All of lore.kernel.org
 help / color / mirror / Atom feed
From: Peter Zijlstra <peterz@infradead.org>
To: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Cc: Mark Rutland <mark.rutland@arm.com>,
	Mathieu Poirier <mathieu.poirier@linaro.org>,
	Suzuki K Poulose <suzuki.poulose@arm.com>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	linux-arm-msm@vger.kernel.org, coresight@lists.linaro.org,
	linux-kernel@vger.kernel.org,
	Arnaldo Carvalho de Melo <acme@kernel.org>,
	Stephen Boyd <swboyd@chromium.org>,
	Ingo Molnar <mingo@redhat.com>,
	Namhyung Kim <namhyung@kernel.org>, Jiri Olsa <jolsa@redhat.com>,
	linux-arm-kernel@lists.infradead.org,
	Mike Leach <mike.leach@linaro.org>
Subject: Re: [PATCHv2 2/4] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()
Date: Thu, 22 Oct 2020 15:34:14 +0200	[thread overview]
Message-ID: <20201022133414.GH2611@hirez.programming.kicks-ass.net> (raw)
In-Reply-To: <a6eadc723ae52396a655c61b9f8d4eef@codeaurora.org>

On Thu, Oct 22, 2020 at 06:19:37PM +0530, Sai Prakash Ranjan wrote:
> On 2020-10-22 17:02, Peter Zijlstra wrote:
> > On Thu, Oct 22, 2020 at 04:27:52PM +0530, Sai Prakash Ranjan wrote:
> > 
> > > Looking at the ETR and other places in the kernel, ETF and the
> > > ETB are the only places trying to dereference the task(owner)
> > > in tmc_enable_etf_sink_perf() which is also called from the
> > > sched_in path as in the call trace.
> > 
> > > @@ -391,6 +392,10 @@ static void *tmc_alloc_etf_buffer(struct
> > > coresight_device *csdev,
> > >  {
> > >  	int node;
> > >  	struct cs_buffers *buf;
> > > +	struct task_struct *task = READ_ONCE(event->owner);
> > > +
> > > +	if (!task || is_kernel_event(event))
> > > +		return NULL;
> > 
> > 
> > This is *wrong*... why do you care about who owns the events?
> > 
> 
> The original issue was the owner being NULL and causing
> a NULL pointer dereference. I did ask some time back
> if it is valid for the owner to be NULL [1] and should
> probably be handled in events core?

No, what I asked is why do you care about ->owner to begin with? That
seems wrong. A driver should not touch ->owner _at_all_.

WARNING: multiple messages have this Message-ID (diff)
From: Peter Zijlstra <peterz@infradead.org>
To: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Cc: Mark Rutland <mark.rutland@arm.com>,
	Mathieu Poirier <mathieu.poirier@linaro.org>,
	Suzuki K Poulose <suzuki.poulose@arm.com>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	linux-arm-msm@vger.kernel.org, coresight@lists.linaro.org,
	linux-kernel@vger.kernel.org,
	Arnaldo Carvalho de Melo <acme@kernel.org>,
	Stephen Boyd <swboyd@chromium.org>,
	Ingo Molnar <mingo@redhat.com>,
	Namhyung Kim <namhyung@kernel.org>, Jiri Olsa <jolsa@redhat.com>,
	linux-arm-kernel@lists.infradead.org,
	Mike Leach <mike.leach@linaro.org>
Subject: Re: [PATCHv2 2/4] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()
Date: Thu, 22 Oct 2020 15:34:14 +0200	[thread overview]
Message-ID: <20201022133414.GH2611@hirez.programming.kicks-ass.net> (raw)
In-Reply-To: <a6eadc723ae52396a655c61b9f8d4eef@codeaurora.org>

On Thu, Oct 22, 2020 at 06:19:37PM +0530, Sai Prakash Ranjan wrote:
> On 2020-10-22 17:02, Peter Zijlstra wrote:
> > On Thu, Oct 22, 2020 at 04:27:52PM +0530, Sai Prakash Ranjan wrote:
> > 
> > > Looking at the ETR and other places in the kernel, ETF and the
> > > ETB are the only places trying to dereference the task(owner)
> > > in tmc_enable_etf_sink_perf() which is also called from the
> > > sched_in path as in the call trace.
> > 
> > > @@ -391,6 +392,10 @@ static void *tmc_alloc_etf_buffer(struct
> > > coresight_device *csdev,
> > >  {
> > >  	int node;
> > >  	struct cs_buffers *buf;
> > > +	struct task_struct *task = READ_ONCE(event->owner);
> > > +
> > > +	if (!task || is_kernel_event(event))
> > > +		return NULL;
> > 
> > 
> > This is *wrong*... why do you care about who owns the events?
> > 
> 
> The original issue was the owner being NULL and causing
> a NULL pointer dereference. I did ask some time back
> if it is valid for the owner to be NULL [1] and should
> probably be handled in events core?

No, what I asked is why do you care about ->owner to begin with? That
seems wrong. A driver should not touch ->owner _at_all_.

_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel

  reply	other threads:[~2020-10-22 13:34 UTC|newest]

Thread overview: 63+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-10-22 10:57 [PATCHv2 0/4] coresight: etf/etb10/etr: Fix NULL pointer dereference crashes Sai Prakash Ranjan
2020-10-22 10:57 ` Sai Prakash Ranjan
2020-10-22 10:57 ` [PATCHv2 1/4] perf/core: Export is_kernel_event() Sai Prakash Ranjan
2020-10-22 10:57   ` Sai Prakash Ranjan
2020-10-31  7:35   ` kernel test robot
2020-10-22 10:57 ` [PATCHv2 2/4] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() Sai Prakash Ranjan
2020-10-22 10:57   ` Sai Prakash Ranjan
2020-10-22 11:32   ` Peter Zijlstra
2020-10-22 11:32     ` Peter Zijlstra
2020-10-22 12:49     ` Sai Prakash Ranjan
2020-10-22 12:49       ` Sai Prakash Ranjan
2020-10-22 13:34       ` Peter Zijlstra [this message]
2020-10-22 13:34         ` Peter Zijlstra
2020-10-22 14:23         ` Sai Prakash Ranjan
2020-10-22 14:23           ` Sai Prakash Ranjan
2020-10-22 13:30     ` Suzuki Poulose
2020-10-22 13:30       ` Suzuki Poulose
2020-10-22 15:06       ` Peter Zijlstra
2020-10-22 15:06         ` Peter Zijlstra
2020-10-22 15:32         ` Suzuki Poulose
2020-10-22 15:32           ` Suzuki Poulose
2020-10-22 21:20           ` Mathieu Poirier
2020-10-22 21:20             ` Mathieu Poirier
2020-10-23  7:39             ` Peter Zijlstra
2020-10-23  7:39               ` Peter Zijlstra
2020-10-23  8:49               ` Suzuki Poulose
2020-10-23  8:49                 ` Suzuki Poulose
2020-10-23  9:23                 ` Peter Zijlstra
2020-10-23  9:23                   ` Peter Zijlstra
2020-10-23 10:49                   ` Suzuki Poulose
2020-10-23 10:49                     ` Suzuki Poulose
2020-10-23  9:41                 ` Peter Zijlstra
2020-10-23  9:41                   ` Peter Zijlstra
2020-10-23 10:34                   ` Suzuki Poulose
2020-10-23 10:34                     ` Suzuki Poulose
2020-10-23 10:54                     ` Peter Zijlstra
2020-10-23 10:54                       ` Peter Zijlstra
2020-10-23 12:56                       ` Suzuki Poulose
2020-10-23 12:56                         ` Suzuki Poulose
2020-10-23 13:16                         ` Peter Zijlstra
2020-10-23 13:16                           ` Peter Zijlstra
2020-10-23 13:29                           ` Suzuki Poulose
2020-10-23 13:29                             ` Suzuki Poulose
2020-10-23 13:44                             ` Peter Zijlstra
2020-10-23 13:44                               ` Peter Zijlstra
2020-10-23 20:37                               ` Mathieu Poirier
2020-10-23 20:37                                 ` Mathieu Poirier
2020-10-30  7:59                                 ` Sai Prakash Ranjan
2020-10-30  7:59                                   ` Sai Prakash Ranjan
2020-10-30 16:48                                   ` Mathieu Poirier
2020-10-30 16:48                                     ` Mathieu Poirier
2020-10-30 17:26                                     ` Sai Prakash Ranjan
2020-10-30 17:26                                       ` Sai Prakash Ranjan
2020-11-04 17:03                                       ` Mathieu Poirier
2020-11-04 17:03                                         ` Mathieu Poirier
2020-10-22 10:57 ` [PATCHv2 3/4] coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() Sai Prakash Ranjan
2020-10-22 10:57   ` Sai Prakash Ranjan
2020-10-22 10:57 ` [PATCHv2 4/4] coresight: tmc-etr: Fix possible NULL ptr dereference in get_perf_etr_buf_cpu_wide() Sai Prakash Ranjan
2020-10-22 10:57   ` Sai Prakash Ranjan
2020-10-22 11:10 ` [PATCHv2 0/4] coresight: etf/etb10/etr: Fix NULL pointer dereference crashes Sai Prakash Ranjan
2020-10-22 11:10   ` Sai Prakash Ranjan
2020-10-22 11:23   ` Sai Prakash Ranjan
2020-10-22 11:23     ` Sai Prakash Ranjan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20201022133414.GH2611@hirez.programming.kicks-ass.net \
    --to=peterz@infradead.org \
    --cc=acme@kernel.org \
    --cc=alexander.shishkin@linux.intel.com \
    --cc=coresight@lists.linaro.org \
    --cc=jolsa@redhat.com \
    --cc=linux-arm-kernel@lists.infradead.org \
    --cc=linux-arm-msm@vger.kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mark.rutland@arm.com \
    --cc=mathieu.poirier@linaro.org \
    --cc=mike.leach@linaro.org \
    --cc=mingo@redhat.com \
    --cc=namhyung@kernel.org \
    --cc=saiprakash.ranjan@codeaurora.org \
    --cc=suzuki.poulose@arm.com \
    --cc=swboyd@chromium.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.