diff options
| author | Robert Richter <robert.richter@amd.com> | 2009-01-17 17:13:27 +0100 |
|---|---|---|
| committer | Ingo Molnar <mingo@elte.hu> | 2009-01-17 17:26:39 +0100 |
| commit | fdb6a8f4db813b4e50f4e975efe6be12ba5bf460 (patch) | |
| tree | ffb4cd30eb41639779925f7c81eaba0e95e9261a | |
| parent | rcu: move Kconfig menu (diff) | |
| download | linux-fdb6a8f4db813b4e50f4e975efe6be12ba5bf460.tar.xz linux-fdb6a8f4db813b4e50f4e975efe6be12ba5bf460.zip | |
oprofile: fix uninitialized use of struct op_entry
Impact: fix crash
In case of losing samples struct op_entry could have been used
uninitialized causing e.g. a wrong preemption count or NULL pointer
access. This patch fixes this.
Signed-off-by: Robert Richter <robert.richter@amd.com>
Signed-off-by: Ingo Molnar <mingo@elte.hu>
| -rw-r--r-- | drivers/oprofile/cpu_buffer.c | 5 | ||||
| -rw-r--r-- | drivers/oprofile/cpu_buffer.h | 7 |
2 files changed, 12 insertions, 0 deletions
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c index 2e03b6d796d3..e76d715e4342 100644 --- a/drivers/oprofile/cpu_buffer.c +++ b/drivers/oprofile/cpu_buffer.c @@ -393,16 +393,21 @@ oprofile_write_reserve(struct op_entry *entry, struct pt_regs * const regs, return; fail: + entry->event = NULL; cpu_buf->sample_lost_overflow++; } int oprofile_add_data(struct op_entry *entry, unsigned long val) { + if (!entry->event) + return 0; return op_cpu_buffer_add_data(entry, val); } int oprofile_write_commit(struct op_entry *entry) { + if (!entry->event) + return -EINVAL; return op_cpu_buffer_write_commit(entry); } diff --git a/drivers/oprofile/cpu_buffer.h b/drivers/oprofile/cpu_buffer.h index 63f81c44846a..272995d20293 100644 --- a/drivers/oprofile/cpu_buffer.h +++ b/drivers/oprofile/cpu_buffer.h @@ -66,6 +66,13 @@ static inline void op_cpu_buffer_reset(int cpu) cpu_buf->last_task = NULL; } +/* + * op_cpu_buffer_add_data() and op_cpu_buffer_write_commit() may be + * called only if op_cpu_buffer_write_reserve() did not return NULL or + * entry->event != NULL, otherwise entry->size or entry->event will be + * used uninitialized. + */ + struct op_sample *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size); int op_cpu_buffer_write_commit(struct op_entry *entry); |