+++ /dev/null
-From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001
-From: Leo Yan <leo.yan@linaro.org>
-Date: Thu, 7 Nov 2019 10:02:44 +0800
-Subject: perf tests: Fix out of bounds memory access
-
-From: Leo Yan <leo.yan@linaro.org>
-
-commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream.
-
-The test case 'Read backward ring buffer' failed on 32-bit architectures
-which were found by LKFT perf testing. The test failed on arm32 x15
-device, qemu_arm32, qemu_i386, and found intermittent failure on i386;
-the failure log is as below:
-
- 50: Read backward ring buffer :
- --- start ---
- test child forked, pid 510
- Using CPUID GenuineIntel-6-9E-9
- mmap size 1052672B
- mmap size 8192B
- Finished reading overwrite ring buffer: rewind
- free(): invalid next size (fast)
- test child interrupted
- ---- end ----
- Read backward ring buffer: FAILED!
-
-The log hints there have issue for memory usage, thus free() reports
-error 'invalid next size' and directly exit for the case. Finally, this
-issue is root caused as out of bounds memory access for the data array
-'evsel->id'.
-
-The backward ring buffer test invokes do_test() twice. 'evsel->id' is
-allocated at the first call with the flow:
-
- test__backward_ring_buffer()
- `-> do_test()
- `-> evlist__mmap()
- `-> evlist__mmap_ex()
- `-> perf_evsel__alloc_id()
-
-So 'evsel->id' is allocated with one item, and it will be used in
-function perf_evlist__id_add():
-
- evsel->id[0] = id
- evsel->ids = 1
-
-At the second call for do_test(), it skips to initialize 'evsel->id'
-and reuses the array which is allocated in the first call. But
-'evsel->ids' contains the stale value. Thus:
-
- evsel->id[1] = id -> out of bound access
- evsel->ids = 2
-
-To fix this issue, we will use evlist__open() and evlist__close() pair
-functions to prepare and cleanup context for evlist; so 'evsel->id' and
-'evsel->ids' can be initialized properly when invoke do_test() and avoid
-the out of bounds memory access.
-
-Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer")
-Signed-off-by: Leo Yan <leo.yan@linaro.org>
-Reviewed-by: Jiri Olsa <jolsa@kernel.org>
-Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
-Cc: Mark Rutland <mark.rutland@arm.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Wang Nan <wangnan0@huawei.com>
-Cc: stable@vger.kernel.org # v4.10+
-Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- tools/perf/tests/backward-ring-buffer.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
---- a/tools/perf/tests/backward-ring-buffer.c
-+++ b/tools/perf/tests/backward-ring-buffer.c
-@@ -142,6 +142,15 @@ int test__backward_ring_buffer(struct te
- goto out_delete_evlist;
- }
-
-+ evlist__close(evlist);
-+
-+ err = evlist__open(evlist);
-+ if (err < 0) {
-+ pr_debug("perf_evlist__open: %s\n",
-+ str_error_r(errno, sbuf, sizeof(sbuf)));
-+ goto out_delete_evlist;
-+ }
-+
- err = do_test(evlist, 1, &sample_count, &comm_count);
- if (err != TEST_OK)
- goto out_delete_evlist;
media-radio-wl1273-fix-interrupt-masking-on-release.patch
media-cec.h-cec_op_rec_flag_-values-were-swapped.patch
cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch
-perf-tests-fix-out-of-bounds-memory-access.patch
intel_th-fix-a-double-put_device-in-error-path.patch
intel_th-pci-add-ice-lake-cpu-support.patch
intel_th-pci-add-tiger-lake-cpu-support.patch
+++ /dev/null
-From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001
-From: Leo Yan <leo.yan@linaro.org>
-Date: Thu, 7 Nov 2019 10:02:44 +0800
-Subject: perf tests: Fix out of bounds memory access
-
-From: Leo Yan <leo.yan@linaro.org>
-
-commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream.
-
-The test case 'Read backward ring buffer' failed on 32-bit architectures
-which were found by LKFT perf testing. The test failed on arm32 x15
-device, qemu_arm32, qemu_i386, and found intermittent failure on i386;
-the failure log is as below:
-
- 50: Read backward ring buffer :
- --- start ---
- test child forked, pid 510
- Using CPUID GenuineIntel-6-9E-9
- mmap size 1052672B
- mmap size 8192B
- Finished reading overwrite ring buffer: rewind
- free(): invalid next size (fast)
- test child interrupted
- ---- end ----
- Read backward ring buffer: FAILED!
-
-The log hints there have issue for memory usage, thus free() reports
-error 'invalid next size' and directly exit for the case. Finally, this
-issue is root caused as out of bounds memory access for the data array
-'evsel->id'.
-
-The backward ring buffer test invokes do_test() twice. 'evsel->id' is
-allocated at the first call with the flow:
-
- test__backward_ring_buffer()
- `-> do_test()
- `-> evlist__mmap()
- `-> evlist__mmap_ex()
- `-> perf_evsel__alloc_id()
-
-So 'evsel->id' is allocated with one item, and it will be used in
-function perf_evlist__id_add():
-
- evsel->id[0] = id
- evsel->ids = 1
-
-At the second call for do_test(), it skips to initialize 'evsel->id'
-and reuses the array which is allocated in the first call. But
-'evsel->ids' contains the stale value. Thus:
-
- evsel->id[1] = id -> out of bound access
- evsel->ids = 2
-
-To fix this issue, we will use evlist__open() and evlist__close() pair
-functions to prepare and cleanup context for evlist; so 'evsel->id' and
-'evsel->ids' can be initialized properly when invoke do_test() and avoid
-the out of bounds memory access.
-
-Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer")
-Signed-off-by: Leo Yan <leo.yan@linaro.org>
-Reviewed-by: Jiri Olsa <jolsa@kernel.org>
-Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
-Cc: Mark Rutland <mark.rutland@arm.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Wang Nan <wangnan0@huawei.com>
-Cc: stable@vger.kernel.org # v4.10+
-Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- tools/perf/tests/backward-ring-buffer.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
---- a/tools/perf/tests/backward-ring-buffer.c
-+++ b/tools/perf/tests/backward-ring-buffer.c
-@@ -144,6 +144,15 @@ int test__backward_ring_buffer(struct te
- goto out_delete_evlist;
- }
-
-+ evlist__close(evlist);
-+
-+ err = evlist__open(evlist);
-+ if (err < 0) {
-+ pr_debug("perf_evlist__open: %s\n",
-+ str_error_r(errno, sbuf, sizeof(sbuf)));
-+ goto out_delete_evlist;
-+ }
-+
- err = do_test(evlist, 1, &sample_count, &comm_count);
- if (err != TEST_OK)
- goto out_delete_evlist;
media-cec.h-cec_op_rec_flag_-values-were-swapped.patch
cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch
erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch
-perf-tests-fix-out-of-bounds-memory-access.patch
intel_th-fix-a-double-put_device-in-error-path.patch
intel_th-pci-add-ice-lake-cpu-support.patch
intel_th-pci-add-tiger-lake-cpu-support.patch
+++ /dev/null
-From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001
-From: Leo Yan <leo.yan@linaro.org>
-Date: Thu, 7 Nov 2019 10:02:44 +0800
-Subject: perf tests: Fix out of bounds memory access
-
-From: Leo Yan <leo.yan@linaro.org>
-
-commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream.
-
-The test case 'Read backward ring buffer' failed on 32-bit architectures
-which were found by LKFT perf testing. The test failed on arm32 x15
-device, qemu_arm32, qemu_i386, and found intermittent failure on i386;
-the failure log is as below:
-
- 50: Read backward ring buffer :
- --- start ---
- test child forked, pid 510
- Using CPUID GenuineIntel-6-9E-9
- mmap size 1052672B
- mmap size 8192B
- Finished reading overwrite ring buffer: rewind
- free(): invalid next size (fast)
- test child interrupted
- ---- end ----
- Read backward ring buffer: FAILED!
-
-The log hints there have issue for memory usage, thus free() reports
-error 'invalid next size' and directly exit for the case. Finally, this
-issue is root caused as out of bounds memory access for the data array
-'evsel->id'.
-
-The backward ring buffer test invokes do_test() twice. 'evsel->id' is
-allocated at the first call with the flow:
-
- test__backward_ring_buffer()
- `-> do_test()
- `-> evlist__mmap()
- `-> evlist__mmap_ex()
- `-> perf_evsel__alloc_id()
-
-So 'evsel->id' is allocated with one item, and it will be used in
-function perf_evlist__id_add():
-
- evsel->id[0] = id
- evsel->ids = 1
-
-At the second call for do_test(), it skips to initialize 'evsel->id'
-and reuses the array which is allocated in the first call. But
-'evsel->ids' contains the stale value. Thus:
-
- evsel->id[1] = id -> out of bound access
- evsel->ids = 2
-
-To fix this issue, we will use evlist__open() and evlist__close() pair
-functions to prepare and cleanup context for evlist; so 'evsel->id' and
-'evsel->ids' can be initialized properly when invoke do_test() and avoid
-the out of bounds memory access.
-
-Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer")
-Signed-off-by: Leo Yan <leo.yan@linaro.org>
-Reviewed-by: Jiri Olsa <jolsa@kernel.org>
-Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
-Cc: Mark Rutland <mark.rutland@arm.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Wang Nan <wangnan0@huawei.com>
-Cc: stable@vger.kernel.org # v4.10+
-Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- tools/perf/tests/backward-ring-buffer.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
---- a/tools/perf/tests/backward-ring-buffer.c
-+++ b/tools/perf/tests/backward-ring-buffer.c
-@@ -140,6 +140,15 @@ int test__backward_ring_buffer(int subte
- goto out_delete_evlist;
- }
-
-+ evlist__close(evlist);
-+
-+ err = evlist__open(evlist);
-+ if (err < 0) {
-+ pr_debug("perf_evlist__open: %s\n",
-+ str_error_r(errno, sbuf, sizeof(sbuf)));
-+ goto out_delete_evlist;
-+ }
-+
- err = do_test(evlist, 1, &sample_count, &comm_count);
- if (err != TEST_OK)
- goto out_delete_evlist;
media-bdisp-fix-memleak-on-release.patch
media-radio-wl1273-fix-interrupt-masking-on-release.patch
cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch
-perf-tests-fix-out-of-bounds-memory-access.patch
pm-devfreq-lock-devfreq-in-trans_stat_show.patch
acpi-osl-only-free-map-once-in-osl.c.patch
acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch
+++ /dev/null
-From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001
-From: Leo Yan <leo.yan@linaro.org>
-Date: Thu, 7 Nov 2019 10:02:44 +0800
-Subject: perf tests: Fix out of bounds memory access
-
-From: Leo Yan <leo.yan@linaro.org>
-
-commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream.
-
-The test case 'Read backward ring buffer' failed on 32-bit architectures
-which were found by LKFT perf testing. The test failed on arm32 x15
-device, qemu_arm32, qemu_i386, and found intermittent failure on i386;
-the failure log is as below:
-
- 50: Read backward ring buffer :
- --- start ---
- test child forked, pid 510
- Using CPUID GenuineIntel-6-9E-9
- mmap size 1052672B
- mmap size 8192B
- Finished reading overwrite ring buffer: rewind
- free(): invalid next size (fast)
- test child interrupted
- ---- end ----
- Read backward ring buffer: FAILED!
-
-The log hints there have issue for memory usage, thus free() reports
-error 'invalid next size' and directly exit for the case. Finally, this
-issue is root caused as out of bounds memory access for the data array
-'evsel->id'.
-
-The backward ring buffer test invokes do_test() twice. 'evsel->id' is
-allocated at the first call with the flow:
-
- test__backward_ring_buffer()
- `-> do_test()
- `-> evlist__mmap()
- `-> evlist__mmap_ex()
- `-> perf_evsel__alloc_id()
-
-So 'evsel->id' is allocated with one item, and it will be used in
-function perf_evlist__id_add():
-
- evsel->id[0] = id
- evsel->ids = 1
-
-At the second call for do_test(), it skips to initialize 'evsel->id'
-and reuses the array which is allocated in the first call. But
-'evsel->ids' contains the stale value. Thus:
-
- evsel->id[1] = id -> out of bound access
- evsel->ids = 2
-
-To fix this issue, we will use evlist__open() and evlist__close() pair
-functions to prepare and cleanup context for evlist; so 'evsel->id' and
-'evsel->ids' can be initialized properly when invoke do_test() and avoid
-the out of bounds memory access.
-
-Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer")
-Signed-off-by: Leo Yan <leo.yan@linaro.org>
-Reviewed-by: Jiri Olsa <jolsa@kernel.org>
-Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
-Cc: Mark Rutland <mark.rutland@arm.com>
-Cc: Namhyung Kim <namhyung@kernel.org>
-Cc: Naresh Kamboju <naresh.kamboju@linaro.org>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Wang Nan <wangnan0@huawei.com>
-Cc: stable@vger.kernel.org # v4.10+
-Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org
-Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- tools/perf/tests/backward-ring-buffer.c | 9 +++++++++
- 1 file changed, 9 insertions(+)
-
---- a/tools/perf/tests/backward-ring-buffer.c
-+++ b/tools/perf/tests/backward-ring-buffer.c
-@@ -144,6 +144,15 @@ int test__backward_ring_buffer(struct te
- goto out_delete_evlist;
- }
-
-+ evlist__close(evlist);
-+
-+ err = evlist__open(evlist);
-+ if (err < 0) {
-+ pr_debug("perf_evlist__open: %s\n",
-+ str_error_r(errno, sbuf, sizeof(sbuf)));
-+ goto out_delete_evlist;
-+ }
-+
- err = do_test(evlist, 1, &sample_count, &comm_count);
- if (err != TEST_OK)
- goto out_delete_evlist;
cpuidle-teo-consider-hits-and-misses-metrics-of-disabled-states.patch
cpuidle-teo-fix-early-hits-handling-for-disabled-idle-states.patch
erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch
-perf-tests-fix-out-of-bounds-memory-access.patch
powerpc-perf-disable-trace_imc-pmu.patch
intel_th-fix-a-double-put_device-in-error-path.patch
intel_th-pci-add-ice-lake-cpu-support.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
