From: Leo Yan <leo.yan@arm.com>
To: Suzuki K Poulose <suzuki.poulose@arm.com>,
Mike Leach <mike.leach@arm.com>,
James Clark <james.clark@linaro.org>,
Alexander Shishkin <alexander.shishkin@linux.intel.com>,
Anshuman Khandual <anshuman.khandual@arm.com>,
Tamas Petz <tamas.petz@arm.com>,
Tamas Zsoldos <tamas.zsoldos@arm.com>,
Suyash Mahar <smahar@meta.com>, Amir Ayupov <aaupov@fb.com>
Cc: linux-arm-kernel@lists.infradead.org,
linux-kernel@vger.kernel.org, coresight@lists.linaro.org,
Leo Yan <leo.yan@arm.com>
Subject: [PATCH v2 05/23] coresight: trbe: Validate perf handle before using sink data
Date: Fri, 16 Oct 2026 17:55:03 +0100 [thread overview]
Message-ID: <20261016-trbe_enable_disable_irq_handle_refactor-v2-5-3f57cf3199b1@arm.com> (raw)
In-Reply-To: <20261016-trbe_enable_disable_irq_handle_refactor-v2-0-3f57cf3199b1@arm.com>
The TRBE IRQ handler calls etm_perf_sink_config(handle) before
validating the per-CPU perf handle and its AUX transaction. This may
dereference a NULL handle after disabling TRBE or access stale sink
data after perf_aux_output_end().
Validate the handle and AUX transaction before accessing the sink
configuration. Move the local buffer lookup closer to its use.
Remove the warning for a NULL handle, which is expected after
disabling TRBE.
Signed-off-by: Leo Yan <leo.yan@arm.com>
---
drivers/hwtracing/coresight/coresight-trbe.c | 15 ++++++++-------
1 file changed, 8 insertions(+), 7 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c
index 91fbdbad3676ffae399df0b4d4ddcd603a40e86c..a7c1037a048f5236598f8f3a7cc4f47bff9d329c 100644
--- a/drivers/hwtracing/coresight/coresight-trbe.c
+++ b/drivers/hwtracing/coresight/coresight-trbe.c
@@ -1150,12 +1150,18 @@ static irqreturn_t arm_trbe_irq_handler(int irq, void *dev)
{
struct perf_output_handle **handle_ptr = dev;
struct perf_output_handle *handle = *handle_ptr;
- struct trbe_buf *buf = etm_perf_sink_config(handle);
+ struct trbe_buf *buf;
enum trbe_fault_action act;
u64 status;
bool truncated = false;
u64 trfcr;
+ if (!handle || !perf_get_aux(handle))
+ return IRQ_NONE;
+
+ if (!is_perf_trbe(handle))
+ return IRQ_NONE;
+
/* Reads to TRBSR_EL1 is fine when TRBE is active */
status = read_sysreg_s(SYS_TRBSR_EL1);
/*
@@ -1171,16 +1177,11 @@ static irqreturn_t arm_trbe_irq_handler(int irq, void *dev)
* Ensure the trace is visible to the CPUs and
* any external aborts have been resolved.
*/
+ buf = etm_perf_sink_config(handle);
trbe_drain_and_disable_local(buf->cpudata);
clr_trbe_irq();
isb();
- if (WARN_ON_ONCE(!handle) || !perf_get_aux(handle))
- return IRQ_NONE;
-
- if (!is_perf_trbe(handle))
- return IRQ_NONE;
-
act = trbe_get_fault_act(handle, status);
switch (act) {
case TRBE_FAULT_ACT_WRAP:
--
2.34.1
next prev parent reply other threads:[~2026-10-16 16:55 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-16 16:54 [PATCH v2 00/23] coresight: trbe: Refactor buffer and IRQ handling Leo Yan
2026-10-16 16:54 ` [PATCH v2 01/23] arm64/sysreg: Define TRBSR_EL1.EC event classes Leo Yan
2026-10-16 16:55 ` [PATCH v2 02/23] coresight: trbe: Make watermark range check overflow safe in __trbe_normal_offset() Leo Yan
2026-10-16 16:55 ` [PATCH v2 03/23] coresight: trbe: Use helpers for checking errata Leo Yan
2026-10-16 16:55 ` [PATCH v2 04/23] coresight: trbe: Check the buffer association before IRQ validation Leo Yan
2026-10-16 16:55 ` Leo Yan [this message]
2026-10-16 16:55 ` [PATCH v2 06/23] coresight: trbe: Drop redundant disable from enable path Leo Yan
2026-10-16 16:55 ` [PATCH v2 07/23] coresight: trbe: Publish the session after successful enable Leo Yan
2026-10-16 16:55 ` [PATCH v2 08/23] coresight: trbe: Clear stale external abort status Leo Yan
2026-10-16 16:55 ` [PATCH v2 09/23] coresight: trbe: Clear TRBSR status at stop sites Leo Yan
2026-10-16 16:55 ` [PATCH v2 10/23] coresight: trbe: Drop redundant disables Leo Yan
2026-10-16 16:55 ` [PATCH v2 11/23] coresight: trbe: Assign the perf handle in enable and disable Leo Yan
2026-10-16 16:55 ` [PATCH v2 12/23] coresight: trbe: Decode TRBSR status codes Leo Yan
2026-10-16 16:55 ` [PATCH v2 13/23] coresight: trbe: Simplify wrap status handling Leo Yan
2026-10-16 16:55 ` [PATCH v2 14/23] coresight: trbe: Treat access not allowed stops as fatal Leo Yan
2026-10-16 16:55 ` [PATCH v2 15/23] coresight: trbe: Report truncated trace on buffer update errors Leo Yan
2026-10-16 16:55 ` [PATCH v2 16/23] coresight: trbe: Always classify TRBSR when updating buffer Leo Yan
2026-10-16 16:55 ` [PATCH v2 17/23] coresight: trbe: Calculate trace size across buffer wrap Leo Yan
2026-10-16 16:55 ` [PATCH v2 18/23] coresight: trbe: Keep the perf handle in per-CPU data Leo Yan
2026-10-16 16:55 ` [PATCH v2 19/23] coresight: trbe: Reload the AUX buffer on overflow restart Leo Yan
2026-10-16 16:55 ` [PATCH v2 20/23] coresight: trbe: Add fault action argument to trbe_handle_overflow() Leo Yan
2026-10-16 16:55 ` [PATCH v2 21/23] coresight: trbe: Read TRBSR after prohibiting and flushing trace Leo Yan
2026-10-16 16:55 ` [PATCH v2 22/23] coresight: trbe: Restart trace source for stopped buffers Leo Yan
2026-10-16 16:55 ` [PATCH v2 23/23] coresight: trbe: Report trace gaps with PARTIAL instead of COLLISION Leo Yan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261016-trbe_enable_disable_irq_handle_refactor-v2-5-3f57cf3199b1@arm.com \
--to=leo.yan@arm.com \
--cc=aaupov@fb.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=anshuman.khandual@arm.com \
--cc=coresight@lists.linaro.org \
--cc=james.clark@linaro.org \
--cc=linux-arm-kernel@lists.infradead.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mike.leach@arm.com \
--cc=smahar@meta.com \
--cc=suzuki.poulose@arm.com \
--cc=tamas.petz@arm.com \
--cc=tamas.zsoldos@arm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®