{ "schema_version": "1.6.1", "id": "RPI-CVE-2023-53368", "modified": "2026-10-07T17:22:01Z", "upstream": [ "CVE-2023-53368" ], "published": "2025-09-17T14:57:20Z", "summary": "tracing: Fix race issue between cpu buffer write and swap", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntracing: Fix race issue between cpu buffer write and swap\n\nWarning happened in rb_end_commit() at code:\n\tif (RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing)))\n\n WARNING: CPU: 0 PID: 139 at kernel/trace/ring_buffer.c:3142\n\trb_commit+0x402/0x4a0\n Call Trace:\n ring_buffer_unlock_commit+0x42/0x250\n trace_buffer_unlock_commit_regs+0x3b/0x250\n trace_event_buffer_commit+0xe5/0x440\n trace_event_buffer_reserve+0x11c/0x150\n trace_event_raw_event_sched_switch+0x23c/0x2c0\n __traceiter_sched_switch+0x59/0x80\n __schedule+0x72b/0x1580\n schedule+0x92/0x120\n worker_thread+0xa0/0x6f0\n\nIt is because the race between writing event into cpu buffer and swapping\ncpu buffer through file per_cpu/cpu0/snapshot:\n\n Write on CPU 0 Swap buffer by per_cpu/cpu0/snapshot on CPU 1\n -------- --------\n tracing_snapshot_write()\n [...]\n\n ring_buffer_lock_reserve()\n cpu_buffer = buffer->buffers[cpu]; // 1. Suppose find 'cpu_buffer_a';\n [...]\n rb_reserve_next_event()\n [...]\n\n ring_buffer_swap_cpu()\n if (local_read(&cpu_buffer_a->committing))\n goto out_dec;\n if (local_read(&cpu_buffer_b->committing))\n goto out_dec;\n buffer_a->buffers[cpu] = cpu_buffer_b;\n buffer_b->buffers[cpu] = cpu_buffer_a;\n // 2. cpu_buffer has swapped here.\n\n rb_start_commit(cpu_buffer);\n if (unlikely(READ_ONCE(cpu_buffer->buffer)\n != buffer)) { // 3. This check passed due to 'cpu_buffer->buffer'\n [...] // has not changed here.\n return NULL;\n }\n cpu_buffer_b->buffer = buffer_a;\n cpu_buffer_a->buffer = buffer_b;\n [...]\n\n // 4. Reserve event from 'cpu_buffer_a'.\n\n ring_buffer_unlock_commit()\n [...]\n cpu_buffer = buffer->buffers[cpu]; // 5. Now find 'cpu_buffer_b' !!!\n rb_commit(cpu_buffer)\n rb_end_commit() // 6. WARN for the wrong 'committing' state !!!\n\nBased on above analysis, we can easily reproduce by following testcase:\n ``` bash\n #!/bin/bash\n\n dmesg -n 7\n sysctl -w kernel.panic_on_warn=1\n TR=/sys/kernel/tracing\n echo 7 > ${TR}/buffer_size_kb\n echo \"sched:sched_switch\" > ${TR}/set_event\n while [ true ]; do\n echo 1 > ${TR}/per_cpu/cpu0/snapshot\n done &\n while [ true ]; do\n echo 1 > ${TR}/per_cpu/cpu0/snapshot\n done &\n while [ true ]; do\n echo 1 > ${TR}/per_cpu/cpu0/snapshot\n done &\n ```\n\nTo fix it, IIUC, we can use smp_call_function_single() to do the swap on\nthe target cpu where the buffer is located, so that above race would be\navoided.", "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:12", "name": "linux" }, "versions": [ "1:6.1.21-1+rpt1", "1:6.1.47-1+rpt2", "1:6.1.47-1+rpt4" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.1.0-rpi1-rpi-v6", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v7", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v7l", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi1-rpi-v8", "binary_version": "1:6.1.21-1+rpt1" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v6", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v7", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v7l", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi2-rpi-v8", "binary_version": "1:6.1.47-1+rpt2" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-2712", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v6", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l", "binary_version": "1:6.1.47-1+rpt4" }, { "binary_name": "linux-image-6.1.0-rpi3-rpi-v8", "binary_version": "1:6.1.47-1+rpt4" } ] }, "database_specific": { "per_version": { "1:6.1.21-1+rpt1": { "linux_commit": "0afb5e98488aed7017b9bf321b575d0177feb7ed", "upstream_version": "6.1.21", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.53" }, "1:6.1.47-1+rpt2": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.53" }, "1:6.1.47-1+rpt4": { "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e", "upstream_version": "6.1.47", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.1.53", "compiled_filter": false } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2023-53368" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/90e037cabc2c2dfc39b3dd9c5b22ea91f995539a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c5d30d6aa83d99fba8dfdd9cf6c4e4e7a63244db" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/6182318ac04648b46db9d441fd7d696337fcdd0b" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/74c85396bd73eca80b96510b4edf93b9a3aff75f" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/89c89da92a60028013f9539be0dcce7e44405a43" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/37ca1b686078b00cc4ffa008e2190615f7709b5d" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/3163f635b20e9e1fb4659e74f47918c9dddfe64e" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-05-12T04:54:46Z" } }