On Tue, 7 Oct 2025 22:42:56 +0530 Ankit Khushwaha <[email protected]> wrote:
Note, tracing subsystem expects the subject to start with a capital letter: ring buffer: Propagate __rb_map_vma return value to caller > The return value from `__rb_map_vma()`, which rejects writable or > executable mappings (VM_WRITE, VM_EXEC, or !VM_MAYSHARE), was being > ignored. As a result the caller of `__rb_map_vma` always returned 0 > even when the mapping had actually failed, allowing it to proceed > with an invalid VMA. > > Reported-by: [email protected] > Closes: > https://syzkaller.appspot.com/bug?id=194151be8eaebd826005329b2e123aecae714bdb > Signed-off-by: Ankit Khushwaha <[email protected]> > --- > > #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git > 4ff71af020ae > > --- > kernel/trace/ring_buffer.c | 2 ++ > 1 file changed, 2 insertions(+) > > diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c > index 43460949ad3f..4efb90364f48 100644 > --- a/kernel/trace/ring_buffer.c > +++ b/kernel/trace/ring_buffer.c > @@ -7271,6 +7271,8 @@ int ring_buffer_map(struct trace_buffer *buffer, int > cpu, > cpu_buffer->subbuf_ids = NULL; > rb_free_meta_page(cpu_buffer); > atomic_dec(&cpu_buffer->resize_disabled); > + /* VM failed to be mapped */ No need to add the comment. It's obvious what happened. > + return err; Don't return here. > } > > return 0; Change this to: return err; as after that if statement, err will be 0 on success or the value you want to return. -- Steve
