Daily update · Aug 9–10, 2026
Tracing subsystem gets a load of fixes as 7.2-rc7 lands
eventfs, ftrace, and ring-buffer all receive corrections for use-after-free conditions, RCU protection gaps, and a self-test crash.
In brief
The 7.2-rc7 release is dominated by a sizeable set of tracing fixes. eventfs closes a use-after-free in recursive removal and tightens memory ordering around SRCU freeing; ftrace gains RCU protection for its direct_functions hash and fixes an off-by-one when freeing module init text; ring-buffer fixes a swap race, blocks unsafe resizing of persistent buffers, and repairs a kthread cleanup crash in its self-test.
eventfs
Fix use-after-free in eventfs_remove_rec()
When recursively removing eventfs inodes, list_for_each_entry() read list.next from a child that could already be freed by an SRCU callback. Switched to list_for_each_entry_safe() to capture the next sibling before recursion.
Why it matters: Prevents a use-after-free when tearing down eventfs subtrees under tracefs; tagged for stable.
Separate rcu head from children list and add memory barriers
The ei->list field was unioned with the SRCU callback head, so a concurrent SRCU-protected iteration could read a corrupted target when an inode was being freed. The rcu head is now placed in a dedicated children field, with smp_wmb()/smp_rmb() pairing around the is_freed flag.
Why it matters: Avoids corrupted list traversal during eventfs inode teardown.
ftrace
Add RCU protection for direct_functions access
Three paths (ftrace_find_rec_direct, update_ftrace_direct_del, update_ftrace_direct_mod) accessed the __rcu direct_functions pointer without RCU protection, risking stale reads. Each now dereferences under RCU.
Why it matters: Fixes potential unsafe access to the direct_functions hash; all three tagged for stable.
Fix off-by-one fentry site disable in ftrace_free_mem()
do_init_module() passes a half-open [start, end) range, but the record comparator treats the upper bound as inclusive. This could delete an ftrace record for a neighboring module's first function when module init text is freed.
Why it matters: Avoids losing ftrace coverage for the first function of an adjacent module after init cleanup.
ring-buffer
Use current_context for safe per-CPU buffer swap
ring_buffer_swap_cpu() checked the committing counter, but an interrupt window between rb_end_commit decrement and a later check allowed a swap to slip through while a reservation was still in progress. The check now uses current_context.
Why it matters: Closes a race that could corrupt per-CPU buffer swaps.
Block unsafe resizing and subbuf order changes
Persistent ring buffers cannot be dynamically resized, so resizing is now disabled for them. Separately, ring_buffer_subbuf_order_set() frees pages and could trigger use-after-free against a non-consuming reader when resizing is disabled, so it now returns -EBUSY in that case.
Why it matters: Prevents use-after-free in subbuf order changes; both tagged for stable.
Initialize reader page order and fix self-test crash
rb_allocate_cpu_buffer() left bpage->order as 0, breaking free_buffer_page() for sub-buffers larger than PAGE_SIZE; now set from buffer::subbuf_order. Separately, test_ringbuffer() cleanup called kthread_stop() on ERR_PTR entries, crashing the late_initcall self-test; the cleanup now handles error pointers.
Why it matters: Avoids incorrect frees for large sub-buffers and a NULL-pointer crash in the ring-buffer self-test; the order init is tagged for stable.
Release
Linux 7.2-rc7 tagged
Linus released 7.2-rc7; the diff is dominated by the tracing fixes above.
Why it matters: Likely the final or near-final rc before 7.2.
Source commits13 entries +
ftrace: Protect direct_functions in ftrace_find_rec_direct
Leon Hwang · Jul 30, 2026 · 1 files
ftrace: Protect direct_functions in update_ftrace_direct_del
Leon Hwang · Jul 30, 2026 · 1 files
ftrace: Protect direct_functions in update_ftrace_direct_mod
Leon Hwang · Jul 30, 2026 · 1 files
ftrace: Drop extra comma in trace_buffered_event_enable
Leon Hwang · Jul 30, 2026 · 1 files
ring-buffer: Use current_context for safe per-CPU buffer swap
Tengda Wu · Aug 3, 2026 · 1 files
eventfs: Fix use-after-free in eventfs_remove_rec()
Shuangpeng Bai · Aug 6, 2026 · 1 files
ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
Josh Poimboeuf · Aug 6, 2026 · 1 files
ring-buffer: Prevent resizing of persistent ring buffer
Vincent Donnefort · Aug 6, 2026 · 1 files
ring-buffer: Prevent subbuf order change when resizing is disabled
Vincent Donnefort · Aug 6, 2026 · 1 files
ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
Vincent Donnefort · Aug 6, 2026 · 1 files
ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
Hui Su · Aug 7, 2026 · 1 files
eventfs: Use children field for rcu head and add memory barriers
Steven Rostedt · Aug 8, 2026 · 2 files
Linux 7.2-rc7
Linus Torvalds · Aug 9, 2026 · 1 files