Messages in this thread | | | Subject | Re: UBSAN: Undefined behaviour in arch/x86/events/amd/ibs.c:582:24: member access within null pointer of type 'struct perf_event' | From | Paul Menzel <> | Date | Sat, 21 Jul 2018 21:38:41 +0200 |
| |
Dear Thomas,
Am 20.07.2018 um 10:39 schrieb Thomas Gleixner:
> On Fri, 20 Jul 2018, Paul Menzel wrote: >> Enabling the undefined behavior sanitizer and building GNU/Linux 4.18-rc5+ >> (with some unrelated commits) with GCC 8.1.0 from Debian Sid/unstable, the >> warning below is shown. >> >>> [ 2.111913] >>> ================================================================================ >>> [ 2.111917] UBSAN: Undefined behaviour in >>> arch/x86/events/amd/ibs.c:582:24 >>> [ 2.111919] member access within null pointer of type 'struct perf_event' >>> [ 2.111926] CPU: 0 PID: 144 Comm: udevadm Not tainted >>> 4.18.0-rc5-00316-g4864b68cedf2 #104 >>> [ 2.111928] Hardware name: ASROCK E350M1/E350M1, BIOS TIMELESS 01/01/1970 >>> [ 2.111930] Call Trace: >>> [ 2.111943] dump_stack+0x55/0x89 >>> [ 2.111949] ubsan_epilogue+0xb/0x33 >>> [ 2.111953] handle_null_ptr_deref+0x7f/0x90 >>> [ 2.111958] __ubsan_handle_type_mismatch_v1+0x55/0x60 >>> [ 2.111964] perf_ibs_handle_irq+0x596/0x620 > > Right, the code dereferences event before checking the STARTED bit. Patch > below should cure the issue. The warning should not trigger, if I analyzed > the thing correctly. Emphasis on *should*
> 8<-------------------- > diff --git a/arch/x86/events/amd/ibs.c b/arch/x86/events/amd/ibs.c > index 4b98101209a1..d50bb4dc0650 100644 > --- a/arch/x86/events/amd/ibs.c > +++ b/arch/x86/events/amd/ibs.c > @@ -579,7 +579,7 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) > { > struct cpu_perf_ibs *pcpu = this_cpu_ptr(perf_ibs->pcpu); > struct perf_event *event = pcpu->event; > - struct hw_perf_event *hwc = &event->hw; > + struct hw_perf_event *hwc; > struct perf_sample_data data; > struct perf_raw_record raw; > struct pt_regs regs; > @@ -602,6 +602,10 @@ static int perf_ibs_handle_irq(struct perf_ibs *perf_ibs, struct pt_regs *iregs) > return 0; > } > > + if (WARN_ON_ONCE(!event)) > + goto fail; > + > + hwc = &event->hw; > msr = hwc->config_base; > buf = ibs_data.regs; > rdmsrl(msr, *buf);
Thank you very much. The warning is gone after applying it.
Tested-by: Paul Menzel <pmenzel@molgen.mpg.de>
Kind regards,
Paul
| |