Re: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap_close

Re: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap_close

[Steven Rostedt]

On Fri, 27 Feb 2026 10:20:38 -0500
Steven Rostedt <rostedt@goodmis.org> wrote:

> On Fri, 27 Feb 2026 11:22:22 +0000
> Vincent Donnefort <vdonnefort@google.com> wrote:
> 
> > > Ah right, Syzkaller is using madvise(MADVISE_DOFORK) which resets VM_DONTCOPY.    
> > 
> > As we are applying restrictive rules for this mapping, I believe setting VM_IO
> > might be a better fix.  
> 
> Agreed.
> 

Adding MM folks so we do this right.

Dear MM folks,

Here's the issue. When the ftrace ring buffer is memory mapped to user
space, we do not want anything "special" done to it. One of those things we
did not want done was to have it copied on fork. To do that, we added
VM_DONTCOPY, but we didn't know that an madvise() could disable that. It
looks like VM_IO will prevent that from happening.

But looking at the various flags, I see there's a VM_SPECIAL. I'm wondering
if that is what we should use?

The effected code is here:

   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/trace/ring_buffer.c#n7172

What's your thoughts?

Thanks,

-- Steve

Re: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap_close

[Lorenzo Stoakes]

+cc David.

On Fri, Feb 27, 2026 at 03:56:01PM -0500, Steven Rostedt wrote:
> On Fri, 27 Feb 2026 10:20:38 -0500
> Steven Rostedt <rostedt@goodmis.org> wrote:
>
> > On Fri, 27 Feb 2026 11:22:22 +0000
> > Vincent Donnefort <vdonnefort@google.com> wrote:
> >
> > > > Ah right, Syzkaller is using madvise(MADVISE_DOFORK) which resets VM_DONTCOPY.
> > >
> > > As we are applying restrictive rules for this mapping, I believe setting VM_IO
> > > might be a better fix.
> >
> > Agreed.
> >
>
> Adding MM folks so we do this right.
>
> Dear MM folks,
>
> Here's the issue. When the ftrace ring buffer is memory mapped to user
> space, we do not want anything "special" done to it. One of those things we
> did not want done was to have it copied on fork. To do that, we added
> VM_DONTCOPY, but we didn't know that an madvise() could disable that. It
> looks like VM_IO will prevent that from happening.
>
> But looking at the various flags, I see there's a VM_SPECIAL. I'm wondering
> if that is what we should use?

VM_SPECIAL is not a VMA flag, it's a bitmask of all the flags which cause us not
to permit things like splitting/merging of VMAs (because we can't safely do
them), i.e. that are one or more of:

        VM_IO - Memory-mapped I/O range.

    VM_PFNMAP - A mapping without struct folio's/page's backing them, e.g. perhaps a
                raw kernel mapping.

  VM_MIXEDMAP - A combination of page/folio-backed memory and/or PFN-backed memory.

VM_DONTEXPAND - Disallow expansion of memory in mremap().

You already set VM_DONTEXPAND so you get these semantics already.

Setting VM_IO just to trigger a failure case in madvise() feels like a hack? I
guess it'd do the trick though, but you're not going to be able to reclaim that
memory, and you might get some unexpected behaviour in code paths that assume
VM_IO means it's memory-mapped I/O... (for instance GUP will stop working, if
you need that).

I'd take a step back and wonder why you are wanting to not allow copying on
fork? Is this kernel-allocated memory? In which case you should set VM_MIXEDMAP
or VM_PFNMAP as appropriate... If not and it has a folio etc. then it seems like
strange semantics.

Are you really bothered also by users doing strange things? Maybe the solution
is to tolerate a fork-copy even if it's broken? I presume somethings straight up
breaks right now?

Without more context that I don't really have much time to acquire it's hard to
know what to advise.

>
> The effected code is here:
>
>    https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/kernel/trace/ring_buffer.c#n7172
>
> What's your thoughts?
>
> Thanks,
>
> -- Steve

Cheers, Lorenzo

Re: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap_close

[Steven Rostedt]

On Mon, 2 Mar 2026 12:13:24 +0000
Lorenzo Stoakes <lorenzo.stoakes@oracle.com> wrote:

Hi Lorenzo,

Thanks for looking into this.

> > But looking at the various flags, I see there's a VM_SPECIAL. I'm wondering
> > if that is what we should use?  
> 
> VM_SPECIAL is not a VMA flag, it's a bitmask of all the flags which cause us not
> to permit things like splitting/merging of VMAs (because we can't safely do
> them), i.e. that are one or more of:

Yep, I knew it wasn't a flag, and actually picked it because it looked to
have the flags we may have wanted.

> 
>         VM_IO - Memory-mapped I/O range.
> 
>     VM_PFNMAP - A mapping without struct folio's/page's backing them, e.g. perhaps a
>                 raw kernel mapping.
> 
>   VM_MIXEDMAP - A combination of page/folio-backed memory and/or PFN-backed memory.
> 
> VM_DONTEXPAND - Disallow expansion of memory in mremap().
> 
> You already set VM_DONTEXPAND so you get these semantics already.
> 
> Setting VM_IO just to trigger a failure case in madvise() feels like a hack? I
> guess it'd do the trick though, but you're not going to be able to reclaim that
> memory, and you might get some unexpected behaviour in code paths that assume
> VM_IO means it's memory-mapped I/O... (for instance GUP will stop working, if
> you need that).

Well, we don't reclaim that memory anyway.

> 
> I'd take a step back and wonder why you are wanting to not allow copying on
> fork? Is this kernel-allocated memory? In which case you should set VM_MIXEDMAP
> or VM_PFNMAP as appropriate... If not and it has a folio etc. then it seems like
> strange semantics.
> 
> Are you really bothered also by users doing strange things? Maybe the solution
> is to tolerate a fork-copy even if it's broken? I presume somethings straight up
> breaks right now?

Yeah, right now the accounting gets screwed up as the mappings get out of
sync when it is forked.

> 
> Without more context that I don't really have much time to acquire it's hard to
> know what to advise.

Fair enough, let me explain everything then ;-)

This is a mapping of the ftrace ring buffer to user space. Until recently,
the only way user space could get access to the ftrace ring buffer was to
either read it, or splice() it to a file/pipe/whatever.

The way the ftrace ring buffer works is that it is made up of a bunch of
sub-buffers (must be multiple of PAGE_SIZE and usually is a single page).
There is one sub-buffer called the "reader-page" which writers never write
to (with an exception out of scope for understanding the mappings).

The "reader-page" is a sub-buffer that belongs to the reader. When the
reader is finish with it and wants to read more of the buffer, an operation
is performed to swap the current reader-page with one of the pages that the
writers have. The new page is now owned by the reader and writers will
leave it alone. This allows readers to do a zero copy splice of the data in
the ring buffer.

Now we added a feature to memory map this buffer to user space. The
reader-page and writer sub-buffers are all mapped read-only into the user's
memory address.

Another page is mapped called the "meta page" which tells user space how to
read the buffer (which sub-buffer is the current reader-page and the order
of the write sub-buffers).

The read-page is what user space will read directly, and when it is done,
it does an ioctl() on the file descriptor for the buffer:

  /sys/kernel/tracing/per_cpu/cpu*/trace_pipe_raw

One command of the ioctl() will tell the kernel to swap the reader-page with
a writer sub-buffer. The meta page is updated and the user space
application can read that.

Now the meta page is unique per ring buffer and not per process. If there's
a fork, any change to the meta page will affect all processes that have
this mapped.

If two processes map the same buffer, one process will see any updates in
its meta page that another process does to it.

Now there is nothing wrong with doing that, accept the user space processes
will likely get confused. And we currently allow two separate tasks to mmap
it at the same time (maybe we shouldn't have!).

What we didn't allow was forking, as the code didn't update the proper
accounting. It needs to know that the buffer is mapped because it handles
splice differently. As the pages are mapped to user space, the kernel can't
just allow splice to steal a page and send it off to whatever pipe. Instead
it makes a copy of the page (basically killing the performance splice()
gives it in the first place).

We originally added the DONTFORK so that we didn't need to handle the fork
case, but I'm guessing that you are suggesting that we should do that
instead of preventing it from being duplicated on fork. Am I correct?

-- Steve