Messages in this thread Patch in this message | | | From | Tristan Hume <> | Subject | [PATCH] perf/x86/intel/pt: Fix crash with stop filters in single-range mode | Date | Thu, 27 Jan 2022 17:08:06 -0500 |
| |
Add a check for !buf->single before calling pt_buffer_region_size in a place where a missing check can cause a kernel crash.
Fixes a bug introduced by 670638477aede0d7a355ced04b569214aa3feacd, which added a support for PT single-range output mode. Since that commit if a PT stop filter range is hit while tracing, the kernel will crash because of a null pointer dereference in pt_handle_status due to calling pt_buffer_region_size without a ToPA configured.
The commit which introduced single-range mode guarded almost all uses of the ToPA buffer variables with checks of the buf->single variable, but missed the case where tracing was stopped by the PT hardware, which happens when execution hits a configured stop filter.
Tested that hitting a stop filter while PT recording successfully records a trace with this patch but crashes without this patch.
Signed-off-by: Tristan Hume <tristan@thume.ca> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Peter Zijlstra (Intel) <peterz@infradead.org> --- arch/x86/events/intel/pt.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c index 7f406c14715f..2d33bba9a144 100644 --- a/arch/x86/events/intel/pt.c +++ b/arch/x86/events/intel/pt.c @@ -897,8 +897,9 @@ static void pt_handle_status(struct pt *pt) * means we are already losing data; need to let the decoder * know. */ - if (!intel_pt_validate_hw_cap(PT_CAP_topa_multiple_entries) || - buf->output_off == pt_buffer_region_size(buf)) { + if (!buf->single && + (!intel_pt_validate_hw_cap(PT_CAP_topa_multiple_entries) || + buf->output_off == pt_buffer_region_size(buf))) { perf_aux_output_flag(&pt->handle, PERF_AUX_FLAG_TRUNCATED); advance++; -- 2.21.1 (Apple Git-122.3)
| |