offset is passed as a pointer and on certain call path is not set by the
function. If the caller does not re-initialize offset between calls, value
could be inherited between calls. Prevent this by initializing offset on each
call.
This impacts the code in amd_pmu_lbr_filter() which does
   for(i=0; ...) {
       ret = get_branch_type_fused(..., &offset);
       if (offset)
          lbr_entries[i].from += offset;
   }

Signed-off-by: Stephane Eranian <eranian@google.com>
---
 arch/x86/events/utils.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/events/utils.c b/arch/x86/events/utils.c
index 5f5617afde79..76b1f8bb0fd5 100644
--- a/arch/x86/events/utils.c
+++ b/arch/x86/events/utils.c
@@ -94,6 +94,10 @@ static int get_branch_type(unsigned long from, unsigned long to, int abort,
 	u8 buf[MAX_INSN_SIZE];
 	int is64 = 0;
 
+	/* make sure we initialize offset */
+	if (offset)
+		*offset = 0;
+
 	to_plm = kernel_ip(to) ? X86_BR_KERNEL : X86_BR_USER;
 	from_plm = kernel_ip(from) ? X86_BR_KERNEL : X86_BR_USER;
 
-- 
2.37.3.998.g577e59143f-goog

On 9/29/2022 12:10 AM, Stephane Eranian wrote:
> offset is passed as a pointer and on certain call path is not set by the
> function. If the caller does not re-initialize offset between calls, value
> could be inherited between calls. Prevent this by initializing offset on each
> call.
> This impacts the code in amd_pmu_lbr_filter() which does
>    for(i=0; ...) {
>        ret = get_branch_type_fused(..., &offset);
>        if (offset)
>           lbr_entries[i].from += offset;
>    }
> 
> Signed-off-by: Stephane Eranian <eranian@google.com>
> ---
>  arch/x86/events/utils.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/x86/events/utils.c b/arch/x86/events/utils.c
> index 5f5617afde79..76b1f8bb0fd5 100644
> --- a/arch/x86/events/utils.c
> +++ b/arch/x86/events/utils.c
> @@ -94,6 +94,10 @@ static int get_branch_type(unsigned long from, unsigned long to, int abort,
>  	u8 buf[MAX_INSN_SIZE];
>  	int is64 = 0;
>  
> +	/* make sure we initialize offset */
> +	if (offset)
> +		*offset = 0;
> +
>  	to_plm = kernel_ip(to) ? X86_BR_KERNEL : X86_BR_USER;
>  	from_plm = kernel_ip(from) ? X86_BR_KERNEL : X86_BR_USER;
>  

Reviewed-by: Sandipan Das <sandipan.das@amd.com>

The following commit has been merged into the perf/core branch of tip:

Commit-ID:     117ceeb1f4f87331e45a77e71f18303d15ec882e
Gitweb:        https://git.kernel.org/tip/117ceeb1f4f87331e45a77e71f18303d15ec882e
Author:        Stephane Eranian <eranian@google.com>
AuthorDate:    Wed, 28 Sep 2022 11:40:42 -07:00
Committer:     Peter Zijlstra <peterz@infradead.org>
CommitterDate: Thu, 29 Sep 2022 12:20:56 +02:00

perf/x86/utils: Fix uninitialized var in get_branch_type()

offset is passed as a pointer and on certain call path is not set by the
function. If the caller does not re-initialize offset between calls, value
could be inherited between calls. Prevent this by initializing offset on each
call.

This impacts the code in amd_pmu_lbr_filter() which does:

   for(i=0; ...) {
       ret = get_branch_type_fused(..., &offset);
       if (offset)
          lbr_entries[i].from += offset;
   }

Fixes: df3e9612f758 ("perf/x86: Make branch classifier fusion-aware")
Signed-off-by: Stephane Eranian <eranian@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Sandipan Das <sandipan.das@amd.com>
Link: https://lore.kernel.org/r/20220928184043.408364-2-eranian@google.com
---
 arch/x86/events/utils.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/events/utils.c b/arch/x86/events/utils.c
index 5f5617a..76b1f8b 100644
--- a/arch/x86/events/utils.c
+++ b/arch/x86/events/utils.c
@@ -94,6 +94,10 @@ static int get_branch_type(unsigned long from, unsigned long to, int abort,
 	u8 buf[MAX_INSN_SIZE];
 	int is64 = 0;
 
+	/* make sure we initialize offset */
+	if (offset)
+		*offset = 0;
+
 	to_plm = kernel_ip(to) ? X86_BR_KERNEL : X86_BR_USER;
 	from_plm = kernel_ip(from) ? X86_BR_KERNEL : X86_BR_USER;