OpenCloudOS-Kernel/arch/alpha/kernel
Will Deacon 6e22f8f2e8 alpha: perf: fix out-of-bounds array access triggered from raw event
Vince's perf fuzzer uncovered the following issue on Alpha:

Unable to handle kernel paging request at virtual address fffffbfe4e46a0e8
CPU 0 perf_fuzzer(1278): Oops 0
pc = [<fffffc000031fbc0>]  ra = [<fffffc000031ff54>]  ps = 0007    Not tainted
pc is at alpha_perf_event_set_period+0x60/0xf0
ra is at alpha_pmu_enable+0x1a4/0x1c0
v0 = 0000000000000000  t0 = 00000000000fffff  t1 = fffffc007b3f5800
t2 = fffffbff275faa94  t3 = ffffffffc9b9bd89  t4 = fffffbfe4e46a098
t5 = 0000000000000020  t6 = fffffbfe4e46a0b8  t7 = fffffc007f4c8000
s0 = 0000000000000000  s1 = fffffc0001b0c018  s2 = fffffc0001b0c020
s3 = fffffc007b3f5800  s4 = 0000000000000001  s5 = ffffffffc9b9bd85
s6 = 0000000000000001
a0 = 0000000000000006  a1 = fffffc007b3f5908  a2 = fffffbfe4e46a098
a3 = 00000005000108c0  a4 = 0000000000000000  a5 = 0000000000000000
t8 = 0000000000000001  t9 = 0000000000000001  t10= 0000000027829f6f
t11= 0000000000000020  pv = fffffc000031fb60  at = fffffc0000950900
gp = fffffc0000940900  sp = fffffc007f4cbca8
Disabling lock debugging due to kernel taint
Trace:
[<fffffc000031ff54>] alpha_pmu_enable+0x1a4/0x1c0
[<fffffc000039f4e8>] perf_pmu_enable+0x48/0x60
[<fffffc00003a0d6c>] __perf_install_in_context+0x15c/0x230
[<fffffc000039d1f0>] remote_function+0x80/0xa0
[<fffffc00003a0c10>] __perf_install_in_context+0x0/0x230
[<fffffc000037b7e4>] smp_call_function_single+0x1b4/0x1d0
[<fffffc000039bb70>] task_function_call+0x60/0x80
[<fffffc00003a0c10>] __perf_install_in_context+0x0/0x230
[<fffffc000039bb44>] task_function_call+0x34/0x80
[<fffffc000039d3fc>] perf_install_in_context+0x9c/0x150
[<fffffc00003a0c10>] __perf_install_in_context+0x0/0x230
[<fffffc00003a5100>] SYSC_perf_event_open+0x360/0xac0
[<fffffc00003110c4>] entSys+0xa4/0xc0

This is due to the raw event encoding being used as an index directly
into the ev67_mapping array, rather than being validated against the
ev67_pmc_event_type enumeration instead. Unlike other architectures,
which allow raw events to propagate into the hardware counters with
little interference, the limited number of events on Alpha and the
strict event <-> counter relationships mean that raw events actually
correspond to the Linux-specific Alpha events, rather than anything
defined by the architecture.

This patch adds a new callback to alpha_pmu_t for validating the raw
event encoding with the Linux event types for the PMU, preventing the
out-of-bounds array access.

Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Acked-by: Michael Cree <mcree@orcon.net.nz>
Acked-by: Matt Turner <mattst88@gmail.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
2013-11-16 16:37:10 -08:00
..
.gitignore alpha: .gitignore vmlinux.lds 2009-01-15 16:39:40 -08:00
Makefile alpha: Reorganize rtc handling 2013-11-16 16:33:16 -08:00
alpha_ksyms.c alpha: Eliminate compiler warning from memset macro 2013-11-16 16:33:09 -08:00
asm-offsets.c CRED: Separate task security context from task_struct 2008-11-14 10:39:16 +11:00
binfmt_loader.c get rid of pt_regs argument of ->load_binary() 2012-11-28 21:53:38 -05:00
console.c TTY:vt: convert remain take_over_console's users to do_take_over_console 2013-05-20 22:29:27 -07:00
core_apecs.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
core_cia.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
core_irongate.c alpha: Add export.h for THIS_MODULE/EXPORT_SYMBOL 2011-10-31 19:31:03 -04:00
core_lca.c Fix common misspellings 2011-03-31 11:26:23 -03:00
core_marvel.c arch/alpha/kernel: Add kmalloc NULL tests 2009-11-30 15:38:19 -05:00
core_mcpcia.c alpha: Remove set but unused variables. 2011-04-17 14:41:30 -07:00
core_polaris.c [PATCH] alpha pt_regs cleanups: machine_check() 2006-10-08 12:32:36 -07:00
core_t2.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
core_titan.c arch/alpha/kernel: Add kmalloc NULL tests 2009-11-30 15:38:19 -05:00
core_tsunami.c alpha: include module.h to fix modpost on Tsunami 2012-05-02 15:54:06 -04:00
core_wildfire.c [PATCH] alpha pt_regs cleanups: machine_check() 2006-10-08 12:32:36 -07:00
entry.S alpha: Generate dwarf2 unwind info for various kernel entry points. 2013-07-19 13:54:25 -07:00
err_common.c PCI: Cleanup the includes of <linux/pci.h> 2007-05-02 19:02:35 -07:00
err_ev6.c alpha: Use static const char * const where possible 2010-09-18 23:06:17 -04:00
err_ev7.c alpha: titan and marvel build fixes 2009-05-02 15:36:10 -07:00
err_impl.h Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
err_marvel.c Fix common misspellings 2011-03-31 11:26:23 -03:00
err_titan.c alpha: Remove set but unused variables. 2011-04-17 14:41:30 -07:00
es1888.c
gct.c
head.S Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
io.c
irq.c alpha: irq: run all handlers with interrupts disabled 2013-04-07 12:59:30 -07:00
irq_alpha.c alpha: Use qemu+cserve provided high-res clock and alarm. 2013-11-16 16:33:21 -08:00
irq_i8259.c alpha: Convert to new irq function names 2011-03-29 14:47:58 +02:00
irq_impl.h alpha: i8259, alcor, jensen wildfire: Convert irq_chip 2011-03-02 14:57:55 -05:00
irq_pyxis.c alpha: Convert to new irq function names 2011-03-29 14:47:58 +02:00
irq_srm.c alpha: Convert to new irq function names 2011-03-29 14:47:58 +02:00
machvec_impl.h alpha: Reorganize rtc handling 2013-11-16 16:33:16 -08:00
module.c modules: make arch's use default loader hooks 2011-07-24 22:06:04 +09:30
osf_sys.c [readdir] constify ->actor 2013-06-29 12:57:05 +04:00
pc873xx.c alpha: Detect Super IO chip, no IDE on Avanti, enable EPP19 2010-06-15 14:19:08 -04:00
pc873xx.h alpha: Detect Super IO chip, no IDE on Avanti, enable EPP19 2010-06-15 14:19:08 -04:00
pci-noop.c Alpha: adapt for dma_map_ops changes 2012-03-28 16:36:36 +02:00
pci-sysfs.c hose_mmap_page_range(): io_remap_pfn_range() will set all those flags... 2013-06-29 12:46:37 +04:00
pci.c ALPHA: drivers: remove __dev* attributes. 2013-01-03 15:57:13 -08:00
pci_impl.h alpha/PCI: replace pci_probe_only with pci_flags 2012-02-23 20:18:56 -07:00
pci_iommu.c alpha: use BUG_ON where possible 2012-11-08 22:42:02 +01:00
perf_event.c alpha: perf: fix out-of-bounds array access triggered from raw event 2013-11-16 16:37:10 -08:00
process.c alpha: Primitive support for CPU power down. 2013-11-16 16:33:15 -08:00
proto.h alpha: Use qemu+cserve provided high-res clock and alarm. 2013-11-16 16:33:21 -08:00
ptrace.c alpha: don't open-code trace_report_syscall_{enter,exit} 2012-10-01 09:58:19 -04:00
rtc.c alpha: Reorganize rtc handling 2013-11-16 16:33:16 -08:00
setup.c alpha: Allow HZ to be configured 2013-11-16 16:33:13 -08:00
signal.c alpha: pass k_sigaction and siginfo_t using ksignal pointer 2013-02-14 09:21:16 -05:00
smc37c93x.c alpha: Remove set but unused variables. 2011-04-17 14:41:30 -07:00
smc37c669.c alpha: remove mysterious if zero-ed out includes 2012-07-30 17:25:11 -07:00
smp.c alpha: Switch to GENERIC_CLOCKEVENTS 2013-11-16 16:33:19 -08:00
srm_env.c srm_env: don't bother with pointer to srm_env_t 2013-04-09 14:13:33 -04:00
srmcons.c TTY: switch tty_schedule_flip 2013-01-15 22:43:15 -08:00
sys_alcor.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_cabriolet.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_dp264.c alpha: Don't if-out dp264_device_interrupt. 2013-07-19 13:54:26 -07:00
sys_eb64p.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_eiger.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_jensen.c alpha: Reorganize rtc handling 2013-11-16 16:33:16 -08:00
sys_marvel.c alpha: Reorganize rtc handling 2013-11-16 16:33:16 -08:00
sys_miata.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_mikasa.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_nautilus.c mm: enhance free_reserved_area() to support poisoning memory with zero 2013-07-03 16:07:32 -07:00
sys_noritake.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_rawhide.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_ruffian.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_rx164.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_sable.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_sio.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_sx164.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_takara.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
sys_titan.c alpha: irq: remove deprecated use of IRQF_DISABLED 2013-04-07 12:59:30 -07:00
sys_wildfire.c Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00
systbls.S alpha: Add kcmp and finit_module syscalls 2013-07-19 13:54:23 -07:00
time.c alpha: Use qemu+cserve provided high-res clock and alarm. 2013-11-16 16:33:21 -08:00
traps.c alpha: Primitive support for CPU power down. 2013-11-16 16:33:15 -08:00
vmlinux.lds.S Disintegrate asm/system.h for Alpha 2012-03-28 18:11:12 +01:00