From: Greg Kroah-Hartman Date: Mon, 16 Dec 2019 16:21:35 +0000 (+0100) Subject: drop perf-tests-fix-out-of-bounds-memory-access.patch from a bunch of trees X-Git-Tag: v5.4.4~19 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=31bc0de3e051e4778932ffa5b7765cb2abe72d47;p=thirdparty%2Fkernel%2Fstable-queue.git drop perf-tests-fix-out-of-bounds-memory-access.patch from a bunch of trees --- diff --git a/queue-4.14/perf-tests-fix-out-of-bounds-memory-access.patch b/queue-4.14/perf-tests-fix-out-of-bounds-memory-access.patch deleted file mode 100644 index 8fe95580e6e..00000000000 --- a/queue-4.14/perf-tests-fix-out-of-bounds-memory-access.patch +++ /dev/null @@ -1,94 +0,0 @@ -From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001 -From: Leo Yan -Date: Thu, 7 Nov 2019 10:02:44 +0800 -Subject: perf tests: Fix out of bounds memory access - -From: Leo Yan - -commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream. - -The test case 'Read backward ring buffer' failed on 32-bit architectures -which were found by LKFT perf testing. The test failed on arm32 x15 -device, qemu_arm32, qemu_i386, and found intermittent failure on i386; -the failure log is as below: - - 50: Read backward ring buffer : - --- start --- - test child forked, pid 510 - Using CPUID GenuineIntel-6-9E-9 - mmap size 1052672B - mmap size 8192B - Finished reading overwrite ring buffer: rewind - free(): invalid next size (fast) - test child interrupted - ---- end ---- - Read backward ring buffer: FAILED! - -The log hints there have issue for memory usage, thus free() reports -error 'invalid next size' and directly exit for the case. Finally, this -issue is root caused as out of bounds memory access for the data array -'evsel->id'. - -The backward ring buffer test invokes do_test() twice. 'evsel->id' is -allocated at the first call with the flow: - - test__backward_ring_buffer() - `-> do_test() - `-> evlist__mmap() - `-> evlist__mmap_ex() - `-> perf_evsel__alloc_id() - -So 'evsel->id' is allocated with one item, and it will be used in -function perf_evlist__id_add(): - - evsel->id[0] = id - evsel->ids = 1 - -At the second call for do_test(), it skips to initialize 'evsel->id' -and reuses the array which is allocated in the first call. But -'evsel->ids' contains the stale value. Thus: - - evsel->id[1] = id -> out of bound access - evsel->ids = 2 - -To fix this issue, we will use evlist__open() and evlist__close() pair -functions to prepare and cleanup context for evlist; so 'evsel->id' and -'evsel->ids' can be initialized properly when invoke do_test() and avoid -the out of bounds memory access. - -Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer") -Signed-off-by: Leo Yan -Reviewed-by: Jiri Olsa -Cc: Alexander Shishkin -Cc: Mark Rutland -Cc: Namhyung Kim -Cc: Naresh Kamboju -Cc: Peter Zijlstra -Cc: Wang Nan -Cc: stable@vger.kernel.org # v4.10+ -Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Greg Kroah-Hartman - ---- - tools/perf/tests/backward-ring-buffer.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - ---- a/tools/perf/tests/backward-ring-buffer.c -+++ b/tools/perf/tests/backward-ring-buffer.c -@@ -142,6 +142,15 @@ int test__backward_ring_buffer(struct te - goto out_delete_evlist; - } - -+ evlist__close(evlist); -+ -+ err = evlist__open(evlist); -+ if (err < 0) { -+ pr_debug("perf_evlist__open: %s\n", -+ str_error_r(errno, sbuf, sizeof(sbuf))); -+ goto out_delete_evlist; -+ } -+ - err = do_test(evlist, 1, &sample_count, &comm_count); - if (err != TEST_OK) - goto out_delete_evlist; diff --git a/queue-4.14/series b/queue-4.14/series index e602300bcc0..389319d7b74 100644 --- a/queue-4.14/series +++ b/queue-4.14/series @@ -209,7 +209,6 @@ media-bdisp-fix-memleak-on-release.patch media-radio-wl1273-fix-interrupt-masking-on-release.patch media-cec.h-cec_op_rec_flag_-values-were-swapped.patch cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch -perf-tests-fix-out-of-bounds-memory-access.patch intel_th-fix-a-double-put_device-in-error-path.patch intel_th-pci-add-ice-lake-cpu-support.patch intel_th-pci-add-tiger-lake-cpu-support.patch diff --git a/queue-4.19/perf-tests-fix-out-of-bounds-memory-access.patch b/queue-4.19/perf-tests-fix-out-of-bounds-memory-access.patch deleted file mode 100644 index c256a5d8873..00000000000 --- a/queue-4.19/perf-tests-fix-out-of-bounds-memory-access.patch +++ /dev/null @@ -1,94 +0,0 @@ -From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001 -From: Leo Yan -Date: Thu, 7 Nov 2019 10:02:44 +0800 -Subject: perf tests: Fix out of bounds memory access - -From: Leo Yan - -commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream. - -The test case 'Read backward ring buffer' failed on 32-bit architectures -which were found by LKFT perf testing. The test failed on arm32 x15 -device, qemu_arm32, qemu_i386, and found intermittent failure on i386; -the failure log is as below: - - 50: Read backward ring buffer : - --- start --- - test child forked, pid 510 - Using CPUID GenuineIntel-6-9E-9 - mmap size 1052672B - mmap size 8192B - Finished reading overwrite ring buffer: rewind - free(): invalid next size (fast) - test child interrupted - ---- end ---- - Read backward ring buffer: FAILED! - -The log hints there have issue for memory usage, thus free() reports -error 'invalid next size' and directly exit for the case. Finally, this -issue is root caused as out of bounds memory access for the data array -'evsel->id'. - -The backward ring buffer test invokes do_test() twice. 'evsel->id' is -allocated at the first call with the flow: - - test__backward_ring_buffer() - `-> do_test() - `-> evlist__mmap() - `-> evlist__mmap_ex() - `-> perf_evsel__alloc_id() - -So 'evsel->id' is allocated with one item, and it will be used in -function perf_evlist__id_add(): - - evsel->id[0] = id - evsel->ids = 1 - -At the second call for do_test(), it skips to initialize 'evsel->id' -and reuses the array which is allocated in the first call. But -'evsel->ids' contains the stale value. Thus: - - evsel->id[1] = id -> out of bound access - evsel->ids = 2 - -To fix this issue, we will use evlist__open() and evlist__close() pair -functions to prepare and cleanup context for evlist; so 'evsel->id' and -'evsel->ids' can be initialized properly when invoke do_test() and avoid -the out of bounds memory access. - -Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer") -Signed-off-by: Leo Yan -Reviewed-by: Jiri Olsa -Cc: Alexander Shishkin -Cc: Mark Rutland -Cc: Namhyung Kim -Cc: Naresh Kamboju -Cc: Peter Zijlstra -Cc: Wang Nan -Cc: stable@vger.kernel.org # v4.10+ -Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Greg Kroah-Hartman - ---- - tools/perf/tests/backward-ring-buffer.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - ---- a/tools/perf/tests/backward-ring-buffer.c -+++ b/tools/perf/tests/backward-ring-buffer.c -@@ -144,6 +144,15 @@ int test__backward_ring_buffer(struct te - goto out_delete_evlist; - } - -+ evlist__close(evlist); -+ -+ err = evlist__open(evlist); -+ if (err < 0) { -+ pr_debug("perf_evlist__open: %s\n", -+ str_error_r(errno, sbuf, sizeof(sbuf))); -+ goto out_delete_evlist; -+ } -+ - err = do_test(evlist, 1, &sample_count, &comm_count); - if (err != TEST_OK) - goto out_delete_evlist; diff --git a/queue-4.19/series b/queue-4.19/series index f131a841eaa..c727bb66364 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -65,7 +65,6 @@ media-radio-wl1273-fix-interrupt-masking-on-release.patch media-cec.h-cec_op_rec_flag_-values-were-swapped.patch cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch -perf-tests-fix-out-of-bounds-memory-access.patch intel_th-fix-a-double-put_device-in-error-path.patch intel_th-pci-add-ice-lake-cpu-support.patch intel_th-pci-add-tiger-lake-cpu-support.patch diff --git a/queue-4.9/perf-tests-fix-out-of-bounds-memory-access.patch b/queue-4.9/perf-tests-fix-out-of-bounds-memory-access.patch deleted file mode 100644 index d30497b020d..00000000000 --- a/queue-4.9/perf-tests-fix-out-of-bounds-memory-access.patch +++ /dev/null @@ -1,94 +0,0 @@ -From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001 -From: Leo Yan -Date: Thu, 7 Nov 2019 10:02:44 +0800 -Subject: perf tests: Fix out of bounds memory access - -From: Leo Yan - -commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream. - -The test case 'Read backward ring buffer' failed on 32-bit architectures -which were found by LKFT perf testing. The test failed on arm32 x15 -device, qemu_arm32, qemu_i386, and found intermittent failure on i386; -the failure log is as below: - - 50: Read backward ring buffer : - --- start --- - test child forked, pid 510 - Using CPUID GenuineIntel-6-9E-9 - mmap size 1052672B - mmap size 8192B - Finished reading overwrite ring buffer: rewind - free(): invalid next size (fast) - test child interrupted - ---- end ---- - Read backward ring buffer: FAILED! - -The log hints there have issue for memory usage, thus free() reports -error 'invalid next size' and directly exit for the case. Finally, this -issue is root caused as out of bounds memory access for the data array -'evsel->id'. - -The backward ring buffer test invokes do_test() twice. 'evsel->id' is -allocated at the first call with the flow: - - test__backward_ring_buffer() - `-> do_test() - `-> evlist__mmap() - `-> evlist__mmap_ex() - `-> perf_evsel__alloc_id() - -So 'evsel->id' is allocated with one item, and it will be used in -function perf_evlist__id_add(): - - evsel->id[0] = id - evsel->ids = 1 - -At the second call for do_test(), it skips to initialize 'evsel->id' -and reuses the array which is allocated in the first call. But -'evsel->ids' contains the stale value. Thus: - - evsel->id[1] = id -> out of bound access - evsel->ids = 2 - -To fix this issue, we will use evlist__open() and evlist__close() pair -functions to prepare and cleanup context for evlist; so 'evsel->id' and -'evsel->ids' can be initialized properly when invoke do_test() and avoid -the out of bounds memory access. - -Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer") -Signed-off-by: Leo Yan -Reviewed-by: Jiri Olsa -Cc: Alexander Shishkin -Cc: Mark Rutland -Cc: Namhyung Kim -Cc: Naresh Kamboju -Cc: Peter Zijlstra -Cc: Wang Nan -Cc: stable@vger.kernel.org # v4.10+ -Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Greg Kroah-Hartman - ---- - tools/perf/tests/backward-ring-buffer.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - ---- a/tools/perf/tests/backward-ring-buffer.c -+++ b/tools/perf/tests/backward-ring-buffer.c -@@ -140,6 +140,15 @@ int test__backward_ring_buffer(int subte - goto out_delete_evlist; - } - -+ evlist__close(evlist); -+ -+ err = evlist__open(evlist); -+ if (err < 0) { -+ pr_debug("perf_evlist__open: %s\n", -+ str_error_r(errno, sbuf, sizeof(sbuf))); -+ goto out_delete_evlist; -+ } -+ - err = do_test(evlist, 1, &sample_count, &comm_count); - if (err != TEST_OK) - goto out_delete_evlist; diff --git a/queue-4.9/series b/queue-4.9/series index 1015f65b2ac..80261ca0b8d 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -131,7 +131,6 @@ ar5523-check-null-before-memcpy-in-ar5523_cmd.patch media-bdisp-fix-memleak-on-release.patch media-radio-wl1273-fix-interrupt-masking-on-release.patch cpuidle-do-not-unset-the-driver-if-it-is-there-already.patch -perf-tests-fix-out-of-bounds-memory-access.patch pm-devfreq-lock-devfreq-in-trans_stat_show.patch acpi-osl-only-free-map-once-in-osl.c.patch acpi-bus-fix-null-pointer-check-in-acpi_bus_get_private_data.patch diff --git a/queue-5.3/perf-tests-fix-out-of-bounds-memory-access.patch b/queue-5.3/perf-tests-fix-out-of-bounds-memory-access.patch deleted file mode 100644 index c256a5d8873..00000000000 --- a/queue-5.3/perf-tests-fix-out-of-bounds-memory-access.patch +++ /dev/null @@ -1,94 +0,0 @@ -From af8490eb2b33684e26a0a927a9d93ae43cd08890 Mon Sep 17 00:00:00 2001 -From: Leo Yan -Date: Thu, 7 Nov 2019 10:02:44 +0800 -Subject: perf tests: Fix out of bounds memory access - -From: Leo Yan - -commit af8490eb2b33684e26a0a927a9d93ae43cd08890 upstream. - -The test case 'Read backward ring buffer' failed on 32-bit architectures -which were found by LKFT perf testing. The test failed on arm32 x15 -device, qemu_arm32, qemu_i386, and found intermittent failure on i386; -the failure log is as below: - - 50: Read backward ring buffer : - --- start --- - test child forked, pid 510 - Using CPUID GenuineIntel-6-9E-9 - mmap size 1052672B - mmap size 8192B - Finished reading overwrite ring buffer: rewind - free(): invalid next size (fast) - test child interrupted - ---- end ---- - Read backward ring buffer: FAILED! - -The log hints there have issue for memory usage, thus free() reports -error 'invalid next size' and directly exit for the case. Finally, this -issue is root caused as out of bounds memory access for the data array -'evsel->id'. - -The backward ring buffer test invokes do_test() twice. 'evsel->id' is -allocated at the first call with the flow: - - test__backward_ring_buffer() - `-> do_test() - `-> evlist__mmap() - `-> evlist__mmap_ex() - `-> perf_evsel__alloc_id() - -So 'evsel->id' is allocated with one item, and it will be used in -function perf_evlist__id_add(): - - evsel->id[0] = id - evsel->ids = 1 - -At the second call for do_test(), it skips to initialize 'evsel->id' -and reuses the array which is allocated in the first call. But -'evsel->ids' contains the stale value. Thus: - - evsel->id[1] = id -> out of bound access - evsel->ids = 2 - -To fix this issue, we will use evlist__open() and evlist__close() pair -functions to prepare and cleanup context for evlist; so 'evsel->id' and -'evsel->ids' can be initialized properly when invoke do_test() and avoid -the out of bounds memory access. - -Fixes: ee74701ed8ad ("perf tests: Add test to check backward ring buffer") -Signed-off-by: Leo Yan -Reviewed-by: Jiri Olsa -Cc: Alexander Shishkin -Cc: Mark Rutland -Cc: Namhyung Kim -Cc: Naresh Kamboju -Cc: Peter Zijlstra -Cc: Wang Nan -Cc: stable@vger.kernel.org # v4.10+ -Link: http://lore.kernel.org/lkml/20191107020244.2427-1-leo.yan@linaro.org -Signed-off-by: Arnaldo Carvalho de Melo -Signed-off-by: Greg Kroah-Hartman - ---- - tools/perf/tests/backward-ring-buffer.c | 9 +++++++++ - 1 file changed, 9 insertions(+) - ---- a/tools/perf/tests/backward-ring-buffer.c -+++ b/tools/perf/tests/backward-ring-buffer.c -@@ -144,6 +144,15 @@ int test__backward_ring_buffer(struct te - goto out_delete_evlist; - } - -+ evlist__close(evlist); -+ -+ err = evlist__open(evlist); -+ if (err < 0) { -+ pr_debug("perf_evlist__open: %s\n", -+ str_error_r(errno, sbuf, sizeof(sbuf))); -+ goto out_delete_evlist; -+ } -+ - err = do_test(evlist, 1, &sample_count, &comm_count); - if (err != TEST_OK) - goto out_delete_evlist; diff --git a/queue-5.3/series b/queue-5.3/series index 2939cb1efed..e362ebbbf96 100644 --- a/queue-5.3/series +++ b/queue-5.3/series @@ -92,7 +92,6 @@ cpuidle-teo-rename-local-variable-in-teo_select.patch cpuidle-teo-consider-hits-and-misses-metrics-of-disabled-states.patch cpuidle-teo-fix-early-hits-handling-for-disabled-idle-states.patch erofs-zero-out-when-listxattr-is-called-with-no-xattr.patch -perf-tests-fix-out-of-bounds-memory-access.patch powerpc-perf-disable-trace_imc-pmu.patch intel_th-fix-a-double-put_device-in-error-path.patch intel_th-pci-add-ice-lake-cpu-support.patch