From patchwork Sun Sep 27 16:20:03 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Sai Prakash Ranjan X-Patchwork-Id: 11802213 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id 53E18112C for ; Sun, 27 Sep 2020 16:20:56 +0000 (UTC) Received: from merlin.infradead.org (merlin.infradead.org [205.233.59.134]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 2080D221E5 for ; Sun, 27 Sep 2020 16:20:56 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=lists.infradead.org header.i=@lists.infradead.org header.b="Of7MNwIc"; dkim=fail reason="signature verification failed" (1024-bit key) header.d=mg.codeaurora.org header.i=@mg.codeaurora.org header.b="jEqFszNA" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 2080D221E5 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=lists.infradead.org; s=merlin.20170209; h=Sender:Content-Transfer-Encoding: Content-Type:Cc:List-Subscribe:List-Help:List-Post:List-Archive: List-Unsubscribe:List-Id:MIME-Version:References:In-Reply-To:Message-Id:Date: Subject:To:From:Reply-To:Content-ID:Content-Description:Resent-Date: Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:List-Owner; bh=EZ05ZpeiJ1o6q2vL4QjyZEwnAc2OMl/I4HwANL514bg=; b=Of7MNwIc0wvQ1M0BZXv/1Pe6l JFZQOIIveh+7s2XWrfdTktz6V7fZkoVD0/+Bgq9iwS/bdf+mZMlVcKeRGTFm5AnSypUnWPIwmG+0Q 9FdnCa3KCl/6cv+3kIWja4E6P+KhheHnhawttqwyIPJpYHQo5D8IhTTbj4lNNmOGacFXVzjc61fvO acaTk54vGweOJ/hiTRPQcj1y3RzHQVBkkJGrahNZAGdp9TEXzZRUxG+YfAcjpgPjozx36Y7IsSfei VAudiCP+tDirx2Y6aVHG+u/pXA6B8X9u3NDdGAXqXSy4YhGO8Jl1iiLU070UMvdZ7nVNmiMXtP2DV VtLY9BG3A==; Received: from localhost ([::1] helo=merlin.infradead.org) by merlin.infradead.org with esmtp (Exim 4.92.3 #3 (Red Hat Linux)) id 1kMZPn-0002Db-Sj; Sun, 27 Sep 2020 16:20:43 +0000 Received: from z5.mailgun.us ([104.130.96.5]) by merlin.infradead.org with esmtps (Exim 4.92.3 #3 (Red Hat Linux)) id 1kMZPc-0002AO-EQ for linux-arm-kernel@lists.infradead.org; Sun, 27 Sep 2020 16:20:37 +0000 DKIM-Signature: a=rsa-sha256; v=1; c=relaxed/relaxed; d=mg.codeaurora.org; q=dns/txt; s=smtp; t=1601223636; h=Content-Transfer-Encoding: MIME-Version: References: In-Reply-To: Message-Id: Date: Subject: Cc: To: From: Sender; bh=vnl5MftWzuNr03G0Cpiz5UQxacLEJ3BlzLim3lzyMlg=; b=jEqFszNA98JllNpU/SI+P45mzUs5cmT6rB2BugRRtQ1t0cKYXvROj2aj26f7/MQE7nG/HdJb YOLcD0vRNbqPR4kgYTFmYe5tILOPy6gATRHn1+wSJn7O503UBfYJi0XvncC/4Fn3i/TJWOYO tzmX4qhrAEmg5PmCTisJ/JYv49A= X-Mailgun-Sending-Ip: 104.130.96.5 X-Mailgun-Sid: WyJiYzAxZiIsICJsaW51eC1hcm0ta2VybmVsQGxpc3RzLmluZnJhZGVhZC5vcmciLCAiYmU5ZTRhIl0= Received: from smtp.codeaurora.org (ec2-35-166-182-171.us-west-2.compute.amazonaws.com [35.166.182.171]) by smtp-out-n07.prod.us-east-1.postgun.com with SMTP id 5f70bbcab51786209c00d0e7 (version=TLS1.2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256); Sun, 27 Sep 2020 16:20:26 GMT Received: by smtp.codeaurora.org (Postfix, from userid 1001) id BDEAAC433CA; Sun, 27 Sep 2020 16:20:25 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-caf-mail-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.9 required=2.0 tests=ALL_TRUSTED, BAYES_00, SPF_FAIL autolearn=no autolearn_force=no version=3.4.0 Received: from blr-ubuntu-253.qualcomm.com (blr-bdr-fw-01_GlobalNAT_AllZones-Outside.qualcomm.com [103.229.18.19]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-SHA256 (128/128 bits)) (No client certificate requested) (Authenticated sender: saiprakash.ranjan) by smtp.codeaurora.org (Postfix) with ESMTPSA id B9277C433C8; Sun, 27 Sep 2020 16:20:21 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 smtp.codeaurora.org B9277C433C8 Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; dmarc=none (p=none dis=none) header.from=codeaurora.org Authentication-Results: aws-us-west-2-caf-mail-1.web.codeaurora.org; spf=fail smtp.mailfrom=saiprakash.ranjan@codeaurora.org From: Sai Prakash Ranjan To: Mathieu Poirier , Suzuki K Poulose , Mike Leach , Leo Yan Subject: [RFC PATCH 1/2] coresight: tmc-etf: Fix NULL pointer dereference in tmc_enable_etf_sink_perf() Date: Sun, 27 Sep 2020 21:50:03 +0530 Message-Id: <751bd7d9fc65cdd3f1d118814193e9d925e2f56f.1601222348.git.saiprakash.ranjan@codeaurora.org> X-Mailer: git-send-email 2.27.0 In-Reply-To: References: MIME-Version: 1.0 X-CRM114-Version: 20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 X-CRM114-CacheID: sfid-20200927_122036_265283_ED7CC44E X-CRM114-Status: GOOD ( 23.47 ) X-Spam-Score: -0.5 (/) X-Spam-Report: SpamAssassin version 3.4.4 on merlin.infradead.org summary: Content analysis details: (-0.5 points) pts rule name description ---- ---------------------- -------------------------------------------------- -0.5 RCVD_IN_MSPIKE_H2 RBL: Average reputation (+2) [104.130.96.5 listed in wl.mailspike.net] 0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record -0.0 SPF_PASS SPF: sender matches SPF record 0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily valid -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature X-BeenThere: linux-arm-kernel@lists.infradead.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: Sai Prakash Ranjan , Alexander Shishkin , linux-arm-msm@vger.kernel.org, coresight@lists.linaro.org, linux-kernel@vger.kernel.org, Stephen Boyd , Peter Zijlstra , denik@google.com, linux-arm-kernel@lists.infradead.org Sender: "linux-arm-kernel" Errors-To: linux-arm-kernel-bounces+patchwork-linux-arm=patchwork.kernel.org@lists.infradead.org There was a report of NULL pointer dereference in ETF enable path for perf CS mode with PID. It is almost 100% reproducible when the process to monitor is something very active such as chrome and only with ETF as the sink. Currently in a bid to find the pid, the owner is dereferenced via task_pid_nr() call in tmc_enable_etf_sink_perf(). With owner being NULL, we get a NULL pointer dereference, so check the owner before dereferencing it to prevent the system crash. perf record -e cs_etm/@tmc_etf0/ -N -p Unable to handle kernel NULL pointer dereference at virtual address 0000000000000548 Mem abort info: ESR = 0x96000006 EC = 0x25: DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000006 CM = 0, WnR = 0 Call trace: tmc_enable_etf_sink+0xe4/0x280 coresight_enable_path+0x168/0x1fc etm_event_start+0x8c/0xf8 etm_event_add+0x38/0x54 event_sched_in+0x194/0x2ac group_sched_in+0x54/0x12c flexible_sched_in+0xd8/0x120 visit_groups_merge+0x100/0x16c ctx_flexible_sched_in+0x50/0x74 ctx_sched_in+0xa4/0xa8 perf_event_sched_in+0x60/0x6c perf_event_context_sched_in+0x98/0xe0 __perf_event_task_sched_in+0x5c/0xd8 finish_task_switch+0x184/0x1cc schedule_tail+0x20/0xec ret_from_fork+0x4/0x18 Signed-off-by: Sai Prakash Ranjan --- I am not sure of this incomplete solution hence the RFC. This issue was also reported when this code was first added [1] but somehow it didn't get much notice at the time. So the NULL pointer is propagated from as far as flexible_sched_in() (might even be earlier than this) in events core and deferenced in ETF code where it crashes. So I am not sure if its a problem with the core code or the etf driver. Plus it is not reproducible with all the processes, just something which is quite active ones such as chrome. This is with 5.4 kernel with all the coresight patches backported, I did go through events/core code from latest kernel to see if we are missing any fixes related to this but I couldn't find any so I believe this problem should also exist on latest kernel as well. [1] https://lists.linaro.org/pipermail/coresight/2019-March/002278.html --- drivers/hwtracing/coresight/coresight-tmc-etf.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/hwtracing/coresight/coresight-tmc-etf.c b/drivers/hwtracing/coresight/coresight-tmc-etf.c index 44402d413ebb..32f141d943ca 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etf.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etf.c @@ -242,6 +242,9 @@ static int tmc_enable_etf_sink_perf(struct coresight_device *csdev, void *data) break; } + if (!handle->event->owner) + break; + /* Get a handle on the pid of the process to monitor */ pid = task_pid_nr(handle->event->owner);