On 20/10/2025 11:18, Jie Gan wrote:
On 10/20/2025 5:06 PM, Xiaoqi Zhuang wrote:
When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed and enabled again, currently sysfs_buf will point to the newly allocated memory(buf_new) and free the old memory(buf_old). But the etr_buf that is being used by the ETR remains pointed to buf_old, not updated to buf_new. In this case, it will result in a memory use-after-free issue.
Fix this by checking ETR's mode before updating and releasing buf_old, if the mode is CS_MODE_SYSFS, then skip updating and releasing it.
I think we need a fix tag for the fix patch: Fixes: de5461970b3e ("coresight: tmc: allocating memory when needed")
minor comment: Since ETR is enabled, we can't switch the sysfs buffer, can we exit earlier by checking the CS_MODE to avoid allocating memory unnecessarily?
+1
Something like this:
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtracing/coresight/coresight-tmc-etr.c index b07fcdb3fe1a..a9ddb05c10d9 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etr.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c @@ -1252,6 +1252,12 @@ static struct etr_buf *tmc_etr_get_sysfs_buffer(struct coresight_device *csdev) raw_spin_lock_irqsave(&drvdata->spinlock, flags); sysfs_buf = READ_ONCE(drvdata->sysfs_buf); if (!sysfs_buf || (sysfs_buf->size != drvdata->size)) { + /* + * If the ETR is already enabled, continue with the existing + * buffer. + */ + if (coresight_get_mode(csdev) == CS_MODE_SYSFS) + goto out; raw_spin_unlock_irqrestore(&drvdata->spinlock, flags);
/* Allocate memory with the locks released */
Suzuki>
Besides, Looks good to me.
Thanks, Jie
Signed-off-by: Xiaoqi Zhuang xiaoqi.zhuang@oss.qualcomm.com
drivers/hwtracing/coresight/coresight-tmc-etr.c | 7 +++++++ 1 file changed, 7 insertions(+)
diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/ drivers/hwtracing/coresight/coresight-tmc-etr.c index b07fcdb3fe1a..3e73cf2c38a3 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etr.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c @@ -1268,6 +1268,13 @@ static struct etr_buf *tmc_etr_get_sysfs_buffer(struct coresight_device *csdev) goto out; } + /* + * Since this sink is already enabled, the existing buffer should not + * be released even if the buffer size has changed. + */ + if (coresight_get_mode(csdev) == CS_MODE_SYSFS) + goto out;
/* * If we don't have a buffer or it doesn't match the requested size, * use the buffer allocated above. Otherwise reuse the existing buffer.
base-commit: 98ac9cc4b4452ed7e714eddc8c90ac4ae5da1a09 change-id: 20251020-fix_etr_issue-02c706dbc899
Best regards,