2013-03-19 15:10:44

by Stephane Eranian

Subject: [PATCH v2] perf,x86: fix uninitialized pt_regs in intel_pmu_drain_bts_buffer()

This patch fixes an uninitialized pt_regs struct in drain BTS
function. The pt_regs struct is propagated all the way to the
code_get_segment() function from perf_instruction_pointer()
and may get garbage.

We cannot simply inherit the actual pt_regs from the interrupt
because BTS must be flushed on context-switch or when the associated
event is disabled. And there we do not have a pt_regs handy.

Setting pt_regs to all zeroes may not be the best option but it is
not clear what else to do given where the drain_bts_buffer() is called
from.

In V2, we move the memset() later in the code to avoid doing it when
we end up returning early without doing the actual BTS processing.
Also dropped the reg.val initialization because it is redundant with
the memset() as suggested by PeterZ.

Signed-off-by: Stephane Eranian <[email protected]>
---

diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index b05a575..26830f3 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -314,10 +314,11 @@ int intel_pmu_drain_bts_buffer(void)
if (top <= at)
return 0;

+ memset(&regs, 0, sizeof(regs));
+
ds->bts_index = ds->bts_buffer_base;

perf_sample_data_init(&data, 0, event->hw.last_period);
- regs.ip = 0;

/*
* Prepare a generic sample, i.e. fill in the invariant fields.

2013-03-21 18:16:35

by tip-bot for Vasyl Gomonovych

Subject: [tip:perf/urgent] perf/x86: Fix uninitialized pt_regs in intel_pmu_drain_bts_buffer()

Commit-ID: 0e48026ae7abf871e51eaa9183c81ab5bef4c267
Gitweb: http://git.kernel.org/tip/0e48026ae7abf871e51eaa9183c81ab5bef4c267
Author: Stephane Eranian <[email protected]>
AuthorDate: Tue, 19 Mar 2013 16:10:38 +0100
Committer: Ingo Molnar <[email protected]>
CommitDate: Thu, 21 Mar 2013 12:03:29 +0100

perf/x86: Fix uninitialized pt_regs in intel_pmu_drain_bts_buffer()

This patch fixes an uninitialized pt_regs struct in drain BTS
function. The pt_regs struct is propagated all the way to the
code_get_segment() function from perf_instruction_pointer()
and may get garbage.

We cannot simply inherit the actual pt_regs from the interrupt
because BTS must be flushed on context-switch or when the
associated event is disabled. And there we do not have a pt_regs
handy.

Setting pt_regs to all zeroes may not be the best option but it
is not clear what else to do given where the drain_bts_buffer()
is called from.

In V2, we move the memset() later in the code to avoid doing it
when we end up returning early without doing the actual BTS
processing. Also dropped the reg.val initialization because it
is redundant with the memset() as suggested by PeterZ.

Signed-off-by: Stephane Eranian <[email protected]>
Acked-by: Peter Zijlstra <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Cc: [email protected]
Link: http://lkml.kernel.org/r/20130319151038.GA25439@quad
Signed-off-by: Ingo Molnar <[email protected]>
---
arch/x86/kernel/cpu/perf_event_intel_ds.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/arch/x86/kernel/cpu/perf_event_intel_ds.c b/arch/x86/kernel/cpu/perf_event_intel_ds.c
index 826054a..f71c9f0 100644
--- a/arch/x86/kernel/cpu/perf_event_intel_ds.c
+++ b/arch/x86/kernel/cpu/perf_event_intel_ds.c
@@ -314,10 +314,11 @@ int intel_pmu_drain_bts_buffer(void)
if (top <= at)
return 0;

+ memset(&regs, 0, sizeof(regs));
+
ds->bts_index = ds->bts_buffer_base;

perf_sample_data_init(&data, 0, event->hw.last_period);
- regs.ip = 0;

/*
* Prepare a generic sample, i.e. fill in the invariant fields.