Commit f27bdc43077e for kernel

commit f27bdc43077e4fcb5557dfc315ee8d91e741f483
Author: Tengda Wu <wutengda@huaweicloud.com>
Date:   Mon Aug 3 00:56:39 2026 +0000

    ring-buffer: Use current_context for safe per-CPU buffer swap

    The ring_buffer_swap_cpu() function currently checks the per-CPU
    committing counter to determine if a buffer is actively being written to
    before performing the swap. However, there exists a race window where
    this check can be bypassed:

        ring_buffer_lock_reserve
            cpu_buffer = buffer->buffers[cpu];       // cpu_buffer_a
            rb_reserve_next_event
                rb_start_commit // inc committing
                if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}
                __rb_reserve_next
                    rb_move_tail
                        rb_end_commit(cpu_buffer);   // dec committing => 0
                        /* interrupt hits here, successfully swaps! */
                        local_inc(&cpu_buffer->committing);

        ring_buffer_unlock_commit
            cpu_buffer = buffer->buffers[cpu];      // cpu_buffer_b
            rb_commit
                rb_end_commit
                RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))
                                                    // triggers warning

    The committing counter can temporarily drop to 0 during a single write
    operation (within rb_move_tail), creating a window where swap can
    succeed even though the write is still in progress. This leads to
    inconsistent buffer state and triggers the RB_WARN_ON in rb_commit().

    Replace the committing counter check with current_context checks, which
    are set at the entry of ring_buffer_lock_reserve() and remain valid
    throughout the entire write operation, providing a reliable indicator of
    buffer busy state during swap.

    Cc: stable@vger.kernel.org
    Fixes: 4239c38fe0b3 ("ring-buffer: Process commits whenever moving to a new page.")
    Link: https://patch.msgid.link/20260803005640.2445666-2-wutengda@huaweicloud.com
    Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
    Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 8e2485bb3aa8..58dc8995a88d 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -6852,7 +6852,7 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a,
 {
 	struct ring_buffer_per_cpu *cpu_buffer_a;
 	struct ring_buffer_per_cpu *cpu_buffer_b;
-	int ret = -EINVAL;
+	int ret = -EBUSY;

 	if (!cpumask_test_cpu(cpu, buffer_a->cpumask) ||
 	    !cpumask_test_cpu(cpu, buffer_b->cpumask))
@@ -6893,10 +6893,10 @@ int ring_buffer_swap_cpu(struct trace_buffer *buffer_a,
 	atomic_inc(&cpu_buffer_a->record_disabled);
 	atomic_inc(&cpu_buffer_b->record_disabled);

-	ret = -EBUSY;
-	if (local_read(&cpu_buffer_a->committing))
+	/* Do not swap if either buffer is in the process of writing */
+	if (cpu_buffer_a->current_context)
 		goto out_dec;
-	if (local_read(&cpu_buffer_b->committing))
+	if (cpu_buffer_b->current_context)
 		goto out_dec;

 	/*