A CPU coming online during ring_buffer_subbuf_order_set() can be added to buffer->cpumask after the allocation loop, and the install loop then uses its empty new_pages list, corrupting the buffer. Take cpus_read_lock() as ring_buffer_resize() does. Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page") Cc: stable@vger.kernel.org Signed-off-by: David Carlier --- kernel/trace/ring_buffer.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 04bb94c29f58..445931bc9ae0 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -7464,6 +7464,12 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order) if (psize > RB_WRITE_MASK + 1) return -EINVAL; + /* + * Keep CPUs from coming online while changing the order to + * synchronize with new per CPU buffers being created. + */ + guard(cpus_read_lock)(); + /* prevent another thread from changing buffer sizes */ guard(mutex)(&buffer->mutex); -- 2.55.0