Commit bf98d7b0d5a9 for kernel

commit bf98d7b0d5a99991e47e66cee4eb1d3fa514be97
Author: Vincent Donnefort <vdonnefort@google.com>
Date:   Thu Aug 6 22:13:02 2026 +0100

    ring-buffer: Prevent subbuf order change when resizing is disabled

    Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
    allow it when resizing is disabled. A non-consuming reader is at risk of
    use-after-free (rb_advance_iter()).

    Return -EBUSY on resize_disabled, matching ring_buffer_resize()
    behaviour.

    Cc: stable@vger.kernel.org
    Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
    Link: https://patch.msgid.link/20260806211306.3704194-3-vdonnefort@google.com
    Reported-by: syzbot+e0cc44465d6bae735679@syzkaller.appspotmail.com
    Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 09d502ef4c55..6cbd80ccef37 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7360,7 +7360,7 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)

 		cpu_buffer = buffer->buffers[cpu];

-		if (cpu_buffer->mapped) {
+		if (atomic_read(&cpu_buffer->resize_disabled)) {
 			err = -EBUSY;
 			goto error;
 		}