Re: [PATCH] tracing: Fix WARN_ON in tracing_buffers_mmap_close

[Lorenzo Stoakes <lorenzo.stoakes@oracle.com>]

On Mon, Mar 02, 2026 at 11:52:20AM -0500, Steven Rostedt wrote:
> On Mon, 2 Mar 2026 12:13:24 +0000
> Lorenzo Stoakes <lorenzo.stoakes@oracle.com> wrote:
>
> Hi Lorenzo,
>
> Thanks for looking into this.
>
> > > But looking at the various flags, I see there's a VM_SPECIAL. I'm wondering
> > > if that is what we should use?
> >
> > VM_SPECIAL is not a VMA flag, it's a bitmask of all the flags which cause us not
> > to permit things like splitting/merging of VMAs (because we can't safely do
> > them), i.e. that are one or more of:
>
> Yep, I knew it wasn't a flag, and actually picked it because it looked to
> have the flags we may have wanted.

Yeah you shouldn't set that is TL;DR on that :P

>
> >
> >         VM_IO - Memory-mapped I/O range.
> >
> >     VM_PFNMAP - A mapping without struct folio's/page's backing them, e.g. perhaps a
> >                 raw kernel mapping.
> >
> >   VM_MIXEDMAP - A combination of page/folio-backed memory and/or PFN-backed memory.
> >
> > VM_DONTEXPAND - Disallow expansion of memory in mremap().
> >
> > You already set VM_DONTEXPAND so you get these semantics already.
> >
> > Setting VM_IO just to trigger a failure case in madvise() feels like a hack? I
> > guess it'd do the trick though, but you're not going to be able to reclaim that
> > memory, and you might get some unexpected behaviour in code paths that assume
> > VM_IO means it's memory-mapped I/O... (for instance GUP will stop working, if
> > you need that).
>
> Well, we don't reclaim that memory anyway.

OK so maybe not such an issue then! As long as GUP not working with it wouldn't
break anything?

>
> >
> > I'd take a step back and wonder why you are wanting to not allow copying on
> > fork? Is this kernel-allocated memory? In which case you should set VM_MIXEDMAP
> > or VM_PFNMAP as appropriate... If not and it has a folio etc. then it seems like
> > strange semantics.
> >
> > Are you really bothered also by users doing strange things? Maybe the solution
> > is to tolerate a fork-copy even if it's broken? I presume somethings straight up
> > breaks right now?
>
> Yeah, right now the accounting gets screwed up as the mappings get out of
> sync when it is forked.

Ack, is that in a way that could screw up things from a kernel point of view at
all? Presumably there was some report that triggered this work, like an assert
fail or something, or a warning?

If a user is explicitly going to an ftrace buffer and madvise()'ing it in random
ways they've only themselves to blame for being so stupid :)

As long as it's not exploitable in some way I don't think that's too much of an
issue?

It'd be nice to keep the semantics of 'don't copy on fork' if we could, even if
some crazy users might override it with madvise().

>
> >
> > Without more context that I don't really have much time to acquire it's hard to
> > know what to advise.
>
> Fair enough, let me explain everything then ;-)
>
> This is a mapping of the ftrace ring buffer to user space. Until recently,
> the only way user space could get access to the ftrace ring buffer was to
> either read it, or splice() it to a file/pipe/whatever.
>
> The way the ftrace ring buffer works is that it is made up of a bunch of
> sub-buffers (must be multiple of PAGE_SIZE and usually is a single page).
> There is one sub-buffer called the "reader-page" which writers never write
> to (with an exception out of scope for understanding the mappings).
>
> The "reader-page" is a sub-buffer that belongs to the reader. When the
> reader is finish with it and wants to read more of the buffer, an operation
> is performed to swap the current reader-page with one of the pages that the
> writers have. The new page is now owned by the reader and writers will
> leave it alone. This allows readers to do a zero copy splice of the data in
> the ring buffer.
>
> Now we added a feature to memory map this buffer to user space. The
> reader-page and writer sub-buffers are all mapped read-only into the user's
> memory address.
>
> Another page is mapped called the "meta page" which tells user space how to
> read the buffer (which sub-buffer is the current reader-page and the order
> of the write sub-buffers).
>
> The read-page is what user space will read directly, and when it is done,
> it does an ioctl() on the file descriptor for the buffer:
>
>   /sys/kernel/tracing/per_cpu/cpu*/trace_pipe_raw
>
> One command of the ioctl() will tell the kernel to swap the reader-page with
> a writer sub-buffer. The meta page is updated and the user space
> application can read that.
>
> Now the meta page is unique per ring buffer and not per process. If there's
> a fork, any change to the meta page will affect all processes that have
> this mapped.
>
> If two processes map the same buffer, one process will see any updates in
> its meta page that another process does to it.
>
> Now there is nothing wrong with doing that, accept the user space processes
> will likely get confused. And we currently allow two separate tasks to mmap
> it at the same time (maybe we shouldn't have!).
>
> What we didn't allow was forking, as the code didn't update the proper
> accounting. It needs to know that the buffer is mapped because it handles
> splice differently. As the pages are mapped to user space, the kernel can't
> just allow splice to steal a page and send it off to whatever pipe. Instead
> it makes a copy of the page (basically killing the performance splice()
> gives it in the first place).
>
> We originally added the DONTFORK so that we didn't need to handle the fork
> case, but I'm guessing that you are suggesting that we should do that
> instead of preventing it from being duplicated on fork. Am I correct?

Thanks for that!

Kind of separate from the question, but I mean if it's kernel-allocated memory
which you're managing separately it should surely be VM_PFNMAP?

It depends if you want to have a refcounted folio underneath though. If you do
then yeah don't do that :)

In general I'd suggest supporting the fork case if you can, or just let things
be wrong if a user does something crazy and undoes the VM_DONTCOPY flag.

>
> -- Steve
>

Cheers, Lorenzo