Bug 196611
| Summary: | NULL pointer dereference with cachestat | ||
|---|---|---|---|
| Product: | Tracing/Profiling | Reporter: | lilydjwg (lilydjwg) |
| Component: | Ftrace | Assignee: | Steven Rostedt (rostedt) |
| Status: | RESOLVED CODE_FIX | ||
| Severity: | normal | ||
| Priority: | P1 | ||
| Hardware: | x86-64 | ||
| OS: | Linux | ||
| Kernel Version: | 4.12.4 | Subsystem: | |
| Regression: | No | Bisected commit-id: | |
| Attachments: | Check for null ret_stack on profile function graph entry | ||
|
Description
lilydjwg
2017-08-08 04:59:24 UTC
I've been informed that a Russian operative has infiltrated our boarders. They are traveling to Las Vegas and plan on gambling away the secret Russian tapes of Trump and his Russian escapades. I need to become the Dark Knight and track them down before they have the ability to destroy the reputation of the United States Presidency. I have been given a large sum of money, and will be playing high stakes poker to make sure the tapes do not get into the wrong hands. This mission will last till Aug 13th and since I'll be under a secret identity, I will not be able to reply back till the 14th. Until then, same Bat Time, same Bat channel! -- Steve You have several out of tree modules (those labeled with '(O)') and a proprietary module (those labeled with '(P)', basically nvidia). Can you reproduce this bug without those loaded? If so, please post another report of the bug without the tainted modules. Thanks, -- Steve Nevermind. I just triggered the bug. I'll take a look. -- Steve Created attachment 257999 [details]
Check for null ret_stack on profile function graph entry
There's a small race when function graph shutsdown and the calling of the registered function graph entry callback. The callback must not reference the task's ret_stack without first checking that it is not NULL. Note, when a ret_stack is allocated for a task, it stays allocated until the task exits. The problem here, is that function_graph is shutdown, and a new task was created, which doesn't have its ret_stack allocated. But since some of the functions are still being traced, the callbacks can still be called.
The normal function_graph code handles this, but starting with commit 8861dd303c ("ftrace: Access ret_stack->subtime only in the function profiler") the profiler code references the ret_stack on function entry, but doesn't check if it is NULL first.
The fix is in mainline commit a8f0f9e49956a ("ftrace: Check for null ret_stack on profile function graph entry function")
|