linux-kernel - [PATCH v2] perf,x86: fix uninitialized pt_regs in intel_pmu_drain_bts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130319151038.GA25439@quad>
Date:	Tue, 19 Mar 2013 16:10:38 +0100
From:	Stephane Eranian <eranian@...gle.com>
To:	linux-kernel@...r.kernel.org
Cc:	peterz@...radead.org, mingo@...e.hu, sqazi@...gle.com,
	ak@...ux.intel.com, jolsa@...hat.com
Subject: [PATCH v2] perf,x86: fix uninitialized pt_regs in
 intel_pmu_drain_bts_buffer()

This patch fixes an uninitialized pt_regs struct in drain BTS
function. The pt_regs struct is propagated all the way to the
code_get_segment() function from perf_instruction_pointer()
and may get garbage.

We cannot simply inherit the actual pt_regs from the interrupt
because BTS must be flushed on context-switch or when the associated
event is disabled. And there we do not have a pt_regs handy.

Setting pt_regs to all zeroes may not be the best option but it is
not clear what else to do given where the drain_bts_buffer() is called
from.

In V2, we move the memset() later in the code to avoid doing it when
we end up returning early without doing the actual BTS processing.
Also dropped the reg.val initialization because it is redundant with
the memset() as suggested by PeterZ.

Signed-off-by: Stephane Eranian <eranian@...gle.com>
---

diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index b05a575..26830f3 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -314,10 +314,11 @@ int intel_pmu_drain_bts_buffer(void)
 	if (top <= at)
 		return 0;

+	memset(&regs, 0, sizeof(regs));
+
 	ds->bts_index = ds->bts_buffer_base;

 	perf_sample_data_init(&data, 0, event->hw.last_period);
-	regs.ip     = 0;

 	/*
 	 * Prepare a generic sample, i.e. fill in the invariant fields.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/