[5.13,238/266] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()

From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>

From: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>

commit 5fae8a946ac2df879caf3f79a193d4766d00239b upstream.

commit 6f755e85c332 ("coresight: Add helper for inserting synchronization
packets") removed trailing '\0' from barrier_pkt array and updated the
call sites like etb_update_buffer() to have proper checks for barrier_pkt
size before read but missed updating tmc_update_etf_buffer() which still
reads barrier_pkt past the array size resulting in KASAN out-of-bounds
bug. Fix this by adding a check for barrier_pkt size before accessing
like it is done in etb_update_buffer().

 BUG: KASAN: global-out-of-bounds in tmc_update_etf_buffer+0x4b8/0x698
 Read of size 4 at addr ffffffd05b7d1030 by task perf/2629

 Call trace:
  dump_backtrace+0x0/0x27c
  show_stack+0x20/0x2c
  dump_stack+0x11c/0x188
  print_address_description+0x3c/0x4a4
  __kasan_report+0x140/0x164
  kasan_report+0x10/0x18
  __asan_report_load4_noabort+0x1c/0x24
  tmc_update_etf_buffer+0x4b8/0x698
  etm_event_stop+0x248/0x2d8
  etm_event_del+0x20/0x2c
  event_sched_out+0x214/0x6f0
  group_sched_out+0xd0/0x270
  ctx_sched_out+0x2ec/0x518
  __perf_event_task_sched_out+0x4fc/0xe6c
  __schedule+0x1094/0x16a0
  preempt_schedule_irq+0x88/0x170
  arm64_preempt_schedule_irq+0xf0/0x18c
  el1_irq+0xe8/0x180
  perf_event_exec+0x4d8/0x56c
  setup_new_exec+0x204/0x400
  load_elf_binary+0x72c/0x18c0
  search_binary_handler+0x13c/0x420
  load_script+0x500/0x6c4
  search_binary_handler+0x13c/0x420
  exec_binprm+0x118/0x654
  __do_execve_file+0x77c/0xba4
  __arm64_compat_sys_execve+0x98/0xac
  el0_svc_common+0x1f8/0x5e0
  el0_svc_compat_handler+0x84/0xb0
  el0_svc_compat+0x10/0x50

 The buggy address belongs to the variable:
  barrier_pkt+0x10/0x40

 Memory state around the buggy address:
  ffffffd05b7d0f00: fa fa fa fa 04 fa fa fa fa fa fa fa 00 00 00 00
  ffffffd05b7d0f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 >ffffffd05b7d1000: 00 00 00 00 00 00 fa fa fa fa fa fa 00 00 00 03
                                      ^
  ffffffd05b7d1080: fa fa fa fa 00 02 fa fa fa fa fa fa 03 fa fa fa
  ffffffd05b7d1100: fa fa fa fa 00 00 00 00 05 fa fa fa fa fa fa fa
 ==================================================================

Link: https://lore.kernel.org/r/20210505093430.18445-1-saiprakash.ranjan@codeaurora.org
Fixes: 0c3fc4d5fa26 ("coresight: Add barrier packet for synchronisation")
Cc: stable@vger.kernel.org
Signed-off-by: Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>
Signed-off-by: Suzuki K Poulose <suzuki.poulose@arm.com>
Signed-off-by: Mathieu Poirier <mathieu.poirier@linaro.org>
Link: https://lore.kernel.org/r/20210614175901.532683-6-mathieu.poirier@linaro.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/hwtracing/coresight/coresight-tmc-etf.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Message ID	20210715182650.807768183@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, Sai Prakash Ranjan <saiprakash.ranjan@codeaurora.org>, Suzuki K Poulose <suzuki.poulose@arm.com>, Mathieu Poirier <mathieu.poirier@linaro.org> Subject: [PATCH 5.13 238/266] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() Date: Thu, 15 Jul 2021 20:39:53 +0200 Message-Id: <20210715182650.807768183@linuxfoundation.org> In-Reply-To: <20210715182613.933608881@linuxfoundation.org> References: <20210715182613.933608881@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Precedence: bulk
Series	None \| expand [5.13,002/266] drm/zte: Dont select DRM_KMS_FB_HELPER [5.13,003/266] drm/ast: Fixed CVE for DP501 [5.13,004/266] drm/amd/display: fix HDCP reset sequence on reinitialize [5.13,006/266] drm/amd/display: Fix BSOD with NULL check [5.13,009/266] drm/bridge: nwl-dsi: Force a full modeset when crtc_state->active is changed to be... [5.13,010/266] drm/imx: Add 8 pixel alignment fix [5.13,011/266] net: pch_gbe: Use proper accessors to BE data in pch_ptp_match() [5.13,013/266] drm/amd/display: Fix clock table filling logic [5.13,014/266] drm/amd/display: fix use_max_lb flag for 420 pixel formats [5.13,016/266] MIPS: Loongson64: Fix build error secondary_kexec_args undeclared under !SMP [5.13,020/266] atm: nicstar: Fix possible use-after-free in nicstar_cleanup() [5.13,022/266] drm/mediatek: Fix PM reference leak in mtk_crtc_ddp_hw_init() [5.13,029/266] net/sched: cls_api: increase max_reclassify_loop [5.13,030/266] net: ethernet: ixp4xx: Fix return value check in ixp4xx_eth_probe() [5.13,031/266] pinctrl: equilibrium: Add missing MODULE_DEVICE_TABLE [5.13,032/266] drm/scheduler: Fix hang when sched_entity released [5.13,034/266] udf: Fix NULL pointer dereference in udf_symlink function [5.13,035/266] net: xilinx_emaclite: Do not print real IOMEM pointer [5.13,036/266] drm/amd/pm: fix return value in aldebaran_set_mp1_state() [5.13,038/266] drm/vc4: hdmi: Fix PM reference leak in vc4_hdmi_encoder_pre_crtc_co() [5.13,039/266] e100: handle eeprom as little endian [5.13,042/266] drm/bridge: cdns: Fix PM reference leak in cdns_dsi_transfer() [5.13,044/266] drm/amd/display: fix odm scaling [5.13,045/266] drm/amdgpu/swsmu/aldebaran: fix check in is_dpm_running [5.13,048/266] drm: rockchip: add missing registers for RK3188 [5.13,051/266] RDMA/rtrs: Change MAX_SESS_QUEUE_DEPTH [5.13,053/266] clk: tegra: Fix refcounting of gate clocks [5.13,054/266] clk: tegra: Ensure that PLLU configuration is applied properly [5.13,055/266] drm: bridge: cdns-mhdp8546: Fix PM reference leak in [5.13,057/266] ipv6: use prandom_u32() for ID generation [5.13,059/266] MIPS: ingenic: Select CPU_SUPPORTS_CPUFREQ && MIPS_EXTERNAL_TIMER [5.13,060/266] drm/amdgpu: fix metadata_size for ubo ioctl queries [5.13,061/266] drm/amdgpu: fix sdma firmware version error in sriov [5.13,069/266] dm writecache: dont split bios when overwriting contiguous cache content [5.13,071/266] block: introduce BIO_ZONE_WRITE_LOCKED bio flag [5.13,072/266] net: bridge: mrp: Update ring transitions. [5.13,074/266] ice: set the value of global config lock timeout longer [5.13,076/266] virtio_net: Remove BUG() to avoid machine dead [5.13,077/266] net: mscc: ocelot: check return value after calling platform_get_resource() [5.13,079/266] net: mvpp2: check return value after calling platform_get_resource() [5.13,081/266] net: moxa: Use devm_platform_get_and_ioremap_resource() [5.13,082/266] drm/amd/display: Fix DCN 3.01 DSCCLK validation [5.13,083/266] drm/amd/display: Revert "Fix clock table filling logic" [5.13,085/266] drm/amd/display: Release MST resources on switch from MST to SST [5.13,088/266] drm/amd/display: Fix crash during MPO + ODM combine mode recalculation [5.13,089/266] net: phy: realtek: add delay to fix RXC generation issue [5.13,091/266] net: sgi: ioc3-eth: check return value after calling platform_get_resource() [5.13,096/266] r8169: avoid link-up interrupt issue on RTL8106e if user enables ASPM [5.13,097/266] drm/amd/display: Verify Gamma & Degamma LUT sizes in amdgpu_dm_atomic_check [5.13,098/266] ibmvnic: fix kernel build warnings in build_hdr_descs_arr [5.13,100/266] dm writecache: commit just one block, not a full page [5.13,102/266] net: phy: nxp-c45-tja11xx: enable MDIO write access to the master/slave registers [5.13,104/266] cw1200: add missing MODULE_DEVICE_TABLE [5.13,106/266] drm/amd/display: Cover edge-case when changing DISPCLK WDIVIDER [5.13,107/266] drm/amdkfd: Fix circular lock in nocpsch path [5.13,109/266] bpf: Fix up register-based shifts in interpreter to silence KUBSAN [5.13,112/266] ice: mark PTYPE 2 as reserved [5.13,117/266] net: sched: fix error return code in tcf_del_walker() [5.13,118/266] io_uring: fix false WARN_ONCE [5.13,121/266] mt76: mt7915: fix tssi indication field of DBDC NICs [5.13,122/266] mt76: mt7921: fix reset under the deep sleep is enabled [5.13,123/266] mt76: mt7921: reset wfsys during hw probe [5.13,126/266] mt76: connac: fix the maximum interval schedule scan can support [5.13,127/266] mt76: mt7915: fix IEEE80211_HE_PHY_CAP7_MAX_NC for station mode [5.13,131/266] net: fec: add FEC_QUIRK_HAS_MULTI_QUEUES represents i.MX6SX ENET IP [5.13,133/266] atm: nicstar: use dma_free_coherent instead of kfree [5.13,134/266] atm: nicstar: register the interrupt handler in the right place [5.13,137/266] RDMA/rxe: Dont overwrite errno from ib_umem_get() [5.13,138/266] iwlwifi: mvm: dont change band on bound PHY contexts [5.13,140/266] iwlwifi: mvm: fix error print when session protection ends [5.13,141/266] iwlwifi: pcie: free IML DMA memory allocation [5.13,145/266] sfc: avoid double pci_remove of VFs [5.13,147/266] wireless: wext-spy: Fix out-of-bounds warning [5.13,151/266] mac80211: Properly WARN on HW scan before restart [5.13,153/266] media, bpf: Do not copy more entries than user space requested [5.13,154/266] net: retrieve netns cookie via getsocketopt [5.13,155/266] net: ip: avoid OOM kills with large UDP sends over loopback [5.13,156/266] RDMA/cma: Fix rdma_resolve_route() memory leak [5.13,158/266] Bluetooth: cmtp: fix file refcount when cmtp_attach_device fails [5.13,159/266] Bluetooth: Fix the HCI to MGMT status conversion table [5.13,161/266] Bluetooth: Shutdown controller after workqueues are flushed or cancelled [5.13,162/266] Bluetooth: btusb: Add a new QCA_ROME device (0cf3:e500) [5.13,163/266] Bluetooth: L2CAP: Fix invalid access if ECRED Reconfigure fails [5.13,169/266] sched/fair: Ensure _sum and _avg values stay consistent [5.13,171/266] flow_offload: action should not be NULL when it is referenced [5.13,172/266] sctp: validate from_addr_param return [5.13,173/266] sctp: add size validation when walking chunks [5.13,174/266] MIPS: loongsoon64: Reserve memory below starting pfn to prevent Oops [5.13,175/266] MIPS: set mips32r5 for virt extensions [5.13,178/266] MIPS: MT extensions are not available on MIPS32r1 [5.13,184/266] powerpc/powernv/vas: Release reference to tgid during window close [5.13,189/266] drm/amdgpu: fix the hang caused by PCIe link width switch [5.13,190/266] drm/radeon: Add the missed drm_gem_object_put() in radeon_user_framebuffer_create() [5.13,191/266] drm/radeon: Call radeon_suspend_kms() in radeon_pci_shutdown() for Loongson64 [5.13,192/266] drm/vc4: txp: Properly set the possible_crtcs mask [5.13,194/266] drm/vc4: hdmi: Prevent clock unbalance [5.13,195/266] drm/dp: Handle zeroed port counts in drm_dp_read_downstream_info() [5.13,196/266] drm/rockchip: dsi: remove extra component_del() call [5.13,197/266] drm/amd/display: fix incorrrect valid irq check [5.13,201/266] drm/tegra: Dont set allow_fb_modifiers explicitly [5.13,202/266] drm/msm/mdp4: Fix modifier support enabling [5.13,203/266] drm/arm/malidp: Always list modifiers [5.13,204/266] drm/nouveau: Dont set allow_fb_modifiers explicitly [5.13,207/266] mmc: sdhci-acpi: Disable write protect detection on Toshiba Encore 2 WT8-B [5.13,208/266] mmc: sdhci: Fix warning message when accessing RPMB in HS400 mode [5.13,209/266] mmc: core: clear flags before allowing to retune [5.13,210/266] mmc: core: Allow UHS-I voltage switch for SDSC cards if supported [5.13,211/266] docs: Makefile: Use CONFIG_SHELL not SHELL [5.13,212/266] ata: ahci_sunxi: Disable DIPM [5.13,213/266] arm64: tlb: fix the TTL value of tlb_get_level [5.13,215/266] clocksource/arm_arch_timer: Improve Allwinner A64 timer workaround [5.13,216/266] fpga: stratix10-soc: Add missing fpga_mgr_free() call [5.13,218/266] mwifiex: bring down link before deleting interface [5.13,220/266] qemu_fw_cfg: Make fw_cfg_rev_attr a proper kobj_attribute [5.13,223/266] thermal/drivers/int340x/processor_thermal: Fix tcc setting [5.13,225/266] power: supply: ab8500: Fix an old bug [5.13,226/266] mfd: syscon: Free the allocated name field of struct regmap_config [5.13,228/266] lkdtm/bugs: XFAIL UNALIGNED_LOAD_STORE_WRITE [5.13,232/266] seq_buf: Fix overflow in seq_buf_putmem_hex() [5.13,233/266] rq-qos: fix missed wake-ups in rq_qos_throttle try two [5.13,234/266] tracing: Simplify & fix saved_tgids logic [5.13,236/266] ipack/carriers/tpci200: Fix a double free in tpci200_pci_probe [5.13,237/266] coresight: Propagate symlink failure [5.13,238/266] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer() [5.13,240/266] dm writecache: flush origin device when writing and cache is full [5.13,245/266] media: subdev: disallow ioctl for saa6588/davinci [5.13,247/266] media: dtv5100: fix control-request directions [5.13,248/266] media: zr364xx: fix memory leak in zr364xx_start_readpipe [5.13,254/266] s390/vdso: always enable vdso [5.13,255/266] s390/vdso64: add sigreturn,rt_sigreturn and restart_syscall [5.13,256/266] s390/vdso: rename VDSO64_LBASE to VDSO_LBASE [5.13,259/266] dm writecache: write at least 4k when committing [5.13,262/266] ext4: fix possible UAF when remounting r/o a mmp-protected file system [5.13,263/266] jfs: fix GPF in diFree [5.13,264/266] media: v4l2-core: explicitly clear ioctl input data [5.13,266/266] f2fs: fix to avoid racing on fsync_entry_slab by multi filesystem instances

[5.13,238/266] coresight: tmc-etf: Fix global-out-of-bounds in tmc_update_etf_buffer()

Commit Message

Patch