[PATCH] perf/x86/intel/pt: Fix NULL pointer dereference in pt_buffer_reset_markers

[PATCH] perf/x86/intel/pt: Fix NULL pointer dereference in pt_buffer_reset_markers

[Qianqiang Liu]

The buf->stop_te and buf->intr_te may be NULL, so we need to check
for NULL pointers before using them.

Fixes: 39152ee51b77 ("perf/x86/intel/pt: Get rid of reverse lookup table for ToPA")
Signed-off-by: Qianqiang Liu <qianqiang.liu@163.com>
---
 arch/x86/events/intel/pt.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/arch/x86/events/intel/pt.c b/arch/x86/events/intel/pt.c
index fd4670a6694e..96bd6aedeb37 100644
--- a/arch/x86/events/intel/pt.c
+++ b/arch/x86/events/intel/pt.c
@@ -1138,9 +1138,12 @@ static int pt_buffer_reset_markers(struct pt_buffer *buf,
 		buf->intr_te = pt_topa_prev_entry(buf, buf->intr_te);
 	}
 
-	buf->stop_te->stop = 1;
-	buf->stop_te->intr = 1;
-	buf->intr_te->intr = 1;
+	if (buf->stop_te) {
+		buf->stop_te->stop = 1;
+		buf->stop_te->intr = 1;
+	}
+	if (buf->intr_te)
+		buf->intr_te->intr = 1;
 
 	return 0;
 }
-- 
2.46.2

Re: [PATCH] perf/x86/intel/pt: Fix NULL pointer dereference in pt_buffer_reset_markers

[Alexander Shishkin]

Qianqiang Liu <qianqiang.liu@163.com> writes:

> The buf->stop_te and buf->intr_te may be NULL, so we need to check
> for NULL pointers before using them.

Iirc, this has come up before, because static analyzers get the idea
that at that point ->stop_te and ->intr_te can be NULL, but in reality,
they can't. When the buffer is created, stop_pos and intr_pos are set to
-1, which will always force ->stop_te and ->intr_te to be set the first
time around.

So no, not a bug. It might deserve a comment explaining the above logic,
so that more versions of this patch don't get generated from static
analyzers' reports.

Regards,
--
Alex

Re: [PATCH] perf/x86/intel/pt: Fix NULL pointer dereference in pt_buffer_reset_markers

[Qianqiang Liu]

> So no, not a bug. It might deserve a comment explaining the above logic,
> so that more versions of this patch don't get generated from static
> analyzers' reports.

Got it, thanks!

-- 
Best,
Qianqiang Liu