From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.5 required=3.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER,INCLUDES_PATCH, MAILING_LIST_MULTI,NICE_REPLY_A,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF61AC2B9F4 for ; Thu, 17 Jun 2021 17:48:16 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 9B7B5613CE for ; Thu, 17 Jun 2021 17:48:16 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S232645AbhFQRuW (ORCPT ); Thu, 17 Jun 2021 13:50:22 -0400 Received: from foss.arm.com ([217.140.110.172]:57196 "EHLO foss.arm.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S231249AbhFQRuV (ORCPT ); Thu, 17 Jun 2021 13:50:21 -0400 Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id 771F513D5; Thu, 17 Jun 2021 10:48:13 -0700 (PDT) Received: from [10.57.9.136] (unknown [10.57.9.136]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id A1CF13F694; Thu, 17 Jun 2021 10:48:12 -0700 (PDT) Subject: Re: [PATCH] perf/arm-cmn: Fix invalid pointer when access dtc object sharing the same IRQ number To: Tuan Phan Cc: Will Deacon , Mark Rutland , linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org References: <1623946129-3290-1-git-send-email-tuanphan@os.amperecomputing.com> From: Robin Murphy Message-ID: Date: Thu, 17 Jun 2021 18:48:06 +0100 User-Agent: Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Thunderbird/78.10.1 MIME-Version: 1.0 In-Reply-To: <1623946129-3290-1-git-send-email-tuanphan@os.amperecomputing.com> Content-Type: text/plain; charset=utf-8; format=flowed Content-Language: en-GB Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2021-06-17 17:08, Tuan Phan wrote: > When multiple dtcs share the same IRQ number, the irq_friend which > used to refer to dtc object gets calculated incorrect which leads > to invalid pointer. Oops, indeed this is supposed to be a forward offset *from* the previous match *to* the current dtc. It's almost as if I never managed to test it... :) Reviewed-by: Robin Murphy > Fixes: 0ba64770a2f2 ("perf: Add Arm CMN-600 PMU driver") > > Signed-off-by: Tuan Phan > --- > drivers/perf/arm-cmn.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/perf/arm-cmn.c b/drivers/perf/arm-cmn.c > index 56a5c35..49016f2 100644 > --- a/drivers/perf/arm-cmn.c > +++ b/drivers/perf/arm-cmn.c > @@ -1212,7 +1212,7 @@ static int arm_cmn_init_irqs(struct arm_cmn *cmn) > irq = cmn->dtc[i].irq; > for (j = i; j--; ) { > if (cmn->dtc[j].irq == irq) { > - cmn->dtc[j].irq_friend = j - i; > + cmn->dtc[j].irq_friend = i - j; > goto next; > } > } >