Commit 2cc6a3e9 authored Jan 13, 2023 by Jia-Ju Bai Committed by Greg Kroah-Hartman Mar 11, 2023

tracing: Add NULL checks for buffer in ring_buffer_free_read_page()

[ Upstream commit 3e4272b9954094907f16861199728f14002fcaf6 ]

In a previous commit 7433632c9ff6, buffer, buffer->buffers and
buffer->buffers[cpu] in ring_buffer_wake_waiters() can be NULL,
and thus the related checks are added.

However, in the same call stack, these variables are also used in
ring_buffer_free_read_page():

tracing_buffers_release()
  ring_buffer_wake_waiters(iter->array_buffer->buffer)
    cpu_buffer = buffer->buffers[cpu] -> Add checks by previous commit
  ring_buffer_free_read_page(iter->array_buffer->buffer)
    cpu_buffer = buffer->buffers[cpu] -> No check

Thus, to avod possible null-pointer derefernces, the related checks
should be added.

These results are reported by a static tool designed by myself.

Link: https://lkml.kernel.org/r/20230113125501.760324-1-baijiaju1990@gmail.com



Reported-by: TOTE Robot <oslab@tsinghua.edu.cn>
Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

parent 4cfeb55a

kernel/trace/ring_buffer.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -4769,11 +4769,16 @@ EXPORT_SYMBOL_GPL(ring_buffer_alloc_read_page);
		*/
		void ring_buffer_free_read_page(struct ring_buffer buffer, int cpu, void data)
		{
		struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
		struct ring_buffer_per_cpu *cpu_buffer;
		struct buffer_data_page *bpage = data;
		struct page *page = virt_to_page(bpage);
		unsigned long flags;

		if (!buffer \|\| !buffer->buffers \|\| !buffer->buffers[cpu])
		return;

		cpu_buffer = buffer->buffers[cpu];

		/* If the page is still in use someplace else, we can't reuse it */
		if (page_ref_count(page) > 1)
		goto out;