From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f44.google.com (mail-wm1-f44.google.com [209.85.128.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DB1FF219E8D for ; Fri, 20 Dec 2024 17:16:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734714987; cv=none; b=IUFs/SGNlNRIVB/ZBxrJYqm2ujOSOxGJhQc0csrDBU5iuTp70GnSbA2pLJJDPQdYE67t1poGIm2uYHnKi21tCMU5pjpVTTzsVI/RO7B9O7zlObzLfO4nup7WObf5zaGAOaOCDN11uRtFEH1vl1UuJaB4hsM9fomzNXa4OHkZLxU= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1734714987; c=relaxed/simple; bh=n8b41AHa3RgNdF/44j6nDwaehIKPuCDpJKbuVqrYhMw=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=Cc3e5oSkGvrztwdXUD9r8uwdKCjQ7w77OA8pSAVe66BFk8moyQL2OalicLLfW6mguGZHtudeSaVLxXISw9qOUMxf0HnsfDHYBvzD984FUyYOQLLdrVk8QxnpLtnpQlXSLUuY8snBy3xVIgNCwwr+0cReccqEfy/BOIrd2Tv8jSg= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org; spf=pass smtp.mailfrom=linaro.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b=SWNDpO6k; arc=none smtp.client-ip=209.85.128.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linaro.org Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linaro.org Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=linaro.org header.i=@linaro.org header.b="SWNDpO6k" Received: by mail-wm1-f44.google.com with SMTP id 5b1f17b1804b1-4363dc916ceso20610275e9.0 for ; Fri, 20 Dec 2024 09:16:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; t=1734714983; x=1735319783; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=aWkEtC1JATIn6qXREPnlwjqS9TBnknDlIdxobBNl7k8=; b=SWNDpO6kjfc13QEy+DaVPFtG+/svjShiF8OBVB2GZ9+9J0wyz5/qtc/4NCukD5rPHp Ajskx6/S5egx+vtacpmYtBmYuLdfdP0DaapNpL098850cY+wNTuL+mcjE+vHsQZmbN4V 2UF6MGwuoT3mE2vPQC4guK8iEd3xfVNePh5FkAbPt2ARzHFWcVZCVBcQOWYyMkEwqPLE CuigiHBIKPxgBWD9+M6T07GL+gET+ZW0OiyOaZ8zzftMHVc6eH/8Mr6DQHoVnZquErEM 2yjdUjd9Td7gO6K4GBn3XUWbgLR5RTL2uyAnPKANjL/YLJlqL5UHd7rK+4Q3YlgIkUDO VIqg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1734714983; x=1735319783; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=aWkEtC1JATIn6qXREPnlwjqS9TBnknDlIdxobBNl7k8=; b=RvoVTc1s9nvz2SkvSs5ugjJs8IYovJuy0wIgnhtsMLylosUr1o5rSrDeP6jRn/Qvby 4UMvPg+/5aHPuB3JPQHYzD2M6qz1AuPnLwzgaslskpwr/Mpvid8Tw3Df0wloXzbLISQI NhW4F4+IW514oO2vC+iomFb5gNWUKrQ0Di7qMO0HJOr9tuJDSvDKChlkJ0Y5YFo2l1NK vKBmEvH0EQ1Q1nSStUShEBMOSxHw09TI7qSCo2TfrYFR+MjJfaLFlUL0Oms2OJrd2hQ9 mawxG03iGdHTBs7dq8J38O/Bc95SoFDLMvzY8WI2xasqbLzQqI6fV5TiXl3ypWfNrC7+ quuQ== X-Forwarded-Encrypted: i=1; AJvYcCWokcIs8YLmGarCXb08MYlQo33kO8rFlbn8vYSujMYPONhtqzkggvoqHRIxbQhcl7akA+dTIKCsKfnWA+g=@vger.kernel.org X-Gm-Message-State: AOJu0YzrUl+TNQOjMYOZF2rm3vmlVrFVfboiMovHq9IuB7wCFgsegH3e 8+ZQL1SRsKSog7CZt1BdOFvo659Mt8cL4+eXdYscF21s6kyheH387i8CLdv6uVg= X-Gm-Gg: ASbGncvQy4dfivqa5brAcodYp0jCLUM5aOu3OmdASgKnDqp3aBw+ja7fU7oYmrDxgys lWYlsR9A+OM2ZJG9BHF/QnrTH2QqPiQoww4b8u8UA/FG/lGpEJsc5ck9XeyYqGOTANpIT+1vyNe j9DgdWGM+HpSYn56ZzvNZcIZnA4DCzzam8w6Bs1a400kdvFsvD7nL3SH7tGUAZbQ49ahKINw8O7 p7TB7x8Jw/tFEo/aNv2yiC4/F7cW+HLb+68862O3NPlSonBMH87ID6GeH/zIO3AW/g= X-Google-Smtp-Source: AGHT+IGn2bSuOD+eQ1Kw77ReARBTW+Z43faAGpGgYHNzLywWOzDLSMMRJx0svPo2NgeJxp9j9ds7vQ== X-Received: by 2002:a05:600c:746:b0:436:185f:dfae with SMTP id 5b1f17b1804b1-4365c770940mr76361555e9.6.1734714983179; Fri, 20 Dec 2024 09:16:23 -0800 (PST) Received: from [192.168.68.163] ([145.224.65.105]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-4366127c4bbsm50677985e9.32.2024.12.20.09.16.21 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Fri, 20 Dec 2024 09:16:22 -0800 (PST) Message-ID: Date: Fri, 20 Dec 2024 17:16:21 +0000 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] perf: arm-spe: Fix null-ptr-deref in arm_spe__alloc_metadata() To: Nihar Chaithanya , Leo Yan Cc: skhan@linuxfoundation.org, john.g.garry@oracle.com, will@kernel.org, mike.leach@linaro.org, leo.yan@linux.dev, peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org, mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, kan.liang@linux.intel.com, graham.woodward@arm.com, bwicaksono@nvidia.com, linux-arm-kernel@lists.infradead.org, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org References: <20241220145659.66066-1-niharchaithanya@gmail.com> Content-Language: en-US From: James Clark In-Reply-To: <20241220145659.66066-1-niharchaithanya@gmail.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit On 20/12/2024 2:57 pm, Nihar Chaithanya wrote: > When metadata is allocated using arm_spe__alloc_metadata(), if the > metadata version is 1, metadata is returned as NULL. This value > is dereferenced later in arm_spe__free_metadata() and it can cause > null-ptr-deref. > > Modify the NULL check for metadata to return -EINVAL even when > metadata_ver == 1. > Hi Nihar, I don't think this is the right fix. Doesn't that mean we can't open files with V1 anymore? Did you test opening an old SPE file on a new version of Perf? I actually thought I tested this before but maybe not if there's a NULL deref. Seems like the correct fix is to not dereference anything if metadata is NULL, or make a fake placeholder one. > This issue was reported by Coverity scan [1]. > [1] https://scan5.scan.coverity.com/#/project-view/63616/10063?selectedIssue=1636359 > Is this supposed to be publicly accessible? It goes to a login page for me. > Closes: https://scan5.scan.coverity.com/#/project-view/63616/10063?selectedIssue=1636359 > Signed-off-by: Nihar Chaithanya Probably needs a fixes: tag too for the commit that introduced the issue. Thanks James > --- > tools/perf/util/arm-spe.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/tools/perf/util/arm-spe.c b/tools/perf/util/arm-spe.c > index dbf13f47879c..55827d8ce133 100644 > --- a/tools/perf/util/arm-spe.c > +++ b/tools/perf/util/arm-spe.c > @@ -1497,7 +1497,7 @@ int arm_spe_process_auxtrace_info(union perf_event *event, > > metadata = arm_spe__alloc_metadata(auxtrace_info, &metadata_ver, > &nr_cpu); > - if (!metadata && metadata_ver != 1) { > + if (!metadata) { > pr_err("Failed to parse Arm SPE metadata.\n"); > return -EINVAL; > }