From: Ingo Molnar <mingo@kernel.org>
To: kan.liang@intel.com
Cc: peterz@infradead.org, mingo@redhat.com, acme@kernel.org,
davej@codemonkey.org.uk, dvyukov@google.com, eranian@gmail.com,
linux-kernel@vger.kernel.org,
Vince Weaver <vincent.weaver@maine.edu>,
Stephane Eranian <eranian@google.com>,
Jiri Olsa <jolsa@redhat.com>
Subject: Re: [PATCH] perf/x86/uncore: remove event_list for snb client uncore IMC
Date: Wed, 16 Nov 2016 09:45:23 +0100 [thread overview]
Message-ID: <20161116084523.GA22045@gmail.com> (raw)
In-Reply-To: <1479235210-29090-1-git-send-email-kan.liang@intel.com>
* kan.liang@intel.com <kan.liang@intel.com> wrote:
> From: Kan Liang <kan.liang@intel.com>
>
> A BUG was found by perf_fuzzer after enabled KASAN.
> [ 205.748005] BUG: KASAN: slab-out-of-bounds in
> snb_uncore_imc_event_del+0x6c/0xa0 at addr ffff8800caa43768
> Reported-by: Vince Weaver <vincent.weaver@maine.edu>
> Tested-by: Vince Weaver <vincent.weaver@maine.edu>
> Signed-off-by: Kan Liang <kan.liang@intel.com>
> ---
> arch/x86/events/intel/uncore_snb.c | 12 ------------
> 1 file changed, 12 deletions(-)
>
> diff --git a/arch/x86/events/intel/uncore_snb.c b/arch/x86/events/intel/uncore_snb.c
> index 81195cc..a3dcc12 100644
> --- a/arch/x86/events/intel/uncore_snb.c
> +++ b/arch/x86/events/intel/uncore_snb.c
> @@ -490,24 +490,12 @@ static int snb_uncore_imc_event_add(struct perf_event *event, int flags)
>
> snb_uncore_imc_event_start(event, 0);
>
> - box->n_events++;
> -
> return 0;
> }
>
> static void snb_uncore_imc_event_del(struct perf_event *event, int flags)
> {
> - struct intel_uncore_box *box = uncore_event_to_box(event);
> - int i;
> -
> snb_uncore_imc_event_stop(event, PERF_EF_UPDATE);
> -
> - for (i = 0; i < box->n_events; i++) {
> - if (event == box->event_list[i]) {
> - --box->n_events;
> - break;
> - }
> - }
I'll apply this fix - but could we please also make sure box->event_list[]
_always_ get initialized to a sane state?
If it had a proper zero initial value in box->n_events the bug would not have
triggered. So struct intel_uncore_box initialization appears to be sloppy,
and that should be looked at as well...
Thanks,
Ingo
next prev parent reply other threads:[~2016-11-16 8:45 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-11-15 18:40 [PATCH] perf/x86/uncore: remove event_list for snb client uncore IMC kan.liang
2016-11-16 8:45 ` Ingo Molnar [this message]
2016-11-16 14:32 ` Liang, Kan
2016-11-16 12:08 ` [tip:perf/urgent] perf/x86/uncore: Fix crash by removing bogus event_list[] handling for SNB " tip-bot for Kan Liang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20161116084523.GA22045@gmail.com \
--to=mingo@kernel.org \
--cc=acme@kernel.org \
--cc=davej@codemonkey.org.uk \
--cc=dvyukov@google.com \
--cc=eranian@gmail.com \
--cc=eranian@google.com \
--cc=jolsa@redhat.com \
--cc=kan.liang@intel.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=peterz@infradead.org \
--cc=vincent.weaver@maine.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).