is_perf_trbe() obtains the sink buffer from the output handle and dereferences buf->cpudata before validating either pointer. A live AUX transaction does not guarantee that the selected buffer has a CPU association.
Reject a missing buffer or CPU association before reading CPU driver data or checking the hardware buffer addresses. Treat these configurations as an invalid perf TRBE session.
Signed-off-by: Leo Yan leo.yan@arm.com --- drivers/hwtracing/coresight/coresight-trbe.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-)
diff --git a/drivers/hwtracing/coresight/coresight-trbe.c b/drivers/hwtracing/coresight/coresight-trbe.c index 8ec0b4c4987f25d10ee0b2f80c27e10f76357387..91fbdbad3676ffae399df0b4d4ddcd603a40e86c 100644 --- a/drivers/hwtracing/coresight/coresight-trbe.c +++ b/drivers/hwtracing/coresight/coresight-trbe.c @@ -1111,10 +1111,16 @@ static int trbe_handle_overflow(struct perf_output_handle *handle) static bool is_perf_trbe(struct perf_output_handle *handle) { struct trbe_buf *buf = etm_perf_sink_config(handle); - struct trbe_cpudata *cpudata = buf->cpudata; - struct trbe_drvdata *drvdata = cpudata->drvdata; + struct trbe_cpudata *cpudata; + struct trbe_drvdata *drvdata; int cpu = smp_processor_id();
+ if (!buf || !buf->cpudata) + return false; + + cpudata = buf->cpudata; + drvdata = cpudata->drvdata; + WARN_ON(buf->trbe_hw_base != get_trbe_base_pointer()); WARN_ON(buf->trbe_limit != get_trbe_limit_pointer());