Hiramatsu (Google) (1):
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
functions

Steven Rostedt (1):
tracing/mmiotrace: Remove reference to unused per CPU data pointer

 kernel/trace/trace_mmiotrace.c | 24 ++++++++++++------------
 1 file changed, 12 insertions(+), 12 deletions(-)

Signature · 1 line

2.43.0

Alexander Martyniuk

author

2026-09-07 15:07 UTC #3 lore raw

PATCH v2 1/2 tracing/mmiotrace: Remove reference to unused per CPU data pointer

From: Steven Rostedt <[email protected]>

commit 6936298393d8d8bc3cec6b704f6a774162cf9bd3 upstream.

The mmiotracer referenced the per CPU array_buffer->data descriptor but never actually used it. Remove the references to it.

Cc Masami Hiramatsu <[email protected]>

Cc Mark Rutland <[email protected]>

Cc Mathieu Desnoyers <[email protected]>

Cc Andrew Morton <[email protected]>

Link https://lore.kernel.org/[email protected] open here

Signed-off-by Steven Rostedt (Google) <[email protected]>

Signed-off-by Alexander Martyniuk <[email protected]>

---
Backport fix for CVE-2026-80689

 kernel/trace/trace_mmiotrace.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

kernel/trace/trace_mmiotrace.c +2 ~~-10~~

index e8ae2d92a678..55ba76bea98b 100644
@@ -294,7 +294,6 @@ __init static int init_mmio_trace(void)
 device_initcall(init_mmio_trace);
 
 static void __trace_mmiotrace_rw(struct trace_array *tr,
-				struct trace_array_cpu *data,
 				struct mmiotrace_rw *rw)
 {
 	struct trace_event_call *call = &event_mmiotrace_rw;

@@ -319,12 +318,10 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
 void mmio_trace_rw(struct mmiotrace_rw *rw)
 {
 	struct trace_array *tr = mmio_trace_array;
-	struct trace_array_cpu *data = per_cpu_ptr(tr->array_buffer.data, smp_processor_id());
-	__trace_mmiotrace_rw(tr, data, rw);
+	__trace_mmiotrace_rw(tr, rw);
 }
 
 static void __trace_mmiotrace_map(struct trace_array *tr,
-				struct trace_array_cpu *data,
 				struct mmiotrace_map *map)
 {
 	struct trace_event_call *call = &event_mmiotrace_map;

@@ -349,12 +346,7 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
 void mmio_trace_mapping(struct mmiotrace_map *map)
 {
 	struct trace_array *tr = mmio_trace_array;
-	struct trace_array_cpu *data;
-
-	preempt_disable();
-	data = per_cpu_ptr(tr->array_buffer.data, smp_processor_id());
-	__trace_mmiotrace_map(tr, data, map);
-	preempt_enable();
+	__trace_mmiotrace_map(tr, map);
 }
 
 int mmio_trace_printk(const char *fmt, va_list args)

Signature · 1 line

2.43.0

Alexander Martyniuk

author

2026-09-07 15:07 UTC #4 lore raw

PATCH v2 2/2 tracing/mmiotrace: Add NULL check for mmio_trace_array in logging functions

In reply to Alexander Martyniuk

From: "Masami Hiramatsu (Google)" <[email protected]>

commit 12b80cdbc54cf615b4717a4e8180063408091ea2 upstream.

Fix this by adding an explicit NULL check for tr at the beginning of __trace_mmiotrace_rw() and __trace_mmiotrace_map().

Link https://patch.msgid.link/178524300062.56416.8362487250709962380.stgit@devnote2 open here

Fixes f984b51e0779 ("ftrace: add mmiotrace plugin")

Assisted-by Antigravity:gemini-3.6-flash

Signed-off-by Masami Hiramatsu (Google) <[email protected]>

Signed-off-by Steven Rostedt <[email protected]>

Signed-off-by Alexander Martyniuk <[email protected]>

---
Backport fix for CVE-2026-80689

 kernel/trace/trace_mmiotrace.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

kernel/trace/trace_mmiotrace.c +10 -2

index 55ba76bea98b..ce45c5ee5227 100644
@@ -297,11 +297,15 @@ static void __trace_mmiotrace_rw(struct trace_array *tr,
 				struct mmiotrace_rw *rw)
 {
 	struct trace_event_call *call = &event_mmiotrace_rw;
-	struct trace_buffer *buffer = tr->array_buffer.buffer;
+	struct trace_buffer *buffer;
 	struct ring_buffer_event *event;
 	struct trace_mmiotrace_rw *entry;
 	int pc = preempt_count();
 
+	if (!tr)
+		return;
+
+	buffer = tr->array_buffer.buffer;
 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
 					  sizeof(*entry), 0, pc);
 	if (!event) {

@@ -325,11 +329,15 @@ static void __trace_mmiotrace_map(struct trace_array *tr,
 				struct mmiotrace_map *map)
 {
 	struct trace_event_call *call = &event_mmiotrace_map;
-	struct trace_buffer *buffer = tr->array_buffer.buffer;
+	struct trace_buffer *buffer;
 	struct ring_buffer_event *event;
 	struct trace_mmiotrace_map *entry;
 	int pc = preempt_count();
 
+	if (!tr)
+		return;
+
+	buffer = tr->array_buffer.buffer;
 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
 					  sizeof(*entry), 0, pc);
 	if (!event) {

Signature · 1 line

2.43.0

Sasha Levin

maintainer Applied

2026-09-08 00:54 UTC #5 lore raw

In reply to Alexander Martyniuk

Quoted 6 lines

Masami Hiramatsu (Google) (1):
tracing/mmiotrace: Add NULL check for mmio_trace_array in logging
functions
Steven Rostedt (1):
tracing/mmiotrace: Remove reference to unused per CPU data pointer

Queued for 5.10, thanks. Good catch adding the prerequisite.

Signature · 2 lines

Thanks,
Sasha