From patchwork Tue Nov 1 23:10:09 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Steven Rostedt X-Patchwork-Id: 13965 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:a5d:6687:0:0:0:0:0 with SMTP id l7csp3265170wru; Tue, 1 Nov 2022 16:13:05 -0700 (PDT) X-Google-Smtp-Source: AMsMyM7Bg/yeBH2jNtRXkF92XU7Li3ieFo3S+uXB+HyCEqI8WynZryNXrVCTo107li3LybvRgDFL X-Received: by 2002:a05:6a00:a94:b0:56d:5c36:7eb8 with SMTP id b20-20020a056a000a9400b0056d5c367eb8mr14527012pfl.38.1667344384740; Tue, 01 Nov 2022 16:13:04 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1667344384; cv=none; d=google.com; s=arc-20160816; b=B7lRA8z9cV6loe/7Dj7+C6VV8/b2O9tyKHt1jL13yKuwaY8lryXbK3q4Fe6ho+1ZNX gRKuCEcQ6DB2Kr477v25syXEwyoZtdzc/7YR0dZq/Ja64uTZJaefx7hmvv0vCo7L6Rq+ 8wGlhrMw24O8gnJrBfzHd8Bxlo8sVFjq6gh1YYEC4YT8NDMIbrnVGSgekjgeoV0RPwFC R6oHvgYrnO4k1d/odAWNFHA8CICEMGY93IX4xxmcRqJTDRJ6zK/fKkewvOivnsWBmDYy sNCmmMtpxWIuqCvIw0CzTm6DJ8TiXJzuTWVwFvalvm7UFn+s+9qEi9Us36qa1+a9XdxC 1Pyw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:subject:cc:to:from:date; bh=q+n1Uq54FKAPRYcvyjzrc3QiHkR6t7sdHcT9SGtWFFs=; b=w4MG2Kcmrcl77AWbLkyTJynMWJ6B47rq+OUOhVt2/ikNu0lzuQ4CTP1PxgjFTgUBGJ 1gRkdEJodFIqlUA6+BjxT1ld7dFI/2jNZoHneoq6Ld2E8KfRciyuoC+3u380ZJovDotc wq/oz0qa5wVfOseBrcjH+o9h0Vm2RUn0Zw4c/ZEJmZ8f4SyGma2HHdNXkmC7XWtVdJb0 p69YVNHMj8XLh+CCRPlxoH4Sd3qY0VKpXAaybH7684kAh264r5ckFhelB3QYhTk6m1qV T2ISeTP+vm8Dh1hQWvAHp+rb0xDRLFD7YPJmxEHsopa0/iXg06hBcfx8S/BNzbPV61Ar TMVQ== ARC-Authentication-Results: i=1; mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id c27-20020a634e1b000000b00462da7a1de0si15869049pgb.301.2022.11.01.16.12.50; Tue, 01 Nov 2022 16:13:04 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S231167AbiKAXL4 (ORCPT + 99 others); Tue, 1 Nov 2022 19:11:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44130 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S230492AbiKAXLm (ORCPT ); Tue, 1 Nov 2022 19:11:42 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 1C851222B8; Tue, 1 Nov 2022 16:10:12 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 808A16177D; Tue, 1 Nov 2022 23:10:12 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9FE77C433D6; Tue, 1 Nov 2022 23:10:11 +0000 (UTC) Date: Tue, 1 Nov 2022 19:10:09 -0400 From: Steven Rostedt To: LKML , Linux trace kernel Cc: Masami Hiramatsu , Roland Ruckerbauer , Takashi Iwai , regressions@lists.linux.dev, Steven Noonan Subject: [PATCH] ring-buffer: Check for NULL cpu_buffer in ring_buffer_wake_waiters() Message-ID: <20221101191009.1e7378c8@rorschach.local.home> X-Mailer: Claws Mail 3.17.8 (GTK+ 2.24.33; x86_64-pc-linux-gnu) MIME-Version: 1.0 X-Spam-Status: No, score=-6.7 required=5.0 tests=BAYES_00, HEADER_FROM_DIFFERENT_DOMAINS,RCVD_IN_DNSWL_HI,SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1748337305809027726?= X-GMAIL-MSGID: =?utf-8?q?1748337305809027726?= From: "Steven Rostedt (Google)" On some machines the number of listed CPUs may be bigger than the actual CPUs that exist. The tracing subsystem allocates a per_cpu directory with access to the per CPU ring buffer via a cpuX file. But to save space, the ring buffer will only allocate buffers for online CPUs, even though the CPU array will be as big as the nr_cpu_ids. With the addition of waking waiters on the ring buffer when closing the file, the ring_buffer_wake_waiters() now needs to make sure that the buffer is allocated (with the irq_work allocated with it) before trying to wake waiters, as it will cause a NULL pointer dereference. While debugging this, I added a NULL check for the buffer itself (which is OK to do), and also NULL pointer checks against buffer->buffers (which is not fine, and will WARN) as well as making sure the CPU number passed in is within the nr_cpu_ids (which is also not fine if it isn't). Link: https://lore.kernel.org/all/87h6zklb6n.wl-tiwai@suse.de/ Link: https://lore.kernel.org/all/CAM6Wdxc0KRJMXVAA0Y=u6Jh2V=uWB-_Fn6M4xRuNppfXzL1mUg@mail.gmail.com/ Cc: stable@vger.kernel.org Bugzilla: https://bugzilla.opensuse.org/show_bug.cgi?id=1204705 Reported-by: Takashi Iwai Reported-by: Roland Ruckerbauer Fixes: f3ddb74ad079 ("tracing: Wake up ring buffer waiters on closing of the file") Signed-off-by: Steven Rostedt (Google) Reviewed-by: Masami Hiramatsu (Google) --- kernel/trace/ring_buffer.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c index 199759c73519..9712083832f4 100644 --- a/kernel/trace/ring_buffer.c +++ b/kernel/trace/ring_buffer.c @@ -937,6 +937,9 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu) struct ring_buffer_per_cpu *cpu_buffer; struct rb_irq_work *rbwork; + if (!buffer) + return; + if (cpu == RING_BUFFER_ALL_CPUS) { /* Wake up individual ones too. One level recursion */ @@ -945,7 +948,15 @@ void ring_buffer_wake_waiters(struct trace_buffer *buffer, int cpu) rbwork = &buffer->irq_work; } else { + if (WARN_ON_ONCE(!buffer->buffers)) + return; + if (WARN_ON_ONCE(cpu >= nr_cpu_ids)) + return; + cpu_buffer = buffer->buffers[cpu]; + /* The CPU buffer may not have been initialized yet */ + if (!cpu_buffer) + return; rbwork = &cpu_buffer->irq_work; }