Commit-ID:  f1e1c9e5e357c05253affb13be29285c5cb56bf0
Gitweb:     http://git.kernel.org/tip/f1e1c9e5e357c05253affb13be29285c5cb56bf0
Author:     Sebastian Andrzej Siewior <bige...@linutronix.de>
AuthorDate: Tue, 20 Sep 2016 15:12:21 +0200
Committer:  Thomas Gleixner <t...@linutronix.de>
CommitDate: Tue, 20 Sep 2016 16:06:09 +0200

perf/x86/intel/bts: Make sure debug store is valid

Since commit 4d4c47412464 ("perf/x86/intel/bts: Fix BTS PMI detection")
my box goes boom on boot:

| .... node  #0, CPUs:      #1 #2 #3 #4 #5 #6 #7
| BUG: unable to handle kernel NULL pointer dereference at 0000000000000018
| IP: [<ffffffff8100c463>] intel_bts_interrupt+0x43/0x130
| Call Trace:
|  <NMI> d [<ffffffff8100b341>] intel_pmu_handle_irq+0x51/0x4b0
|  [<ffffffff81004d47>] perf_event_nmi_handler+0x27/0x40

This happens because the code introduced in this commit dereferences the
debug store pointer unconditionally. The debug store is not guaranteed to
be available, so a NULL pointer check as on other places is required.

Fixes: 4d4c47412464 ("perf/x86/intel/bts: Fix BTS PMI detection")
Signed-off-by: Sebastian Andrzej Siewior <bige...@linutronix.de>
Reviewed-by: Alexander Shishkin <alexander.shish...@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <a...@infradead.org>
Cc: Peter Zijlstra <a.p.zijls...@chello.nl>
Cc: vi...@deater.net
Cc: eran...@google.com
Link: http://lkml.kernel.org/r/20160920131220.xg5pbdjtznszu...@breakpoint.cc
Signed-off-by: Thomas Gleixner <t...@linutronix.de>

---
 arch/x86/events/intel/bts.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/x86/events/intel/bts.c b/arch/x86/events/intel/bts.c
index bdcd651..6ff66ef 100644
--- a/arch/x86/events/intel/bts.c
+++ b/arch/x86/events/intel/bts.c
@@ -455,7 +455,7 @@ int intel_bts_interrupt(void)
         * The only surefire way of knowing if this NMI is ours is by checking
         * the write ptr against the PMI threshold.
         */
-       if (ds->bts_index >= ds->bts_interrupt_threshold)
+       if (ds && (ds->bts_index >= ds->bts_interrupt_threshold))
                handled = 1;
 
        /*

Reply via email to