Re: [PATCH] coresight: perf: Fix pointer check with IS_ERR_OR_NULL()

[James Clark <james.clark@linaro.org>]

On 04/09/2025 1:00 pm, James Clark wrote:
> 
> 
> On 04/09/2025 11:53 am, Leo Yan wrote:
>> The returned pointer from .alloc_buffer() callback can be an error, if
>> only checking NULL pointer the driver cannot capture errors. The driver
>> will proceed even after failure and cause kernel panic.
>>
>> Change to use IS_ERR_OR_NULL() check for capture error cases.
>>
>> Fixes: 0bcbf2e30ff2 ("coresight: etm-perf: new PMU driver for ETM 
>> tracers")
>> Reported-by: Tamas Zsoldos <tamas.zsoldos@arm.com>
>> Signed-off-by: Leo Yan <leo.yan@arm.com>
>> ---
>>   drivers/hwtracing/coresight/coresight-etm-perf.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/hwtracing/coresight/coresight-etm-perf.c b/ 
>> drivers/hwtracing/coresight/coresight-etm-perf.c
>> index 
>> f677c08233ba1a28b277674662c6e6db904873dd..440d967f5d0962df187a81b0dd69a7d82a8b62ba 100644
>> --- a/drivers/hwtracing/coresight/coresight-etm-perf.c
>> +++ b/drivers/hwtracing/coresight/coresight-etm-perf.c
>> @@ -198,7 +198,7 @@ static void free_sink_buffer(struct etm_event_data 
>> *event_data)
>>       cpumask_t *mask = &event_data->mask;
>>       struct coresight_device *sink;
>> -    if (!event_data->snk_config)
>> +    if (IS_ERR_OR_NULL(event_data->snk_config))
>>           return;
>>       if (WARN_ON(cpumask_empty(mask)))
>> @@ -450,7 +450,7 @@ static void *etm_setup_aux(struct perf_event 
>> *event, void **pages,
>>       event_data->snk_config =
>>               sink_ops(sink)->alloc_buffer(sink, event, pages,
>>                                nr_pages, overwrite);
>> -    if (!event_data->snk_config)
>> +    if (IS_ERR_OR_NULL(event_data->snk_config))
>>           goto err;
> 
> I think the bug is in TRBE. It's the only one that returns an error 
> pointer, but only for -ENOMEM which would normally be NULL for alloc 
> type functions anyway.
> 
> Also it's assigned to event_data->snk_config which is later NULL checked 
> rather than IS_ERR_OR_NULL in free_sink_buffer(). Maybe that path 
> doesn't happen, but all instances should be updated anyway.

Oh sorry I was only looking at the update to etm_setup_aux() so both 
functions are covered. But the other points still apply.

> 
> It's much easier to keep it as NULL and make the fix in TRBE. It also 
> wouldn't need to be backported as far.
> 
>>   out:
>>
>> ---
>> base-commit: fa71e9cb4cfa59abb196229667ec84929bdc18fe
>> change-id: 20250904-cs_etm_auxsetup_fix_error_handling-cb7e07ed9adf
>>
>> Best regards,
>