linux-kernel - [tip:perf/urgent] perf/x86: Fix uninitialized pt_regs in intel_pmu_drain_bts

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:	Thu, 21 Mar 2013 11:15:17 -0700
From:	tip-bot for Stephane Eranian <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	linux-kernel@...r.kernel.org, eranian@...gle.com, hpa@...or.com,
	mingo@...nel.org, a.p.zijlstra@...llo.nl, tglx@...utronix.de
Subject: [tip:perf/urgent] perf/x86:
  Fix uninitialized pt_regs in intel_pmu_drain_bts_buffer()

Commit-ID:  0e48026ae7abf871e51eaa9183c81ab5bef4c267
Gitweb:     http://git.kernel.org/tip/0e48026ae7abf871e51eaa9183c81ab5bef4c267
Author:     Stephane Eranian <eranian@...gle.com>
AuthorDate: Tue, 19 Mar 2013 16:10:38 +0100
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Thu, 21 Mar 2013 12:03:29 +0100

perf/x86: Fix uninitialized pt_regs in intel_pmu_drain_bts_buffer()

This patch fixes an uninitialized pt_regs struct in drain BTS
function. The pt_regs struct is propagated all the way to the
code_get_segment() function from perf_instruction_pointer()
and may get garbage.

We cannot simply inherit the actual pt_regs from the interrupt
because BTS must be flushed on context-switch or when the
associated event is disabled. And there we do not have a pt_regs
handy.

Setting pt_regs to all zeroes may not be the best option but it
is not clear what else to do given where the drain_bts_buffer()
is called from.

In V2, we move the memset() later in the code to avoid doing it
when we end up returning early without doing the actual BTS
processing. Also dropped the reg.val initialization because it
is redundant with the memset() as suggested by PeterZ.

Signed-off-by: Stephane Eranian <eranian@...gle.com>
Acked-by: Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc: peterz@...radead.org
Cc: sqazi@...gle.com
Cc: ak@...ux.intel.com
Cc: jolsa@...hat.com
Link: http://lkml.kernel.org/r/20130319151038.GA25439@quad
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 arch/x86/kernel/cpu/perf_event_intel_ds.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 826054a..f71c9f0 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -314,10 +314,11 @@ int intel_pmu_drain_bts_buffer(void)
 	if (top <= at)
 		return 0;
 
+	memset(&regs, 0, sizeof(regs));
+
 	ds->bts_index = ds->bts_buffer_base;
 
 	perf_sample_data_init(&data, 0, event->hw.last_period);
-	regs.ip     = 0;
 
 	/*
 	 * Prepare a generic sample, i.e. fill in the invariant fields.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/