linux-kernel - Re: [PATCH] coresight: fix kernel panic caused by invalid CPU

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANLsYky=URDp64M_A87+9JMZqTzouC5P5biT-vCWuYoQ8GZd+w@mail.gmail.com>
Date:   Tue, 3 Jan 2017 13:37:05 -0700
From:   Mathieu Poirier <mathieu.poirier@...aro.org>
To:     Wang Nan <wangnan0@...wei.com>
Cc:     "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        Xia Kaixu <xiakaixu@...wei.com>, Li Zefan <lizefan@...wei.com>
Subject: Re: [PATCH] coresight: fix kernel panic caused by invalid CPU

On 25 December 2016 at 23:31, Wang Nan <wangnan0@...wei.com> wrote:
> Commit d52c9750f150 ("coresight: reset 'enable_sink' flag when need be")
> caused a kernel panic because of the using of an invalid value: after
> 'for_each_cpu(cpu, mask)', value of local variable 'cpu' become invalid,
> causes following 'cpu_to_node' access invalid memory area.
>
> This patch brings the deleted 'cpu = cpumask_first(mask)' back.
>
> Panic log:
>
>  $ perf record -e cs_etm// ls
>
>  Unable to handle kernel paging request at virtual address fffe801804af4f10
>  pgd = ffff8017ce031600
>  [fffe801804af4f10] *pgd=0000000000000000, *pud=0000000000000000
>  Internal error: Oops: 96000004 [#1] SMP
>  Modules linked in:
>  CPU: 33 PID: 1619 Comm: perf Not tainted 4.7.1+ #16
>  Hardware name: Huawei Taishan 2280 /CH05TEVBA, BIOS 1.10 11/24/2016
>  task: ffff8017cb0c8400 ti: ffff8017cb154000 task.ti: ffff8017cb154000
>  PC is at tmc_alloc_etf_buffer+0x60/0xd4
>  LR is at tmc_alloc_etf_buffer+0x44/0xd4
>  pc : [<ffff000008633df8>] lr : [<ffff000008633ddc>] pstate: 60000145
>  sp : ffff8017cb157b40
>  x29: ffff8017cb157b40 x28: 0000000000000000
>  ...skip...
>  7a60: ffff000008c64dc8 0000000000000006 0000000000000253 ffffffffffffffff
>  7a80: 0000000000000000 0000000000000000 ffff0000080872cc 0000000000000001
>  [<ffff000008633df8>] tmc_alloc_etf_buffer+0x60/0xd4
>  [<ffff000008632b9c>] etm_setup_aux+0x1dc/0x1e8
>  [<ffff00000816eed4>] rb_alloc_aux+0x2b0/0x338
>  [<ffff00000816a5e4>] perf_mmap+0x414/0x568
>  [<ffff0000081ab694>] mmap_region+0x324/0x544
>  [<ffff0000081abbe8>] do_mmap+0x334/0x3e0
>  [<ffff000008191150>] vm_mmap_pgoff+0xa4/0xc8
>  [<ffff0000081a9a30>] SyS_mmap_pgoff+0xb0/0x22c
>  [<ffff0000080872e4>] sys_mmap+0x18/0x28
>  [<ffff0000080843f0>] el0_svc_naked+0x24/0x28
>  Code: 912040a5 d0001c00 f873d821 911c6000 (b8656822)
>  ---[ end trace 98933da8f92b0c9a ]---
>
> Signed-off-by: Wang Nan <wangnan0@...wei.com>
> Cc: Xia Kaixu <xiakaixu@...wei.com>
> Cc: Li Zefan <lizefan@...wei.com>
> Cc: Mathieu Poirier <mathieu.poirier@...aro.org>
> Cc: linux-arm-kernel@...ts.infradead.org
> Cc: linux-kernel@...r.kernel.org
> ---
>  drivers/hwtracing/coresight/coresight-etm-perf.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/drivers/hwtracing/coresight/coresight-etm-perf.c
> index 1774196..26cfac3 100644
> --- a/drivers/hwtracing/coresight/coresight-etm-perf.c
> +++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
> @@ -242,6 +242,7 @@ static void *etm_setup_aux(int event_cpu, void **pages,
>         if (!sink_ops(sink)->alloc_buffer)
>                 goto err;
>
> +       cpu = cpumask_first(mask);
>         /* Get the AUX specific data from the sink buffer */
>         event_data->snk_config =
>                         sink_ops(sink)->alloc_buffer(sink, cpu, pages,
> --
> 2.10.1
>

Applied - thanks.