linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Wei Li <liwei391@huawei.com>,
	"Steven Rostedt (VMware)" <rostedt@goodmis.org>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH 5.1 55/96] ftrace: Fix NULL pointer dereference in free_ftrace_func_mapper()
Date: Mon,  8 Jul 2019 17:13:27 +0200	[thread overview]
Message-ID: <20190708150529.484926709@linuxfoundation.org> (raw)
In-Reply-To: <20190708150526.234572443@linuxfoundation.org>

[ Upstream commit 04e03d9a616c19a47178eaca835358610e63a1dd ]

The mapper may be NULL when called from register_ftrace_function_probe()
with probe->data == NULL.

This issue can be reproduced as follow (it may be covered by compiler
optimization sometime):

/ # cat /sys/kernel/debug/tracing/set_ftrace_filter
#### all functions enabled ####
/ # echo foo_bar:dump > /sys/kernel/debug/tracing/set_ftrace_filter
[  206.949100] Unable to handle kernel NULL pointer dereference at virtual address 0000000000000000
[  206.952402] Mem abort info:
[  206.952819]   ESR = 0x96000006
[  206.955326]   Exception class = DABT (current EL), IL = 32 bits
[  206.955844]   SET = 0, FnV = 0
[  206.956272]   EA = 0, S1PTW = 0
[  206.956652] Data abort info:
[  206.957320]   ISV = 0, ISS = 0x00000006
[  206.959271]   CM = 0, WnR = 0
[  206.959938] user pgtable: 4k pages, 48-bit VAs, pgdp=0000000419f3a000
[  206.960483] [0000000000000000] pgd=0000000411a87003, pud=0000000411a83003, pmd=0000000000000000
[  206.964953] Internal error: Oops: 96000006 [#1] SMP
[  206.971122] Dumping ftrace buffer:
[  206.973677]    (ftrace buffer empty)
[  206.975258] Modules linked in:
[  206.976631] Process sh (pid: 281, stack limit = 0x(____ptrval____))
[  206.978449] CPU: 10 PID: 281 Comm: sh Not tainted 5.2.0-rc1+ #17
[  206.978955] Hardware name: linux,dummy-virt (DT)
[  206.979883] pstate: 60000005 (nZCv daif -PAN -UAO)
[  206.980499] pc : free_ftrace_func_mapper+0x2c/0x118
[  206.980874] lr : ftrace_count_free+0x68/0x80
[  206.982539] sp : ffff0000182f3ab0
[  206.983102] x29: ffff0000182f3ab0 x28: ffff8003d0ec1700
[  206.983632] x27: ffff000013054b40 x26: 0000000000000001
[  206.984000] x25: ffff00001385f000 x24: 0000000000000000
[  206.984394] x23: ffff000013453000 x22: ffff000013054000
[  206.984775] x21: 0000000000000000 x20: ffff00001385fe28
[  206.986575] x19: ffff000013872c30 x18: 0000000000000000
[  206.987111] x17: 0000000000000000 x16: 0000000000000000
[  206.987491] x15: ffffffffffffffb0 x14: 0000000000000000
[  206.987850] x13: 000000000017430e x12: 0000000000000580
[  206.988251] x11: 0000000000000000 x10: cccccccccccccccc
[  206.988740] x9 : 0000000000000000 x8 : ffff000013917550
[  206.990198] x7 : ffff000012fac2e8 x6 : ffff000012fac000
[  206.991008] x5 : ffff0000103da588 x4 : 0000000000000001
[  206.991395] x3 : 0000000000000001 x2 : ffff000013872a28
[  206.991771] x1 : 0000000000000000 x0 : 0000000000000000
[  206.992557] Call trace:
[  206.993101]  free_ftrace_func_mapper+0x2c/0x118
[  206.994827]  ftrace_count_free+0x68/0x80
[  206.995238]  release_probe+0xfc/0x1d0
[  206.995555]  register_ftrace_function_probe+0x4a8/0x868
[  206.995923]  ftrace_trace_probe_callback.isra.4+0xb8/0x180
[  206.996330]  ftrace_dump_callback+0x50/0x70
[  206.996663]  ftrace_regex_write.isra.29+0x290/0x3a8
[  206.997157]  ftrace_filter_write+0x44/0x60
[  206.998971]  __vfs_write+0x64/0xf0
[  206.999285]  vfs_write+0x14c/0x2f0
[  206.999591]  ksys_write+0xbc/0x1b0
[  206.999888]  __arm64_sys_write+0x3c/0x58
[  207.000246]  el0_svc_common.constprop.0+0x408/0x5f0
[  207.000607]  el0_svc_handler+0x144/0x1c8
[  207.000916]  el0_svc+0x8/0xc
[  207.003699] Code: aa0003f8 a9025bf5 aa0103f5 f946ea80 (f9400303)
[  207.008388] ---[ end trace 7b6d11b5f542bdf1 ]---
[  207.010126] Kernel panic - not syncing: Fatal exception
[  207.011322] SMP: stopping secondary CPUs
[  207.013956] Dumping ftrace buffer:
[  207.014595]    (ftrace buffer empty)
[  207.015632] Kernel Offset: disabled
[  207.017187] CPU features: 0x002,20006008
[  207.017985] Memory Limit: none
[  207.019825] ---[ end Kernel panic - not syncing: Fatal exception ]---

Link: http://lkml.kernel.org/r/20190606031754.10798-1-liwei391@huawei.com

Signed-off-by: Wei Li <liwei391@huawei.com>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 kernel/trace/ftrace.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 045e7f46a74a..2469d54b3e43 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4230,10 +4230,13 @@ void free_ftrace_func_mapper(struct ftrace_func_mapper *mapper,
 	struct ftrace_func_entry *entry;
 	struct ftrace_func_map *map;
 	struct hlist_head *hhd;
-	int size = 1 << mapper->hash.size_bits;
-	int i;
+	int size, i;
+
+	if (!mapper)
+		return;
 
 	if (free_func && mapper->hash.count) {
+		size = 1 << mapper->hash.size_bits;
 		for (i = 0; i < size; i++) {
 			hhd = &mapper->hash.buckets[i];
 			hlist_for_each_entry(entry, hhd, hlist) {
-- 
2.20.1




  parent reply	other threads:[~2019-07-08 15:33 UTC|newest]

Thread overview: 115+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-07-08 15:12 [PATCH 5.1 00/96] 5.1.17-stable review Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 01/96] Bluetooth: Fix faulty expression for minimum encryption key size check Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 02/96] signal: remove the wrong signal_pending() check in restore_user_sigmask() Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 03/96] netfilter: nf_flow_table: ignore DF bit setting Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 04/96] netfilter: nft_flow_offload: set liberal tracking mode for tcp Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 05/96] netfilter: nft_flow_offload: dont offload when sequence numbers need adjustment Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 06/96] netfilter: nft_flow_offload: IPCB is only valid for ipv4 family Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 07/96] idr: Fix idr_get_next race with idr_remove Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 08/96] HID: i2c-hid: add iBall Aer3 to descriptor override Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 09/96] ASoC : cs4265 : readable register too low Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 10/96] ASoC: ak4458: add return value for ak4458_probe Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 11/96] ASoC: soc-pcm: BE dai needs prepare when pause release after resume Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 12/96] ASoC: ak4458: rstn_control - return a non-zero on error only Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 13/96] spi: bitbang: Fix NULL pointer dereference in spi_unregister_master Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 14/96] ASoC: core: lock client_mutex while removing link components Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 15/96] iommu/vt-d: Set the right field for Page Walk Snoop Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 16/96] HID: a4tech: fix horizontal scrolling Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 17/96] ASoC: Intel: Baytrail: add quirk for Aegex 10 (RU2) tablet Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 18/96] ASoC: hda: fix unbalanced codec dev refcount for HDA_DEV_ASOC Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 19/96] drm/mediatek: fix unbind functions Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 20/96] drm/mediatek: unbind components in mtk_drm_unbind() Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 21/96] drm/mediatek: call drm_atomic_helper_shutdown() when unbinding driver Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 22/96] drm/mediatek: clear num_pipes when unbind driver Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 23/96] drm/mediatek: call mtk_dsi_stop() after mtk_drm_crtc_atomic_disable() Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 24/96] ASoC: max98090: remove 24-bit format support if RJ is 0 Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 25/96] ASoC: sun4i-i2s: Fix sun8i tx channel offset mask Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 26/96] ASoC: sun4i-i2s: Add offset to RX channel select Greg Kroah-Hartman
2019-07-08 15:12 ` [PATCH 5.1 27/96] x86/CPU: Add more Icelake model numbers Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 28/96] usb: gadget: fusb300_udc: Fix memory leak of fusb300->ep[i] Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 29/96] usb: gadget: udc: lpc32xx: allocate descriptor with GFP_ATOMIC Greg Kroah-Hartman
2019-07-10  9:59   ` Pavel Machek
2019-07-15 20:07     ` Alexandre Belloni
2019-07-08 15:13 ` [PATCH 5.1 30/96] usb: gadget: dwc2: fix zlp handling Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 31/96] ASoC: Intel: cht_bsw_max98090: fix kernel oops with platform_name override Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 32/96] ASoC: Intel: bytcht_es8316: " Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 33/96] ASoC: Intel: cht_bsw_nau8824: " Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 34/96] ASoC: Intel: cht_bsw_rt5672: " Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 35/96] ASoC: core: move DAI pre-links initiation to snd_soc_instantiate_card Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 36/96] ALSA: hdac: fix memory release for SST and SOF drivers Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 37/96] SoC: rt274: Fix internal jack assignment in set_jack callback Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 38/96] scsi: hpsa: correct ioaccel2 chaining Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 39/96] gpio: pca953x: hack to fix 24 bit gpio expanders Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 40/96] drm: panel-orientation-quirks: Add quirk for GPD pocket2 Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 41/96] drm: panel-orientation-quirks: Add quirk for GPD MicroPC Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 42/96] ASoC: core: Fix deadlock in snd_soc_instantiate_card() Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 43/96] ASoC: Intel: sst: fix kmalloc call with wrong flags Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 44/96] platform/x86: asus-wmi: Only Tell EC the OS will handle display hotkeys from asus_nb_wmi Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 45/96] platform/x86: intel-vbtn: Report switch events when event wakes device Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 46/96] platform/x86: mlx-platform: Fix parent device in i2c-mux-reg device registration Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 47/96] platform/mellanox: mlxreg-hotplug: Add devm_free_irq call to remove flow Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 48/96] i2c: pca-platform: Fix GPIO lookup code Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 49/96] arm64: tlbflush: Ensure start/end of address range are aligned to stride Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 50/96] cpuset: restore sanity to cpuset_cpus_allowed_fallback() Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 51/96] scripts/decode_stacktrace.sh: prefix addr2line with $CROSS_COMPILE Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 52/96] mm/mlock.c: change count_mm_mlocked_page_nr return type Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 53/96] tracing: avoid build warning with HAVE_NOP_MCOUNT Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 54/96] module: Fix livepatch/ftrace module text permissions race Greg Kroah-Hartman
2019-07-08 15:13 ` Greg Kroah-Hartman [this message]
2019-07-08 15:13 ` [PATCH 5.1 56/96] ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 57/96] crypto: user - prevent operating on larval algorithms Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 58/96] crypto: cryptd - Fix skcipher instance memory leak Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 59/96] ALSA: seq: fix incorrect order of dest_client/dest_ports arguments Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 60/96] ALSA: firewire-lib/fireworks: fix miss detection of received MIDI messages Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 61/96] ALSA: line6: Fix write on zero-sized buffer Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 62/96] ALSA: usb-audio: fix sign unintended sign extension on left shifts Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 63/96] ALSA: hda/realtek: Add quirks for several Clevo notebook barebones Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 64/96] ALSA: hda/realtek - Change front mic location for Lenovo M710q Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 65/96] dax: Fix xarray entry association for mixed mappings Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 66/96] lib/mpi: Fix karactx leak in mpi_powm Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 67/96] fs/userfaultfd.c: disable irqs for fault_pending and event locks Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 68/96] swap_readpage(): avoid blk_wake_io_task() if !synchronous Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 69/96] tracing/snapshot: Resize spare buffer if size changed Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 70/96] ARM: dts: armada-xp-98dx3236: Switch to armada-38x-uart serial node Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 71/96] arm64: kaslr: keep modules inside module region when KASAN is enabled Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 72/96] drm/i915/ringbuffer: EMIT_INVALIDATE *before* switch context Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 73/96] drm/amd/powerplay: use hardware fan control if no powerplay fan table Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 74/96] drm/amdgpu: Dont skip display settings in hwmgr_resume() Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 75/96] drm/amdgpu/gfx9: use reset default for PA_SC_FIFO_SIZE Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 76/96] drm/virtio: move drm_connector_update_edid_property() call Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 77/96] drm/etnaviv: add missing failure path to destroy suballoc Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 78/96] drm/imx: notify drm core before sending event during crtc disable Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 79/96] drm/imx: only send event on crtc disable if kept disabled Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 80/96] ftrace/x86: Remove possible deadlock between register_kprobe() and ftrace_run_update_code() Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 81/96] mm/vmscan.c: prevent useless kswapd loops Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 82/96] btrfs: Ensure replaced device doesnt have pending chunk allocation Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 83/96] tty: rocket: fix incorrect forward declaration of rp_init() Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 84/96] s390/mm: fix pxd_bad with folded page tables Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 85/96] KVM: x86: degrade WARN to pr_warn_ratelimited Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 86/96] KVM: LAPIC: Fix pending interrupt in IRR blocked by software disable LAPIC Greg Kroah-Hartman
2019-07-08 15:13 ` [PATCH 5.1 87/96] nfsd: Fix overflow causing non-working mounts on 1 TB machines Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 88/96] svcrdma: Ignore source port when computing DRC hash Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 89/96] MIPS: Fix bounds check virt_addr_valid Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 90/96] MIPS: Add missing EHB in mtc0 -> mfc0 sequence Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 91/96] MIPS: have "plain" make calls build dtbs for selected platforms Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 92/96] dmaengine: qcom: bam_dma: Fix completed descriptors count Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 93/96] dmaengine: imx-sdma: remove BD_INTR for channel0 Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 94/96] dmaengine: jz4780: Fix an endian bug in IRQ handler Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 95/96] fs: VALIDATE_FS_PARSER should default to n Greg Kroah-Hartman
2019-07-08 15:14 ` [PATCH 5.1 96/96] scsi: target/iblock: Fix overrun in WRITE SAME emulation Greg Kroah-Hartman
2019-07-08 17:09 ` [PATCH 5.1 00/96] 5.1.17-stable review Jiunn Chang
2019-07-08 17:49 ` Phong Tran
2019-07-10  7:50   ` Greg Kroah-Hartman
2019-07-08 19:12 ` kernelci.org bot
2019-07-08 19:29 ` Luke Nowakowski-Krijger
2019-07-10  7:49   ` Greg Kroah-Hartman
2019-07-09  0:52 ` shuah
2019-07-09  6:56   ` Greg Kroah-Hartman
2019-07-09  4:43 ` Naresh Kamboju
2019-07-09  6:56   ` Greg Kroah-Hartman
2019-07-09 13:12 ` Amol Surati
2019-07-10  7:50   ` Greg Kroah-Hartman
2019-07-09 18:41 ` Guenter Roeck
2019-07-09 19:54   ` Greg Kroah-Hartman
2019-07-10  6:14 ` Jon Hunter
2019-07-10  7:24   ` Greg Kroah-Hartman

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190708150529.484926709@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=liwei391@huawei.com \
    --cc=rostedt@goodmis.org \
    --cc=sashal@kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).