From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
To: Suzuki K Poulose <suzuki.poulose@arm.com>
Cc: Mathieu Poirier <mathieu.poirier@linaro.org>,
Mike Leach <mike.leach@linaro.org>, Leo Yan <leo.yan@linaro.org>,
coresight@lists.linaro.org, Stephen Boyd <swboyd@chromium.org>,
Denis Nikitin <denik@chromium.org>,
linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-arm-kernel@lists.infradead.org, stable@vger.kernel.org
Subject: Re: [PATCH] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()
Date: Tue, 25 May 2021 17:17:51 +0530 [thread overview]
Message-ID: <ee7abbb2cfebf982addec0a4a18d9512@codeaurora.org> (raw)
In-Reply-To: <dc18845a-73bf-9cbf-6749-6271dcaac9e8@arm.com>
On 2021-05-25 14:24, Suzuki K Poulose wrote:
> Hi Sai
>
> On 05/05/2021 10:47, Suzuki K Poulose wrote:
>> On 05/05/2021 10:34, Sai Prakash Ranjan wrote:
>>> commit 6f755e85c332 ("coresight: Add helper for inserting
>>> synchronization
>>> packets") removed trailing '\0' from barrier_pkt array and updated
>>> the
>>> call sites like etb_update_buffer() to have proper checks for
>>> barrier_pkt
>>> size before read but missed updating tmc_update_etf_buffer() which
>>> still
>>> reads barrier_pkt past the array size resulting in KASAN
>>> out-of-bounds
>>> bug. Fix this by adding a check for barrier_pkt size before accessing
>>> like it is done in etb_update_buffer().
>>>
>>> BUG: KASAN: global-out-of-bounds in
>>> tmc_update_etf_buffer+0x4b8/0x698
>>> Read of size 4 at addr ffffffd05b7d1030 by task perf/2629
>>>
>>> Call trace:
>>> dump_backtrace+0x0/0x27c
>>> show_stack+0x20/0x2c
>>> dump_stack+0x11c/0x188
>>> print_address_description+0x3c/0x4a4
>>> __kasan_report+0x140/0x164
>>> kasan_report+0x10/0x18
>>> __asan_report_load4_noabort+0x1c/0x24
>>> tmc_update_etf_buffer+0x4b8/0x698
>>> etm_event_stop+0x248/0x2d8
>>> etm_event_del+0x20/0x2c
>>> event_sched_out+0x214/0x6f0
>>> group_sched_out+0xd0/0x270
>>> ctx_sched_out+0x2ec/0x518
>>> __perf_event_task_sched_out+0x4fc/0xe6c
>>> __schedule+0x1094/0x16a0
>>> preempt_schedule_irq+0x88/0x170
>>> arm64_preempt_schedule_irq+0xf0/0x18c
>>> el1_irq+0xe8/0x180
>>> perf_event_exec+0x4d8/0x56c
>>> setup_new_exec+0x204/0x400
>>> load_elf_binary+0x72c/0x18c0
>>> search_binary_handler+0x13c/0x420
>>> load_script+0x500/0x6c4
>>> search_binary_handler+0x13c/0x420
>>> exec_binprm+0x118/0x654
>>> __do_execve_file+0x77c/0xba4
>>> __arm64_compat_sys_execve+0x98/0xac
>>> el0_svc_common+0x1f8/0x5e0
>>> el0_svc_compat_handler+0x84/0xb0
>>> el0_svc_compat+0x10/0x50
>>>
>>> The buggy address belongs to the variable:
>>> barrier_pkt+0x10/0x40
>>>
>>> Memory state around the buggy address:
>>> ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00
>>> ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
>>> >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03
>>> ^
>>> ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa
>>> ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa
>>> ==================================================================
>>>
>>> Fixes: 6f755e85c332 ("coresight: Add helper for inserting
>>> synchronization packets")
>
> I have changed the commit to :
>
> Fixes: 0c3fc4d5fa26 ("coresight: Add barrier packet for
> synchronisation")
>
> Applied.
>
Sure, thanks Suzuki.
Regards,
Sai
--
QUALCOMM INDIA, on behalf of Qualcomm Innovation Center, Inc. is a
member
of Code Aurora Forum, hosted by The Linux Foundation
prev parent reply other threads:[~2021-05-25 11:48 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-05-05 9:34 [PATCH] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() Sai Prakash Ranjan
2021-05-05 9:47 ` Suzuki K Poulose
2021-05-05 9:47 ` Suzuki K Poulose
2021-05-25 8:54 ` Suzuki K Poulose
2021-05-25 8:54 ` Suzuki K Poulose
2021-05-25 11:47 ` Sai Prakash Ranjan [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=ee7abbb2cfebf982addec0a4a18d9512@codeaurora.org \
--to=saiprakash.ranjan@codeaurora.org \
--cc=coresight@lists.linaro.org \
--cc=denik@chromium.org \
--cc=leo.yan@linaro.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-arm-msm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mathieu.poirier@linaro.org \
--cc=mike.leach@linaro.org \
--cc=stable@vger.kernel.org \
--cc=suzuki.poulose@arm.com \
--cc=swboyd@chromium.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.