linux-kernel - Re: [PATCH] coresight: perf: Fix pointer check with IS_ERR_OR

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20cec516-1589-4fc5-ac07-06029f2dc143@linaro.org>
Date: Thu, 4 Sep 2025 13:11:37 +0100
From: James Clark <james.clark@...aro.org>
To: Leo Yan <leo.yan@....com>
Cc: coresight@...ts.linaro.org, linux-arm-kernel@...ts.infradead.org,
 linux-kernel@...r.kernel.org, Tamas Zsoldos <tamas.zsoldos@....com>,
 Suzuki K Poulose <suzuki.poulose@....com>, Mike Leach
 <mike.leach@...aro.org>,
 Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
 Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
 Mathieu Poirier <mathieu.poirier@...aro.org>
Subject: Re: [PATCH] coresight: perf: Fix pointer check with IS_ERR_OR_NULL()



On 04/09/2025 1:00 pm, James Clark wrote:
> 
> 
> On 04/09/2025 11:53 am, Leo Yan wrote:
>> The returned pointer from .alloc_buffer() callback can be an error, if
>> only checking NULL pointer the driver cannot capture errors. The driver
>> will proceed even after failure and cause kernel panic.
>>
>> Change to use IS_ERR_OR_NULL() check for capture error cases.
>>
>> Fixes: 0bcbf2e30ff2 ("coresight: etm-perf: new PMU driver for ETM 
>> tracers")
>> Reported-by: Tamas Zsoldos <tamas.zsoldos@....com>
>> Signed-off-by: Leo Yan <leo.yan@....com>
>> ---
>>   drivers/hwtracing/coresight/coresight-etm-perf.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/ 
>> drivers/hwtracing/coresight/coresight-etm-perf.c
>> index 
>> f677c08233ba1a28b277674662c6e6db904873dd..440d967f5d0962df187a81b0dd69a7d82a8b62ba 100644
>> --- a/drivers/hwtracing/coresight/coresight-etm-perf.c
>> +++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
>> @@ -198,7 +198,7 @@ static void free_sink_buffer(struct etm_event_data 
>> *event_data)
>>       cpumask_t *mask = &event_data->mask;
>>       struct coresight_device *sink;
>> -    if (!event_data->snk_config)
>> +    if (IS_ERR_OR_NULL(event_data->snk_config))
>>           return;
>>       if (WARN_ON(cpumask_empty(mask)))
>> @@ -450,7 +450,7 @@ static void *etm_setup_aux(struct perf_event 
>> *event, void **pages,
>>       event_data->snk_config =
>>               sink_ops(sink)->alloc_buffer(sink, event, pages,
>>                                nr_pages, overwrite);
>> -    if (!event_data->snk_config)
>> +    if (IS_ERR_OR_NULL(event_data->snk_config))
>>           goto err;
> 
> I think the bug is in TRBE. It's the only one that returns an error 
> pointer, but only for -ENOMEM which would normally be NULL for alloc 
> type functions anyway.
> 
> Also it's assigned to event_data->snk_config which is later NULL checked 
> rather than IS_ERR_OR_NULL in free_sink_buffer(). Maybe that path 
> doesn't happen, but all instances should be updated anyway.

Oh sorry I was only looking at the update to etm_setup_aux() so both 
functions are covered. But the other points still apply.

> 
> It's much easier to keep it as NULL and make the fix in TRBE. It also 
> wouldn't need to be backported as far.
> 
>>   out:
>>
>> ---
>> base-commit: fa71e9cb4cfa59abb196229667ec84929bdc18fe
>> change-id: 20250904-cs_etm_auxsetup_fix_error_handling-cb7e07ed9adf
>>
>> Best regards,
>