Pull tracing fixes from Steven Rostedt:

 - Fix use-after-free in eventfs_remove_rec()

   The freeing of the eventfs_inode children used list_for_each_entry()
   where the child is freed via srcu, but there's still a chance that it
   gets freed. It should be using list_for_each_entry_safe().

 - Fix eventfs_inode SRCU use of list in freeing

   The iterator uses an SRCU protected list walk on the eventfs inodes.
   The eventfs inode uses its "list" field in a union with the RCU list
   head. When the inode gets added to the SRCU list it immediately
   corrupts the list pointer and can cause an issue with the iterator.
   Move the RCU list head to be shared with the children list head which
   allows the iterator to check the parent inode if is freed before
   referencing the child. Have the iterator check the parent "is_freed"
   field and break out if it is set. Also add memory barriers to make
   sure the ordering is correct.

 - Fix various RCU synchronization issues with direct_functions

   Updates to direct_functions have some missing RCU protection and
   synchronization. Restructure the code a bit to make sure updates to
   the direct_functions are protected.

 - Remove an unneeded comma from a scope_guard()

   There's a spurious comma in a scope_guard(). Remove it.

 - Fix race in per CPU buffer swap in the ring buffer

   When a per CPU buffer swap happens, it must make sure that it doesn't
   occur while a writer is active. Instead it returns an -EBUSY. But
   there's a small race window when a writer moves from one sub-buffer
   to the next that it resets the "committing" counter. If a swap
   happens at that moment, the buffer used for the commit of an event
   will not match the buffer the event is actually on. Instead of using
   the "committing" counter, use the recursive detection counter that
   does not get reset when the writer crosses sub-buffers.

 - Fix off-by-one in ftrace_free_mem()

   The function ftrace_free_mem() gets an "end_ptr" as a parameter that
   is exclusive to the rang to be freed. But its value is used to search
   for the records that expects an inclusive value. Subtract one from
   the parameter to convert it to an inclusive range.

 - Disable resizing of the ring buffer for persistent buffers

   Resizing the persistent buffer has undefined behavior. Prevent it
   from being resized.

 - Disable changing ring buffer subbuf order when resizing is disabled

   The ring buffer subbuffer order can not be changed during resizing.
   Use that instead of just checking if the buffer is mapped as mapped
   buffers also have resizing disabled.

 - Initialize subbuf_order of reader pages when they are created

   In rb_allocate_cpu_buffer() the bpage->order is not updated to the
   current subbuf_order leaving it as zero. This value is used when the
   page is freed.

 - Fix test_ringbuffer() to test for ERR_PTR before calling
   kthread_stop()

   The rb_threads[] array is assigned the output of kthread_run_on_cpu()
   which could return an ERR_PTR. At the end of the test, all threads in
   the array are cleaned up by kthread_stop() passing in the value in
   the array if it isn't zero. But if the array contains an ERR_PTR,
   kthread_stop() will not be able to handle it properly.

* tag 'trace-v7.2-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  ring-buffer: Fix crash passing ERR_PTR to kthread_stop()
  ring-buffer: Initialise reader page order in rb_allocate_cpu_buffer()
  ring-buffer: Prevent subbuf order change when resizing is disabled
  ring-buffer: Prevent resizing of persistent ring buffer
  ftrace: Fix off-by-one fentry site disable in ftrace_free_mem()
  ring-buffer: Use current_context for safe per-CPU buffer swap
  ftrace: Drop extra comma in trace_buffered_event_enable
  ftrace: Protect direct_functions in update_ftrace_direct_mod
  ftrace: Protect direct_functions in update_ftrace_direct_del
  ftrace: Protect direct_functions in ftrace_find_rec_direct
  eventfs: Use children field for rcu head and add memory barriers
  eventfs: Fix use-after-free in eventfs_remove_rec()

Pull s390 fixes from Vasily Gorbik:

 - Fix potential uninitialized memory reads and buffer overflows from
   malformed zcrypt CCA and EP11 requests by properly validating lengths
   and payloads

 - Fix possible out of bounds accesses in zcrypt EP11 domain handling by
   replacing fixed payload layout assumptions with parsing ASN.1 fields
   with bounds checks

 - Fix zcrypt CCA and EP11 request and reply buffer allocations missing
   required 4-byte padding, and scrub the full allocation on release

 - Fix zcrypt CCA and EP11 messages leaking up to 3 uninitialized bytes
   of memory by zeroing trailing alignment padding

* tag 's390-7.2-7' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/zcrypt: Pad trailing CCA or EP11 message with zeros
  s390/zcrypt: Improve EP11 CPRB domain handling with ASN.1 parsing
  s390/zcrypt: Improve EP11 CPRB length and overflow checks
  s390/zcrypt: Improve CCA CPRB length and overflow checks
  s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code

In test_ringbuffer()'s out_free cleanup loop, the check
`!rb_threads[cpu]` only catches NULL entries and misses entries that
hold an ERR_PTR.

rb_threads[] is static, so unassigned slots are NULL. But when
kthread_run_on_cpu() fails for a cpu, it stores ERR_PTR(-ENOMEM) (or
-EINTR) in rb_threads[cpu] before the creation loop jumps to out_free.
That entry is non-NULL, so the old `!ptr` check does not break, and the
cleanup proceeds to call kthread_stop() on the ERR_PTR. kthread_stop()
then dereferences the bogus pointer, crashing the kernel during the
late_initcall self-test.

crash logs:
  BUG: kernel NULL pointer dereference, address: 000000000000001c
  Oops: 0002 [#1] SMP NOPTI
  CPU: 1 PID: 1 Comm: swapper/0 Not tainted 7.2.0-rc6-dirty #7 PREEMPT(lazy)
  RIP: 0010:kthread_stop+0x2e/0x220
  RBX: fffffffffffffff4
  CR2: 000000000000001c
  Call Trace:
   <TASK>
   test_ringbuffer+0x1ec/0x650
   do_one_initcall+0x6c/0x2c0
   kernel_init_freeable+0x21d/0x420
   kernel_init+0x15/0x1c0
   ret_from_fork+0x21b/0x320
   </TASK>
  Kernel panic - not syncing: Fatal exception

Cc: stable@vger.kernel.org
Fixes: 64ed3a049e3e ("ring-buffer: make use of the helper function kthread_run_on_cpu()")
Link: https://patch.msgid.link/20260807154145.2846521-2-sh_def@163.com
Signed-off-by: Hui Su <sh_def@163.com>
Reviewed-by: Vincent Donnefort <vdonnefort@google.com>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

In rb_allocate_cpu_buffer(), bpage->order was omitted, leaving it as 0.
This is an issue for a ring-buffer with subbufs bigger than PAGE_SIZE if
when freed: free_buffer_page() relies on this value. Align the value
with the actual allocation size (buffer::subbuf_order).

Cc: stable@vger.kernel.org
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Link: https://patch.msgid.link/20260806211306.3704194-4-vdonnefort@google.com
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

Because ring_buffer_subbuf_order_set() frees buffer pages, we can't
allow it when resizing is disabled. A non-consuming reader is at risk of
use-after-free (rb_advance_iter()).

Return -EBUSY on resize_disabled, matching ring_buffer_resize()
behaviour.

Cc: stable@vger.kernel.org
Fixes: f9b94daa542a ("ring-buffer: Set new size of the ring buffer sub page")
Link: https://patch.msgid.link/20260806211306.3704194-3-vdonnefort@google.com
Reported-by: syzbot+e0cc44465d6bae735679@syzkaller.appspotmail.com
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

Dynamically resizing a persistent ring buffer is not possible. Disable
the feature.

Cc: stable@vger.kernel.org
Fixes: be68d63a139b ("ring-buffer: Add ring_buffer_alloc_range()")
Link: https://patch.msgid.link/20260806211306.3704194-2-vdonnefort@google.com
Signed-off-by: Vincent Donnefort <vdonnefort@google.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

When a module's init text is freed, do_init_module() calls
ftrace_free_mem() with a half-open [start, end) range.  However the
ftrace_cmp_recs() comparator treats the upper bound as inclusive, as all
its other users do, passing 'ip + size - 1'.  So ftrace_free_mem() can
delete a record sitting exactly at 'end', which is outside the freed
range.

For a kernel without CFI or IBT, the first record of a function is at
the function start, which for the first function in a module is also the
base of its text allocation.  As the module allocator packs its regions,
that address is often the 'end' passed by a neighboring module's
do_init_module(), causing the first function's ftrace location to get
disabled, preventing an attempt to livepatch it:

  livepatch: failed to find location for function 'pcspkr_probe'

Convert the exclusive end to the inclusive 'end - 1' the comparator
expects, and return early for an empty range to avoid the subtraction
from underflowing when the init text size is zero.

Cc: stable@vger.kernel.org
Fixes: 42c269c88dc1 ("ftrace: Allow for function tracing to record init functions on boot up")
Link: https://patch.msgid.link/1b5ccfa8095bdb1277f84af1c2c2e2205aca03ae.1785992188.git.jpoimboe@kernel.org
Signed-off-by: Josh Poimboeuf <jpoimboe@kernel.org>
Acked-by: Masami Hiramatsu (Google) <mhiramat@kernel.org>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

The ring_buffer_swap_cpu() function currently checks the per-CPU
committing counter to determine if a buffer is actively being written to
before performing the swap. However, there exists a race window where
this check can be bypassed:

    ring_buffer_lock_reserve
        cpu_buffer = buffer->buffers[cpu];       // cpu_buffer_a
        rb_reserve_next_event
            rb_start_commit // inc committing
            if (unlikely(READ_ONCE(cpu_buffer->buffer) != buffer)) {...}
            __rb_reserve_next
                rb_move_tail
                    rb_end_commit(cpu_buffer);   // dec committing => 0
                    /* interrupt hits here, successfully swaps! */
                    local_inc(&cpu_buffer->committing);

    ring_buffer_unlock_commit
        cpu_buffer = buffer->buffers[cpu];      // cpu_buffer_b
        rb_commit
            rb_end_commit
            RB_WARN_ON(cpu_buffer, !local_read(&cpu_buffer->committing))
                                                // triggers warning

The committing counter can temporarily drop to 0 during a single write
operation (within rb_move_tail), creating a window where swap can
succeed even though the write is still in progress. This leads to
inconsistent buffer state and triggers the RB_WARN_ON in rb_commit().

Replace the committing counter check with current_context checks, which
are set at the entry of ring_buffer_lock_reserve() and remain valid
throughout the entire write operation, providing a reliable indicator of
buffer busy state during swap.

Cc: stable@vger.kernel.org
Fixes: 4239c38fe0b3 ("ring-buffer: Process commits whenever moving to a new page.")
Link: https://patch.msgid.link/20260803005640.2445666-2-wutengda@huaweicloud.com
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

Pull x86 fix from Ingo Molnar:

 - Fix MCE CMCI discovery initialization ordering bug (Breno Leitao)

* tag 'x86-urgent-2026-08-08' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mce: Set up the polling timer before CMCI discovery