From nobody Fri Apr 3 04:48:15 2026 Received: from foss.arm.com (foss.arm.com [217.140.110.172]) by smtp.subspace.kernel.org (Postfix) with ESMTP id 9A798356A13 for ; Tue, 17 Feb 2026 13:20:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=217.140.110.172 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771334403; cv=none; b=YxXQjo2CleHGsqmSJBk8SZNS9VjXHcWg1K1MzW1zXpVrfcPdpaezFUKwZlEh5+zmSkNNWPyjnkMiLM2UDjj+1UxitRheHZ+ZUwu1pjWE02VBjn7KzrYI/Q3Tm2c7KHB9F14nvKPzOaxnw3LkiqWT/YslViGdeLmaiukkQbxvSvo= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771334403; c=relaxed/simple; bh=gPxqymQQcc7AbS+KcuwCvzaL83DqtsIgMWR1FqdhBGA=; h=From:Date:Subject:MIME-Version:Content-Type:Message-Id:To:Cc; b=cx31q6ZQ6NSlI78x46d4MWF/dTRm0pYuRQfZn4EBCTJALEg7URF+Ax9DqGCtSJPLh7seBn/yLi6JLM9127xOPn6P/trbjrnVaZWJMpvMXOtpu2HTAP03s5b8GFR6RHkntkRrPbhOCeDY4TFFgdl5OxL9qnHhYAhx7uojOKFJWl4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com; spf=pass smtp.mailfrom=arm.com; arc=none smtp.client-ip=217.140.110.172 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=arm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=arm.com Received: from usa-sjc-imap-foss1.foss.arm.com (unknown [10.121.207.14]) by usa-sjc-mx-foss1.foss.arm.com (Postfix) with ESMTP id B0FC71477; Tue, 17 Feb 2026 05:19:47 -0800 (PST) Received: from e132581.arm.com (e132581.arm.com [10.1.196.87]) by usa-sjc-imap-foss1.foss.arm.com (Postfix) with ESMTPSA id 400D93F632; Tue, 17 Feb 2026 05:19:52 -0800 (PST) From: Leo Yan Date: Tue, 17 Feb 2026 13:19:43 +0000 Subject: [PATCH] coresight: tmc: Fix overflow when calculating is bigger than 2GiB Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Message-Id: <20260217-arm_coresight_fix_big_buffer_size-v1-1-774e893d8e3f@arm.com> X-B4-Tracking: v=1; b=H4sIAO5qlGkC/x2NywqDMBAAf0X23ICJxdevFFmibuIefLCrIhX/v aHHgWHmBiVhUmizG4ROVl6XBPaVwTD5JZLhMTG43JW5s5XxMuOwCinHacfAF/YcsT9CIEHlLxl f+7d1TV2UzQipswkl7f/4dM/zA49b5TtzAAAA X-Change-ID: 20260217-arm_coresight_fix_big_buffer_size-a8a41298369d To: Suzuki K Poulose , Mike Leach , James Clark , Mathieu Poirier , Greg Kroah-Hartman , Junhao He Cc: coresight@lists.linaro.org, linux-arm-kernel@lists.infradead.org, linux-kernel@vger.kernel.org, Michiel van Tol , Leo Yan X-Mailer: b4 0.14.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1771334392; l=2289; i=leo.yan@arm.com; s=20250604; h=from:subject:message-id; bh=gPxqymQQcc7AbS+KcuwCvzaL83DqtsIgMWR1FqdhBGA=; b=Oy9iM9uga+INKGsCTo0PDQ/ufp8IzfW2fLNBcxl2TcglCpZp05+KgSJ0kHdY1JPnMZwyIqOIA jymeSHOctMDDdcg9iA6O1QfHq6lHjzGu9PDLkjgO2KyHbxiFRjFN2JR X-Developer-Key: i=leo.yan@arm.com; a=ed25519; pk=k4BaDbvkCXzBFA7Nw184KHGP5thju8lKqJYIrOWxDhI= When specifying a 2GB AUX buffer, the ETR driver ends up allocating only a 1MB buffer instead: # echo 'file coresight-tmc-etr.c +p' > \ /sys/kernel/debug/dynamic_debug/control # perf record -e cs_etm/@tmc_etr0,timestamp=3D0/u -C 0 -m ,2G -- test coresight tmc_etr0: allocated buffer of size 1024KB in mode 0 The page index is an 'int' type, and shifting it by PAGE_SHIFT overflows when the resulting value exceeds 2GB. This produces a negative value, causing the driver to fall back to the minimum buffer size (1MB). Cast the page index to a wider type to accommodate large buffer sizes. Also fix a similar issue in the buffer offset calculation. Reported-by: Michiel van Tol Fixes: 99443ea19e8b ("coresight: Add generic TMC sg table framework") Fixes: eebe8dbd8630 ("coresight: tmc: Decouple the perf buffer allocation f= rom sysfs mode") Signed-off-by: Leo Yan --- drivers/hwtracing/coresight/coresight-tmc-etr.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/drivers/hwtr= acing/coresight/coresight-tmc-etr.c index cee82e52c4ea96b035f1db71b2d9a006bfc1c51e..990bbb721e1d712d7b93f1e3608= 7fdaf9d3baa3b 100644 --- a/drivers/hwtracing/coresight/coresight-tmc-etr.c +++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c @@ -154,7 +154,7 @@ tmc_pages_get_offset(struct tmc_pages *tmc_pages, dma_a= ddr_t addr) for (i =3D 0; i < tmc_pages->nr_pages; i++) { page_start =3D tmc_pages->daddrs[i]; if (addr >=3D page_start && addr < (page_start + PAGE_SIZE)) - return i * PAGE_SIZE + (addr - page_start); + return (long)i * PAGE_SIZE + (addr - page_start); } =20 return -EINVAL; @@ -1381,7 +1381,7 @@ alloc_etr_buf(struct tmc_drvdata *drvdata, struct per= f_event *event, node =3D (event->cpu =3D=3D -1) ? NUMA_NO_NODE : cpu_to_node(event->cpu); =20 /* Use the minimum limit if the required size is smaller */ - size =3D nr_pages << PAGE_SHIFT; + size =3D (ssize_t)nr_pages << PAGE_SHIFT; size =3D max_t(ssize_t, size, TMC_ETR_PERF_MIN_BUF_SIZE); =20 /* --- base-commit: eebe8dbd8630f51cf70b1f68a440cd3d7f7a914d change-id: 20260217-arm_coresight_fix_big_buffer_size-a8a41298369d Best regards, --=20 Leo Yan