mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-08-23 09:19:51 +00:00
![]() Vince's perf fuzzer uncovered the following issue on Alpha: Unable to handle kernel paging request at virtual address fffffbfe4e46a0e8 CPU 0 perf_fuzzer(1278): Oops 0 pc = [<fffffc000031fbc0>] ra = [<fffffc000031ff54>] ps = 0007 Not tainted pc is at alpha_perf_event_set_period+0x60/0xf0 ra is at alpha_pmu_enable+0x1a4/0x1c0 v0 = 0000000000000000 t0 = 00000000000fffff t1 = fffffc007b3f5800 t2 = fffffbff275faa94 t3 = ffffffffc9b9bd89 t4 = fffffbfe4e46a098 t5 = 0000000000000020 t6 = fffffbfe4e46a0b8 t7 = fffffc007f4c8000 s0 = 0000000000000000 s1 = fffffc0001b0c018 s2 = fffffc0001b0c020 s3 = fffffc007b3f5800 s4 = 0000000000000001 s5 = ffffffffc9b9bd85 s6 = 0000000000000001 a0 = 0000000000000006 a1 = fffffc007b3f5908 a2 = fffffbfe4e46a098 a3 = 00000005000108c0 a4 = 0000000000000000 a5 = 0000000000000000 t8 = 0000000000000001 t9 = 0000000000000001 t10= 0000000027829f6f t11= 0000000000000020 pv = fffffc000031fb60 at = fffffc0000950900 gp = fffffc0000940900 sp = fffffc007f4cbca8 Disabling lock debugging due to kernel taint Trace: [<fffffc000031ff54>] alpha_pmu_enable+0x1a4/0x1c0 [<fffffc000039f4e8>] perf_pmu_enable+0x48/0x60 [<fffffc00003a0d6c>] __perf_install_in_context+0x15c/0x230 [<fffffc000039d1f0>] remote_function+0x80/0xa0 [<fffffc00003a0c10>] __perf_install_in_context+0x0/0x230 [<fffffc000037b7e4>] smp_call_function_single+0x1b4/0x1d0 [<fffffc000039bb70>] task_function_call+0x60/0x80 [<fffffc00003a0c10>] __perf_install_in_context+0x0/0x230 [<fffffc000039bb44>] task_function_call+0x34/0x80 [<fffffc000039d3fc>] perf_install_in_context+0x9c/0x150 [<fffffc00003a0c10>] __perf_install_in_context+0x0/0x230 [<fffffc00003a5100>] SYSC_perf_event_open+0x360/0xac0 [<fffffc00003110c4>] entSys+0xa4/0xc0 This is due to the raw event encoding being used as an index directly into the ev67_mapping array, rather than being validated against the ev67_pmc_event_type enumeration instead. Unlike other architectures, which allow raw events to propagate into the hardware counters with little interference, the limited number of events on Alpha and the strict event <-> counter relationships mean that raw events actually correspond to the Linux-specific Alpha events, rather than anything defined by the architecture. This patch adds a new callback to alpha_pmu_t for validating the raw event encoding with the Linux event types for the PMU, preventing the out-of-bounds array access. Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Acked-by: Michael Cree <mcree@orcon.net.nz> Acked-by: Matt Turner <mattst88@gmail.com> Signed-off-by: Will Deacon <will.deacon@arm.com> |
||
---|---|---|
.. | ||
.gitignore | ||
alpha_ksyms.c | ||
asm-offsets.c | ||
binfmt_loader.c | ||
console.c | ||
core_apecs.c | ||
core_cia.c | ||
core_irongate.c | ||
core_lca.c | ||
core_marvel.c | ||
core_mcpcia.c | ||
core_polaris.c | ||
core_t2.c | ||
core_titan.c | ||
core_tsunami.c | ||
core_wildfire.c | ||
entry.S | ||
err_common.c | ||
err_ev6.c | ||
err_ev7.c | ||
err_impl.h | ||
err_marvel.c | ||
err_titan.c | ||
es1888.c | ||
gct.c | ||
head.S | ||
io.c | ||
irq.c | ||
irq_alpha.c | ||
irq_i8259.c | ||
irq_impl.h | ||
irq_pyxis.c | ||
irq_srm.c | ||
machvec_impl.h | ||
Makefile | ||
module.c | ||
osf_sys.c | ||
pc873xx.c | ||
pc873xx.h | ||
pci-noop.c | ||
pci-sysfs.c | ||
pci.c | ||
pci_impl.h | ||
pci_iommu.c | ||
perf_event.c | ||
process.c | ||
proto.h | ||
ptrace.c | ||
rtc.c | ||
setup.c | ||
signal.c | ||
smc37c93x.c | ||
smc37c669.c | ||
smp.c | ||
srm_env.c | ||
srmcons.c | ||
sys_alcor.c | ||
sys_cabriolet.c | ||
sys_dp264.c | ||
sys_eb64p.c | ||
sys_eiger.c | ||
sys_jensen.c | ||
sys_marvel.c | ||
sys_miata.c | ||
sys_mikasa.c | ||
sys_nautilus.c | ||
sys_noritake.c | ||
sys_rawhide.c | ||
sys_ruffian.c | ||
sys_rx164.c | ||
sys_sable.c | ||
sys_sio.c | ||
sys_sx164.c | ||
sys_takara.c | ||
sys_titan.c | ||
sys_wildfire.c | ||
systbls.S | ||
time.c | ||
traps.c | ||
vmlinux.lds.S |