From patchwork Fri Nov 27 17:52:50 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Mathieu Poirier X-Patchwork-Id: 11936983 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.8 required=3.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_GIT autolearn=unavailable autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1540FC3E8C5 for ; Fri, 27 Nov 2020 17:55:57 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id BBA4F2224A for ; Fri, 27 Nov 2020 17:55:56 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="SzH/zDMG"; dkim=fail reason="signature verification failed" (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="ShMuYNe7" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org BBA4F2224A Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=linaro.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=kZ/PQEv4983pt38M17EJuWosQCmJdvnHS7o4zpcQjKk=; b=SzH/zDMGEY1LeIl6zhbj5NIRJ QOPGQ3zUpT/Fxv395j71dDX8y3Lon0oq76vDnDBmq5rY8y211WFBPOMzokYo86gnWWKEijzSx2mAr GoZCq5Yksya7z98yAMob3TKqQ4MDtp2DCf2Y4REl7NdoueB9+bXieG3SMJ1+GDSF+erZ+0jLKKd1i pb5sAi+PGak/zS7JBOr1CBDZ3HFH7H08Pa/mP5nBt3zwfhUdXbVoUzXMbsyUB0zU4Vy5utfikoud9 p6MTyKo8Gv+HoDfKrtYv9+/lnIs/lrZN+vGfzfG/1eWxtty3qbX2T3l0DykoQ4tMlP86syHb3OcBW yyZ/G+gKw==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kihwi-00050B-HH; Fri, 27 Nov 2020 17:54:12 +0000 Received: from mail-pf1-x444.google.com ([2607:f8b0:4864:20::444]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kihvg-0004e7-OH for linux-arm-kernel@lists.infradead.org; Fri, 27 Nov 2020 17:53:12 +0000 Received: by mail-pf1-x444.google.com with SMTP id b63so5160432pfg.12 for ; Fri, 27 Nov 2020 09:53:08 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=EAfb3eu9PEwqw2acxzKnY+PHQEjWwXbjMesTIZeFnXs=; b=ShMuYNe7NhTa0j4JWs6zezip9DKv/wVj3FWthKlbvsRE96DCXIFdx4dCxbB60K7vNM aUU9k7Go0VsRUAwvUmwtIAVo5EDlXeaBQdxKIyi4NlNDu48/dpqJ9e3L4reVQo80YDi/ Gl+GrtSaX18zGIpvBhTtx4StM+nhxHS71vc7d7hnI3kdsWbAlRJpnxRWSc5CHNpk5z6e XwNHJkJaJpRRTK6ijIjqH5A484Wo8DmiiAQpR3YfsHT73SISNbvYoGMuoPVpToDQz4VJ uNMMW4mqSzmofEiw0DRXhQznPr0yItvpdHP2GbSS+OV06JFd7JHt+wdYRT/moGMX2LaE NoHA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=EAfb3eu9PEwqw2acxzKnY+PHQEjWwXbjMesTIZeFnXs=; b=C/cULDRxgUrT1Iir5FAX9Gn07c79XraMsal+wLkPjmadZNkLa3zC1sDfpQQLA4ZgSn g9SkFJ+VcvHJZPseTxGEZqrOvTMdum8n9v3BnAvv9PQaVpUBMj1wCB1EZhNsxT+3NVhI 4XSg3nAMY8P/o/lwrH9KIyMomy6El+MQ3ZKAKEFEL7vJGvGr4jv0/G9lSh+/6jd13jNq n0Ls6MRG3Lkb+6fvdc5+UG7uxscYcgJr6UqKOe18YZt/LyL/qHKbb7Or+XZb01frk8KJ gjpkEibBgT6UWewodkbB9oda7iT0GnS/B3++drtmJtOGbN06tHouMFLBZgttg/pPf3C3 XqIQ== X-Gm-Message-State: AOAM531KhoYQEFp8E9vpF7K+FFRBKW/1PPoMPYnMMr3dnRvREMIqYrP0 sP3YHiLybuFe3enYPzY40JW8Eg== X-Google-Smtp-Source: ABdhPJxRTKNZcLka4nx9t5gy6bRADeaKB53K/14ja9sOd/6VcaciKw9tgFpAgp+RNykqC8GhduOQzQ== X-Received: by 2002:a17:90b:1b52:: with SMTP id nv18mr11583917pjb.172.1606499587077; Fri, 27 Nov 2020 09:53:07 -0800 (PST) Received: from xps15.cg.shawcable.net (S0106889e681aac74.cg.shawcable.net. [68.147.0.187]) by smtp.gmail.com with ESMTPSA id t18sm10536724pji.1.2020.11.27.09.53.06 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 27 Nov 2020 09:53:06 -0800 (PST) From: Mathieu Poirier To: gregkh@linuxfoundation.org Subject: [PATCH 09/15] coresight: tmc-etf: Fix NULL ptr dereference in tmc_enable_etf_sink_perf() Date: Fri, 27 Nov 2020 10:52:50 -0700 Message-Id: <20201127175256.1092685-10-mathieu.poirier@linaro.org> X-Mailer: git-send-email 2.25.1 In-Reply-To: <20201127175256.1092685-1-mathieu.poirier@linaro.org> References: <20201127175256.1092685-1-mathieu.poirier@linaro.org> MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20201127_125308_874351_A1DB5A3B X-CRM114-Status: GOOD ( 20.80 ) X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: linux-kernel@vger.kernel.org, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+linux-arm-kernel=archiver.kernel.org@lists.infradead.org From: Sai Prakash Ranjan There was a report of NULL pointer dereference in ETF enable path for perf CS mode with PID monitoring. It is almost 100% reproducible when the process to monitor is something very active such as chrome and with ETF as the sink and not ETR. Currently in a bid to find the pid, the owner is dereferenced via task_pid_nr() call in tmc_enable_etf_sink_perf() and with owner being NULL, we get a NULL pointer dereference. Looking at the ETR and other places in the kernel, ETF and the ETB are the only places trying to dereference the task(owner) in tmc_enable_etf_sink_perf() which is also called from the sched_in path as in the call trace. Owner(task) is NULL even in the case of ETR in tmc_enable_etr_sink_perf(), but since we cache the PID in alloc_buffer() callback and it is done as part of etm_setup_aux() when allocating buffer for ETR sink, we never dereference this NULL pointer and we are safe. So lets do the same thing with ETF and cache the PID to which the cs_buffer belongs in tmc_alloc_etf_buffer() as done for ETR. This will also remove the unnecessary function calls(task_pid_nr()) since we are caching the PID. Easily reproducible running below: perf record -e cs_etm/@tmc_etf0/ -N -p Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 ... Call trace: tmc_enable_etf_sink+0xe4/0x280 coresight_enable_path+0x168/0x1fc etm_event_start+0x8c/0xf8 etm_event_add+0x38/0x54 event_sched_in+0x194/0x2ac group_sched_in+0x54/0x12c flexible_sched_in+0xd8/0x120 visit_groups_merge+0x100/0x16c ctx_flexible_sched_in+0x50/0x74 ctx_sched_in+0xa4/0xa8 perf_event_sched_in+0x60/0x6c perf_event_context_sched_in+0x98/0xe0 __perf_event_task_sched_in+0x5c/0xd8 finish_task_switch+0x184/0x1cc schedule_tail+0x20/0xec ret_from_fork+0x4/0x18 Cc: stable@vger.kernel.org Fixes: 880af782c6e8 ("coresight: tmc-etf: Add support for CPU-wide trace scenarios") Signed-off-by: Sai Prakash Ranjan Signed-off-by: Mathieu Poirier --- drivers/hwtracing/coresight/coresight-priv.h | 2 ++ drivers/hwtracing/coresight/coresight-tmc-etf.c | 4 +++- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/drivers/hwtracing/coresight/coresight-priv.h b/drivers/hwtracing/coresight/coresight-priv.h index 65a29293b6cb..f5f654ea2994 100644 --- a/drivers/hwtracing/coresight/coresight-priv.h +++ b/drivers/hwtracing/coresight/coresight-priv.h @@ -87,6 +87,7 @@ enum cs_mode { * struct cs_buffer - keep track of a recording session' specifics * @cur: index of the current buffer * @nr_pages: max number of pages granted to us + * @pid: PID this cs_buffer belongs to * @offset: offset within the current buffer * @data_size: how much we collected in this run * @snapshot: is this run in snapshot mode @@ -95,6 +96,7 @@ enum cs_mode { struct cs_buffers { unsigned int cur; unsigned int nr_pages; + pid_t pid; unsigned long offset; local_t data_size; bool snapshot; diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c index 44402d413ebb..989d965f3d90 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etf.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c @@ -227,6 +227,7 @@ static int tmc_enable_etf_sink_perf(struct coresight_device *csdev, void *data) unsigned long flags; struct tmc_drvdata *drvdata = dev_get_drvdata(csdev->dev.parent); struct perf_output_handle *handle = data; + struct cs_buffers *buf = etm_perf_sink_config(handle); spin_lock_irqsave(&drvdata->spinlock, flags); do { @@ -243,7 +244,7 @@ static int tmc_enable_etf_sink_perf(struct coresight_device *csdev, void *data) } /* Get a handle on the pid of the process to monitor */ - pid = task_pid_nr(handle->event->owner); + pid = buf->pid; if (drvdata->pid != -1 && drvdata->pid != pid) { ret = -EBUSY; @@ -399,6 +400,7 @@ static void *tmc_alloc_etf_buffer(struct coresight_device *csdev, if (!buf) return NULL; + buf->pid = task_pid_nr(event->owner); buf->snapshot = overwrite; buf->nr_pages = nr_pages; buf->data_pages = pages;