Commit aed0af05 authored Mar 07, 2026 by Linus Torvalds

linux-trace

Pull tracing fixes from Steven Rostedt:

 - Fix possible NULL pointer dereference in trace_data_alloc()

   On the trace_data_alloc() error path, it can call trigger_data_free()
   with a NULL pointer. This used to be a kfree() but was changed to
   trigger_data_free() to clean up any partial initialization. The issue
   is that trigger_data_free() does not expect a NULL pointer. Have
   trigger_data_free() return safely on NULL pointer.

 - Fix multiple events on the command line and bootconfig

   If multiple events are enabled on the command line separately and not
   grouped, only the last event gets enabled. That is:

      trace_event=sched_switch trace_event=sched_waking

   will only enable sched_waking whereas:

      trace_event=sched_switch,sched_waking

   will enable both.

   The bootconfig makes it even worse as the second way is the more
   common method.

   The issue is that a temporary buffer is used to store the events to
   enable later in boot. Each time the cmdline callback is called, it
   overwrites what was previously there.

   Have the callback append the next value (delimited by a comma) if the
   temporary buffer already has content.

 - Fix command line trace_buffer_size if >= 2G

   The logic to allocate the trace buffer uses "int" for the size
   parameter in the command line code causing overflow issues if more
   that 2G is specified.

* tag 'trace-v7.0-rc2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  tracing: Fix trace_buf_size= cmdline parameter with sizes >= 2G
  tracing: Fix enabling multiple events on the kernel command line and bootconfig
  tracing: Add NULL pointer check to trigger_data_free()

parents 7b6e48df d008ba8b

kernel/trace/trace.c

+3 −3

Original line number	Diff line number	Diff line
		@@ -9350,7 +9350,7 @@ static void setup_trace_scratch(struct trace_array *tr,
		}

		static int
		allocate_trace_buffer(struct trace_array tr, struct array_buffer buf, int size)
		allocate_trace_buffer(struct trace_array tr, struct array_buffer buf, unsigned long size)
		{
		enum ring_buffer_flags rb_flags;
		struct trace_scratch *tscratch;
		@@ -9405,7 +9405,7 @@ static void free_trace_buffer(struct array_buffer *buf)
		}
		}

		static int allocate_trace_buffers(struct trace_array *tr, int size)
		static int allocate_trace_buffers(struct trace_array *tr, unsigned long size)
		{
		int ret;

		@@ -10769,7 +10769,7 @@ __init static void enable_instances(void)

		__init static int tracer_alloc_buffers(void)
		{
		int ring_buf_size;
		unsigned long ring_buf_size;
		int ret = -ENOMEM;

kernel/trace/trace_events.c

+5 −1

Original line number	Diff line number	Diff line
		@@ -4493,7 +4493,11 @@ static char bootup_event_buf[COMMAND_LINE_SIZE] __initdata;

		static __init int setup_trace_event(char *str)
		{
		strscpy(bootup_event_buf, str, COMMAND_LINE_SIZE);
		if (bootup_event_buf[0] != '\0')
		strlcat(bootup_event_buf, ",", COMMAND_LINE_SIZE);

		strlcat(bootup_event_buf, str, COMMAND_LINE_SIZE);

		trace_set_ring_buffer_expanded(NULL);
		disable_tracing_selftest("running event tracing");

kernel/trace/trace_events_trigger.c

+3 −0

Original line number	Diff line number	Diff line
		@@ -50,6 +50,9 @@ static int trigger_kthread_fn(void *ignore)

		void trigger_data_free(struct event_trigger_data *data)
		{
		if (!data)
		return;

		if (data->cmd_ops->set_filter)
		data->cmd_ops->set_filter(NULL, data, NULL);