Commit b9b3e33b70b7 for kernel

commit b9b3e33b70b71e516930117e21de3ad2a7723747
Merge: b643e495ae92 91542863abad
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Sun Aug 9 08:47:31 2026 -0700

    Merge tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

    Pull tracing fixes from Steven Rostedt:

     - Fix use-after-free in eventfs_remove_rec()

       The freeing of the eventfs_inode children used list_for_each_entry()
       where the child is freed via srcu, but there's still a chance that it
       gets freed. It should be using list_for_each_entry_safe().

     - Fix eventfs_inode SRCU use of list in freeing

       The iterator uses an SRCU protected list walk on the eventfs inodes.
       The eventfs inode uses its "list" field in a union with the RCU list
       head. When the inode gets added to the SRCU list it immediately
       corrupts the list pointer and can cause an issue with the iterator.
       Move the RCU list head to be shared with the children list head which
       allows the iterator to check the parent inode if is freed before
       referencing the child. Have the iterator check the parent "is_freed"
       field and break out if it is set. Also add memory barriers to make
       sure the ordering is correct.

     - Fix various RCU synchronization issues with direct_functions

       Updates to direct_functions have some missing RCU protection and
       synchronization. Restructure the code a bit to make sure updates to
       the direct_functions are protected.

     - Remove an unneeded comma from a scope_guard()

       There's a spurious comma in a scope_guard(). Remove it.

     - Fix race in per CPU buffer swap in the ring buffer

       When a per CPU buffer swap happens, it must make sure that it doesn't
       occur while a writer is active. Instead it returns an -EBUSY. But
       there's a small race window when a writer moves from one sub-buffer
       to the next that it resets the "committing" counter. If a swap
       happens at that moment, the buffer used for the commit of an event
       will not match the buffer the event is actually on. Instead of using
       the "committing" counter, use the recursive detection counter that
       does not get reset when the writer crosses sub-buffers.

     - Fix off-by-one in ftrace_free_mem()

       The function ftrace_free_mem() gets an "end_ptr" as a parameter that
       is exclusive to the rang to be freed. But its value is used to search
       for the records that expects an inclusive value. Subtract one from
       the parameter to convert it to an inclusive range.

     - Disable resizing of the ring buffer for persistent buffers

       Resizing the persistent buffer has undefined behavior. Prevent it
       from being resized.

     - Disable changing ring buffer subbuf order when resizing is disabled

       The ring buffer subbuffer order can not be changed during resizing.
       Use that instead of just checking if the buffer is mapped as mapped
       buffers also have resizing disabled.

     - Initialize subbuf_order of reader pages when they are created

       In rb_allocate_cpu_buffer() the bpage->order is not updated to the
       current subbuf_order leaving it as zero. This value is used when the
       page is freed.

     - Fix test_ringbuffer() to test for ERR_PTR before calling
       kthread_stop()

       The rb_threads[] array is assigned the output of kthread_run_on_cpu()
       which could return an ERR_PTR. At the end of the test, all threads in
       the array are cleaned up by kthread_stop() passing in the value in
       the array if it isn't zero. But if the array contains an ERR_PTR,
       kthread_stop() will not be able to handle it properly.

    * tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
      ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
      ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
      ring-buffer: Prevent subbuf order change when resizing is disabled
      ring-buffer: Prevent resizing of persistent ring buffer
      ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
      ring-buffer: Use current_context for safe per-CPU buffer swap
      ftrace: Drop extra comma in trace_buffered_event_enable
      ftrace: Protect direct_functions in update_ftrace_direct_mod
      ftrace: Protect direct_functions in update_ftrace_direct_del
      ftrace: Protect direct_functions in ftrace_find_rec_direct
      eventfs: Use children field for rcu head and add memory barriers
      eventfs: Fix use-after-free in eventfs_remove_rec()