From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>,
Mathieu Poirier <mathieu.poirier@linaro.org>
Subject: [PATCH 5.10 15/40] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf()
Date: Wed, 23 Dec 2020 16:33:16 +0100 [thread overview]
Message-ID: <20201223150516.292233870@linuxfoundation.org> (raw)
In-Reply-To: <20201223150515.553836647@linuxfoundation.org>
From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
commit 868663dd5d69fef05bfb004f91da5c30e9b93461 upstream.
There was a report of NULL pointer dereference in ETF enable
path for perf CS mode with PID monitoring. It is almost 100%
reproducible when the process to monitor is something very
active such as chrome and with ETF as the sink and not ETR.
Currently in a bid to find the pid, the owner is dereferenced
via task_pid_nr() call in tmc_enable_etf_sink_perf() and with
owner being NULL, we get a NULL pointer dereference.
Looking at the ETR and other places in the kernel, ETF and the
ETB are the only places trying to dereference the task(owner)
in tmc_enable_etf_sink_perf() which is also called from the
sched_in path as in the call trace. Owner(task) is NULL even
in the case of ETR in tmc_enable_etr_sink_perf(), but since we
cache the PID in alloc_buffer() callback and it is done as part
of etm_setup_aux() when allocating buffer for ETR sink, we never
dereference this NULL pointer and we are safe. So lets do the
same thing with ETF and cache the PID to which the cs_buffer
belongs in tmc_alloc_etf_buffer() as done for ETR. This will
also remove the unnecessary function calls(task_pid_nr()) since
we are caching the PID.
Easily reproducible running below:
perf record -e cs_etm/@tmc_etf0/ -N -p <pid>
Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548
Mem abort info:
ESR = 0x96000006
EC = 0x25: DABT (current EL), IL = 32 bits
SET = 0, FnV = 0
EA = 0, S1PTW = 0
Data abort info:
ISV = 0, ISS = 0x00000006
CM = 0, WnR = 0
<snip>...
Call trace:
tmc_enable_etf_sink+0xe4/0x280
coresight_enable_path+0x168/0x1fc
etm_event_start+0x8c/0xf8
etm_event_add+0x38/0x54
event_sched_in+0x194/0x2ac
group_sched_in+0x54/0x12c
flexible_sched_in+0xd8/0x120
visit_groups_merge+0x100/0x16c
ctx_flexible_sched_in+0x50/0x74
ctx_sched_in+0xa4/0xa8
perf_event_sched_in+0x60/0x6c
perf_event_context_sched_in+0x98/0xe0
__perf_event_task_sched_in+0x5c/0xd8
finish_task_switch+0x184/0x1cc
schedule_tail+0x20/0xec
ret_from_fork+0x4/0x18
Fixes: 880af782c6e8 ("coresight: tmc-etf: Add support for CPU-wide trace scenarios")
Cc: stable@vger.kernel.org
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20201127175256.1092685-10-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/hwtracing/coresight/coresight-priv.h | 2 ++
drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 +++-
2 files changed, 5 insertions(+), 1 deletion(-)
--- a/drivers/hwtracing/coresight/coresight-priv.h
+++ b/drivers/hwtracing/coresight/coresight-priv.h
@@ -87,6 +87,7 @@ enum cs_mode {
* struct cs_buffer - keep track of a recording session' specifics
* @cur: index of the current buffer
* @nr_pages: max number of pages granted to us
+ * @pid: PID this cs_buffer belongs to
* @offset: offset within the current buffer
* @data_size: how much we collected in this run
* @snapshot: is this run in snapshot mode
@@ -95,6 +96,7 @@ enum cs_mode {
struct cs_buffers {
unsigned int cur;
unsigned int nr_pages;
+ pid_t pid;
unsigned long offset;
local_t data_size;
bool snapshot;
--- a/drivers/hwtracing/coresight/coresight-tmc-etf.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c
@@ -227,6 +227,7 @@ static int tmc_enable_etf_sink_perf(stru
unsigned long flags;
struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent);
struct perf_output_handle *handle = data;
+ struct cs_buffers *buf = etm_perf_sink_config(handle);
spin_lock_irqsave(&drvdata->spinlock, flags);
do {
@@ -243,7 +244,7 @@ static int tmc_enable_etf_sink_perf(stru
}
/* Get a handle on the pid of the process to monitor */
- pid = task_pid_nr(handle->event->owner);
+ pid = buf->pid;
if (drvdata->pid != -1 && drvdata->pid != pid) {
ret = -EBUSY;
@@ -399,6 +400,7 @@ static void *tmc_alloc_etf_buffer(struct
if (!buf)
return NULL;
+ buf->pid = task_pid_nr(event->owner);
buf->snapshot = overwrite;
buf->nr_pages = nr_pages;
buf->data_pages = pages;
next prev parent reply other threads:[~2020-12-23 15:34 UTC|newest]
Thread overview: 62+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-12-23 15:33 [PATCH 5.10 00/40] 5.10.3-rc1 review Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 01/40] net: ipconfig: Avoid spurious blank lines in boot log Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 02/40] x86/split-lock: Avoid returning with interrupts enabled Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 03/40] exfat: Avoid allocating upcase table using kcalloc() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 04/40] soc/tegra: fuse: Fix index bug in get_process_id Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 05/40] usb: mtu3: fix memory corruption in mtu3_debugfs_regset() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 06/40] USB: serial: option: add interface-number sanity check to flag handling Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 07/40] USB: gadget: f_acm: add support for SuperSpeed Plus Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 08/40] USB: gadget: f_midi: setup SuperSpeed Plus descriptors Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 09/40] usb: gadget: f_fs: Re-use SS descriptors for SuperSpeedPlus Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 10/40] USB: gadget: f_rndis: fix bitrate for SuperSpeed and above Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 11/40] usb: chipidea: ci_hdrc_imx: Pass DISABLE_DEVICE_STREAMING flag to imx6ul Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 12/40] ARM: dts: exynos: fix roles of USB 3.0 ports on Odroid XU Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 13/40] ARM: dts: exynos: fix USB 3.0 VBUS control and over-current pins on Exynos5410 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 14/40] ARM: dts: exynos: fix USB 3.0 pins supply being turned off on Odroid XU Greg Kroah-Hartman
2020-12-23 15:33 ` Greg Kroah-Hartman [this message]
2020-12-23 15:33 ` [PATCH 5.10 16/40] coresight: tmc-etr: Check if page is valid before dma_map_page() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 17/40] coresight: tmc-etr: Fix barrier packet insertion for perf buffer Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 18/40] coresight: etb10: Fix possible NULL ptr dereference in etb_enable_perf() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 19/40] coresight: etm4x: Skip setting LPOVERRIDE bit for qcom, skip-power-up Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 20/40] coresight: etm4x: Fix accesses to TRCVMIDCTLR1 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 21/40] coresight: etm4x: Fix accesses to TRCCIDCTLR1 Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 22/40] coresight: etm4x: Fix accesses to TRCPROCSELR Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 23/40] coresight: etm4x: Handle TRCVIPCSSCTLR accesses Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 24/40] f2fs: fix to seek incorrect data offset in inline data file Greg Kroah-Hartman
2020-12-24 1:11 ` Chao Yu
2020-12-24 7:52 ` Greg Kroah-Hartman
2020-12-24 9:38 ` Chao Yu
2020-12-23 15:33 ` [PATCH 5.10 25/40] f2fs: init dirty_secmap incorrectly Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 26/40] scsi: megaraid_sas: Check user-provided offsets Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 27/40] HID: i2c-hid: add Vero K147 to descriptor override Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 28/40] serial_core: Check for port state when tty is in error state Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 29/40] fscrypt: remove kernel-internal constants from UAPI header Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 30/40] fscrypt: add fscrypt_is_nokey_name() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 31/40] ubifs: prevent creating duplicate encrypted filenames Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 32/40] ext4: " Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 33/40] f2fs: " Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 34/40] Bluetooth: Fix slab-out-of-bounds read in hci_le_direct_adv_report_evt() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 35/40] quota: Sanity-check quota file headers on load Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 36/40] fs: quota: fix array-index-out-of-bounds bug by passing correct argument to vfs_cleanup_quota_inode() Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 37/40] media: msi2500: assign SPI bus number dynamically Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 38/40] crypto: af_alg - avoid undefined behavior accessing salg_name Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 39/40] nl80211: validate key indexes for cfg80211_registered_device Greg Kroah-Hartman
2020-12-23 15:33 ` [PATCH 5.10 40/40] md: fix a warning caused by a race between concurrent md_ioctl()s Greg Kroah-Hartman
2020-12-23 19:26 ` [PATCH 5.10 00/40] 5.10.3-rc1 review Jon Hunter
2020-12-26 15:07 ` Greg Kroah-Hartman
2020-12-24 0:56 ` Daniel Díaz
2020-12-26 15:07 ` Greg Kroah-Hartman
2020-12-24 9:43 ` Jeffrin Jose T
2020-12-26 15:06 ` Greg Kroah-Hartman
2020-12-27 15:50 ` Jeffrin Jose T
2020-12-27 16:05 ` Greg Kroah-Hartman
2020-12-27 21:33 ` Jeffrin Jose T
2020-12-28 9:50 ` Pavel Machek
2020-12-28 20:41 ` Guenter Roeck
2021-01-03 13:07 ` Jeffrin Jose T
2021-01-04 6:21 ` Greg Kroah-Hartman
2021-01-06 19:38 ` Jeffrin Jose T
2021-01-06 19:49 ` Greg Kroah-Hartman
2021-01-06 23:56 ` Jeffrin Jose T
2020-12-24 15:26 ` Guenter Roeck
2020-12-26 15:06 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201223150516.292233870@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mathieu.poirier@linaro.org \
--cc=saiprakash.ranjan@codeaurora.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.