Commit d860c67c0516 for kernel

commit d860c67c051685abb0460b593b193f0f45f4fa92
Author: David Carlier <devnexen@gmail.com>
Date:   Sat Sep 12 11:39:38 2026 +0100

    ring-buffer: Check resize_disabled before publishing the new subbuf order

    ring_buffer_subbuf_order_set() stores the new order and only then walks
    the CPUs, returning -EBUSY if any of them has resizing disabled. A user
    mapped buffer has resizing disabled, and __rb_map_vma() reads
    buffer->subbuf_order without buffer->mutex, so an mmap of an already
    mapped CPU racing the failing order change sizes the mapping with the
    new order and inserts pages past the sub-buffer into the VMA.

    Check the CPUs before storing the new order.

    Cc: stable@vger.kernel.org
    Fixes: 117c39200d9d ("ring-buffer: Introducing ring-buffer mapping functions")
    Link: https://patch.msgid.link/20260912103938.1127021-1-devnexen@gmail.com
    Signed-off-by: David Carlier <devnexen@gmail.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 9bc8ce8c5676..04bb94c29f58 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -7473,6 +7473,14 @@ int ring_buffer_subbuf_order_set(struct trace_buffer *buffer, int order)

 	old_capacity = rb_subbuf_capacity(buffer);

+	/* The mmap fast path reads subbuf_order without buffer->mutex. */
+	for_each_buffer_cpu(buffer, cpu) {
+		if (!cpumask_test_cpu(cpu, buffer->cpumask))
+			continue;
+		if (atomic_read(&buffer->buffers[cpu]->resize_disabled))
+			return -EBUSY;
+	}
+
 	atomic_inc(&buffer->record_disabled);

 	/* Make sure all commits have finished */