From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Jia-Ju Bai <baijiaju1990@gmail.com>,
TOTE Robot <oslab@tsinghua.edu.cn>,
Steven Rostedt <rostedt@goodmis.org>,
Sasha Levin <sashal@kernel.org>,
mhiramat@kernel.org, linux-trace-kernel@vger.kernel.org
Subject: [PATCH AUTOSEL 6.2 1/6] tracing: Add NULL checks for buffer in ring_buffer_free_read_page()
Date: Wed, 1 Mar 2023 11:29:24 -0500 [thread overview]
Message-ID: <20230301162929.1302785-1-sashal@kernel.org> (raw)
From: Jia-Ju Bai <baijiaju1990@gmail.com>
[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]
In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.
However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():
tracing_buffers_release()
ring_buffer_wake_waiters(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
ring_buffer_free_read_page(iter->array_buffer->buffer)
cpu_buffer = buffer->buffers[cpu] -> No check
Thus, to avod possible null-pointer derefernces, the related checks
should be added.
These results are reported by a static tool designed by myself.
Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com
Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
kernel/trace/ring_buffer.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index c366a0a9ddba4..45d4a23d60444 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -5626,11 +5626,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
*/
void ring_buffer_free_read_page(struct trace_buffer *buffer, int cpu, void *data)
{
- struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
+ struct ring_buffer_per_cpu *cpu_buffer;
struct buffer_data_page *bpage = data;
struct page *page = virt_to_page(bpage);
unsigned long flags;
+ if (!buffer || !buffer->buffers || !buffer->buffers[cpu])
+ return;
+
+ cpu_buffer = buffer->buffers[cpu];
+
/* If the page is still in use someplace else, we can't reuse it */
if (page_ref_count(page) > 1)
goto out;
--
2.39.2
next reply other threads:[~2023-03-01 16:29 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2023-03-01 16:29 Sasha Levin [this message]
2023-03-01 16:29 ` [PATCH AUTOSEL 6.2 2/6] efi: efivars: prevent double registration Sasha Levin
2023-03-01 16:31 ` Ard Biesheuvel
2023-03-01 18:59 ` Sasha Levin
2023-03-01 16:29 ` [PATCH AUTOSEL 6.2 3/6] kernel/printk/index.c: fix memory leak with using debugfs_lookup() Sasha Levin
2023-03-01 16:29 ` [PATCH AUTOSEL 6.2 4/6] firmware/efi sysfb_efi: Add quirk for Lenovo IdeaPad Duet 3 Sasha Levin
2023-03-01 16:29 ` [PATCH AUTOSEL 6.2 5/6] bootconfig: Increase max nodes of bootconfig from 1024 to 8192 for DCC support Sasha Levin
2023-03-01 16:29 ` [PATCH AUTOSEL 6.2 6/6] mfd: arizona: Use pm_runtime_resume_and_get() to prevent refcnt leak Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20230301162929.1302785-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=baijiaju1990@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-trace-kernel@vger.kernel.org \
--cc=mhiramat@kernel.org \
--cc=oslab@tsinghua.edu.cn \
--cc=rostedt@goodmis.org \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox