Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fdb6a8f4 authored by Robert Richter's avatar Robert Richter Committed by Ingo Molnar
Browse files

oprofile: fix uninitialized use of struct op_entry 



Impact: fix crash

In case of losing samples struct op_entry could have been used
uninitialized causing e.g. a wrong preemption count or NULL pointer
access. This patch fixes this.

Signed-off-by: default avatarRobert Richter <robert.richter@amd.com>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
parent c903ff83

drivers/oprofile/cpu_buffer.c

+5 −0
Original line number Original line Diff line number Diff line
@@ -393,16 +393,21 @@ oprofile_write_reserve(struct op_entry *entry, struct pt_regs * const regs, 
	return;

	return;





fail:

fail:

	entry->event = NULL;

	cpu_buf->sample_lost_overflow++;

	cpu_buf->sample_lost_overflow++;

}

}





int oprofile_add_data(struct op_entry *entry, unsigned long val)

int oprofile_add_data(struct op_entry *entry, unsigned long val)

{

{

	if (!entry->event)

		return 0;

	return op_cpu_buffer_add_data(entry, val);

	return op_cpu_buffer_add_data(entry, val);

}

}





int oprofile_write_commit(struct op_entry *entry)

int oprofile_write_commit(struct op_entry *entry)

{

{

	if (!entry->event)

		return -EINVAL;

	return op_cpu_buffer_write_commit(entry);

	return op_cpu_buffer_write_commit(entry);

}

}

drivers/oprofile/cpu_buffer.h

+7 −0
Original line number Original line Diff line number Diff line
@@ -66,6 +66,13 @@ static inline void op_cpu_buffer_reset(int cpu) 
	cpu_buf->last_task = NULL;

	cpu_buf->last_task = NULL;

}

}





/*

 * op_cpu_buffer_add_data() and op_cpu_buffer_write_commit() may be

 * called only if op_cpu_buffer_write_reserve() did not return NULL or

 * entry->event != NULL, otherwise entry->size or entry->event will be

 * used uninitialized.

 */



struct op_sample

struct op_sample

*op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size);

*op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size);

int op_cpu_buffer_write_commit(struct op_entry *entry);

int op_cpu_buffer_write_commit(struct op_entry *entry);