diff options
| author |   Sergey Matyukevich <sergey.matyukevich@syntacore.com> | 2022-08-30 18:53:04 +0300 |
|---|---|---|
| committer |   Palmer Dabbelt <palmer@rivosinc.com> | 2022-09-08 13:50:25 -0700 |
| commit | 20e0fbab16003ae23a9e86a64bcb93e3121587ca (patch) | |
| tree | ff6fc31691dd292508a305c2e44636bd14e39288 /drivers | |
| parent | Merge tag 'dt-fixes-for-palmer-6.0-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/conor/linux.git into fixes (diff) | |
| download | linux-dev-20e0fbab16003ae23a9e86a64bcb93e3121587ca.tar.xz linux-dev-20e0fbab16003ae23a9e86a64bcb93e3121587ca.zip | |
perf: RISC-V: fix access beyond allocated array
SBI firmware should report total number of firmware and hardware counters
including unused ones or special ones. In this case the kernel doesn't need
to make any assumptions about gaps in reported counters, e.g. excluded timer
counter. That was fixed in OpenSBI v1.1 by commit 3f66465fb6bf ("lib: pmu:
allow to use the highest available counter"). This kernel patch has no effect
if SBI firmware behaves correctly. However it eliminates access beyond the
allocated pmu_ctr_list if the kernel is used with OpenSBI older than v1.1.
Fixes: e9991434596f ("RISC-V: Add perf platform driver based on SBI PMU extension")
Signed-off-by: Sergey Matyukevich <sergey.matyukevich@syntacore.com>
Reviewed-by: Atish Patra <atishp@rivosinc.com>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20220830155306.301714-2-geomatsi@gmail.com
Signed-off-by: Palmer Dabbelt <palmer@rivosinc.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/perf/riscv_pmu_sbi.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/perf/riscv_pmu_sbi.c b/drivers/perf/riscv_pmu_sbi.c index 6f6681bbfd36..8de4ca2fef21 100644 --- a/drivers/perf/riscv_pmu_sbi.c +++ b/drivers/perf/riscv_pmu_sbi.c @@ -473,7 +473,7 @@ static int pmu_sbi_get_ctrinfo(int nctr) if (!pmu_ctr_list) return -ENOMEM; - for (i = 0; i <= nctr; i++) { + for (i = 0; i < nctr; i++) { ret = sbi_ecall(SBI_EXT_PMU, SBI_EXT_PMU_COUNTER_GET_INFO, i, 0, 0, 0, 0, 0); if (ret.error) /* The logical counter ids are not expected to be contiguous */ |