• Daniel Thompson's avatar
    tracing: kdb: Fix kernel panic during ftdump · c270cc75
    Daniel Thompson authored
    Currently kdb's ftdump command unconditionally crashes due to a null
    pointer de-reference whenever the command is run. This in turn causes
    the kernel to panic.
    
    The abridged stacktrace (gathered with ARCH=arm) is:
    
    --- cut here ---
    [<c09535ac>] (panic) from [<c02132dc>] (die+0x264/0x440)
    [<c02132dc>] (die) from [<c0952eb8>]
    (__do_kernel_fault.part.11+0x74/0x84)
    [<c0952eb8>] (__do_kernel_fault.part.11) from [<c021f954>]
    (do_page_fault+0x1d0/0x3c4)
    [<c021f954>] (do_page_fault) from [<c020846c>] (do_DataAbort+0x48/0xac)
    
    [<c020846c>] (do_DataAbort) from [<c0213c58>] (__dabt_svc+0x38/0x60)
    Exception stack(0xc0deba88 to 0xc0debad0)
    ba80:                   e8c29180 00000001 e9854304 e9854300 c0f567d8
    c0df2580
    baa0: 00000000 00000000 00000000 c0f117b8 c0e3a3c0 c0debb0c 00000000
    c0debad0
    bac0: 0000672e c02f4d60 60000193 ffffffff
    [<c0213c58>] (__dabt_svc) from [<c02f4d60>] (kdb_ftdump+0x1e4/0x3d8)
    [<c02f4d60>] (kdb_ftdump) from [<c02ce328>] (kdb_parse+0x2b8/0x698)
    [<c02ce328>] (kdb_parse) from [<c02ceef0>] (kdb_main_loop+0x52c/0x784)
    [<c02ceef0>] (kdb_main_loop) from [<c02d1b0c>] (kdb_stub+0x238/0x490)
    --- cut here ---
    
    The NULL deref occurs due to the initialized use of struct trace_iter's
    buffer_iter member.
    
    This is a regression, albeit a fairly elderly one. It was introduced
    by commit 6d158a81 ("tracing: Remove NR_CPUS array from
    trace_iterator").
    
    This patch solves this by providing a collection of ring_buffer_iter(s)
    and using this to initialize buffer_iter. Note that static allocation
    is used solely because the trace_iter itself is also static allocated.
    Static allocation also means that we have to NULL-ify the pointer during
    cleanup to avoid use-after-free problems.
    
    Link: http://lkml.kernel.org/r/1415277716-19419-2-git-send-email-daniel.thompson@linaro.org
    
    Cc: Jason Wessel <jason.wessel@windriver.com>
    Signed-off-by: default avatarDaniel Thompson <daniel.thompson@linaro.org>
    Signed-off-by: default avatarSteven Rostedt <rostedt@goodmis.org>
    c270cc75
trace_kdb.c 3.22 KB