All of lore.kernel.org
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org,
	"Peter Zijlstra (Intel)" <peterz@infradead.org>,
	Arnaldo Carvalho de Melo <acme@redhat.com>,
	David Ahern <dsahern@gmail.com>, Jiri Olsa <jolsa@redhat.com>,
	Kan Liang <kan.liang@intel.com>,
	Linus Torvalds <torvalds@linux-foundation.org>,
	Namhyung Kim <namhyung@kernel.org>,
	Stephane Eranian <eranian@google.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Vince Weaver <vincent.weaver@maine.edu>,
	Ingo Molnar <mingo@kernel.org>
Subject: [PATCH 4.4 13/18] perf/x86: Fix uninitialized value usage
Date: Mon,  4 May 2020 19:57:11 +0200	[thread overview]
Message-ID: <20200504165444.253471372@linuxfoundation.org> (raw)
In-Reply-To: <20200504165441.533160703@linuxfoundation.org>

From: Peter Zijlstra <peterz@infradead.org>

commit e01d8718de4170373cd7fbf5cf6f9cb61cebb1e9 upstream.

When calling intel_alt_er() with .idx != EXTRA_REG_RSP_* we will not
initialize alt_idx and then use this uninitialized value to index an
array.

When that is not fatal, it can result in an infinite loop in its
caller __intel_shared_reg_get_constraints(), with IRQs disabled.

Alternative error modes are random memory corruption due to the
cpuc->shared_regs->regs[] array overrun, which manifest in either
get_constraints or put_constraints doing weird stuff.

Only took 6 hours of painful debugging to find this. Neither GCC nor
Smatch warnings flagged this bug.

Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Kan Liang <kan.liang@intel.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Fixes: ae3f011fc251 ("perf/x86/intel: Fix SLM MSR_OFFCORE_RSP1 valid_mask")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/kernel/cpu/perf_event_intel.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/arch/x86/kernel/cpu/perf_event_intel.c
+++ b/arch/x86/kernel/cpu/perf_event_intel.c
@@ -1937,7 +1937,8 @@ intel_bts_constraints(struct perf_event
 
 static int intel_alt_er(int idx, u64 config)
 {
-	int alt_idx;
+	int alt_idx = idx;
+
 	if (!(x86_pmu.flags & PMU_FL_HAS_RSP_1))
 		return idx;
 



  parent reply	other threads:[~2020-05-04 17:59 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-04 17:56 [PATCH 4.4 00/18] 4.4.222-rc1 review Greg Kroah-Hartman
2020-05-04 17:56 ` [PATCH 4.4 01/18] ext4: fix special inode number checks in __ext4_iget() Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 02/18] drm/qxl: qxl_release leak in qxl_hw_surface_alloc() Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 03/18] ALSA: pcm: oss: Place the plugin buffer overflow checks correctly Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 04/18] PM: ACPI: Output correct message on target power state Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 05/18] RDMA/mlx4: Initialize ib_spec on the stack Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 06/18] vfio/type1: Fix VA->PA translation for PFNMAP VMAs in vaddr_get_pfn() Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 07/18] ALSA: opti9xx: shut up gcc-10 range warning Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 08/18] nfs: Fix potential posix_acl refcnt leak in nfs3_set_acl Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 09/18] dmaengine: dmatest: Fix iteration non-stop logic Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 10/18] i2c: designware-pci: use IRQF_COND_SUSPEND flag Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 11/18] perf hists: Fix HISTC_MEM_DCACHELINE width setting Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 12/18] powerpc/perf: Remove PPMU_HAS_SSLOT flag for Power8 Greg Kroah-Hartman
2020-05-04 17:57 ` Greg Kroah-Hartman [this message]
2020-05-04 17:57 ` [PATCH 4.4 14/18] [media] exynos4-is: fix a format string bug Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 15/18] ASoC: wm8960: Fix WM8960_SYSCLK_PLL mode Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 16/18] ASoC: imx-spdif: Fix crash on suspend Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 17/18] ipv6: use READ_ONCE() for inet->hdrincl as in ipv4 Greg Kroah-Hartman
2020-05-04 17:57 ` [PATCH 4.4 18/18] selinux: properly handle multiple messages in selinux_netlink_send() Greg Kroah-Hartman
2020-05-05  7:43 ` [PATCH 4.4 00/18] 4.4.222-rc1 review Chris Paterson
2020-05-05  8:36 ` Jon Hunter
2020-05-05  8:36   ` Jon Hunter
2020-05-05 15:41 ` Guenter Roeck
2020-05-05 15:50 ` Naresh Kamboju

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200504165444.253471372@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=acme@redhat.com \
    --cc=dsahern@gmail.com \
    --cc=eranian@google.com \
    --cc=jolsa@redhat.com \
    --cc=kan.liang@intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=namhyung@kernel.org \
    --cc=peterz@infradead.org \
    --cc=stable@vger.kernel.org \
    --cc=tglx@linutronix.de \
    --cc=torvalds@linux-foundation.org \
    --cc=vincent.weaver@maine.edu \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.