/* * Range add and subtract */ #include #include #include #include #include int add_range(struct range *range, int az, int nr_range, u64 start, u64 end) { if (start >= end) return nr_range; /* Out of slots: */ if (nr_range >= az) return nr_range; range[nr_range].start = start; range[nr_range].end = end; nr_range++; return nr_range; } int add_range_with_merge(struct range *range, int az, int nr_range, u64 start, u64 end) { int i; if (start >= end) return nr_range; /* get new start/end: */ for (i = 0; i < nr_range; i++) { u64 common_start, common_end; if (!range[i].end) continue; common_start = max(range[i].start, start); common_end = min(range[i].end, end); if (common_start > common_end) continue; /* new start/end, will add it back at last */ start = min(range[i].start, start); end = max(range[i].end, end); memmove(&range[i], &range[i + 1], (nr_range - (i + 1)) * sizeof(range[i])); range[nr_range - 1].start = 0; range[nr_range - 1].end = 0; nr_range--; i--; } /* Need to add it: */ return add_range(range, az, nr_range, start, end); } void subtract_range(struct range *range, int az, u64 start, u64 end) { int i, j; if (start >= end) return; for (j = 0; j < az; j++) { if (!range[j].end) continue; if (start <= range[j].start && end >= range[j].end) { range[j].start = 0; range[j].end = 0; continue; } if (start <= range[j].start && end < range[j].end && range[j].start < end) { range[j].start = end; continue; } if (start > range[j].start && end >= range[j].end && range[j].end > start) { range[j].end = start; continue; } if (start > range[j].start && end < range[j].end) { /* Find the new spare: */ for (i = 0; i < az; i++) { if (range[i].end == 0) break; } if (i < az) { range[i].end = range[j].end; range[i].start = end; } else { pr_err("%s: run out of slot in ranges\n", __func__); } range[j].end = start; continue; } } } static int cmp_range(const void *x1, const void *x2) { const struct range *r1 = x1; const struct range *r2 = x2; if (r1->start < r2->start) return -1; if (r1->start > r2->start) return 1; return 0; } int clean_sort_range(struct range *range, int az) { int i, j, k = az - 1, nr_range = az; for (i = 0; i < k; i++) { if (range[i].end) continue; for (j = k; j > i; j--) { if (range[j].end) { k = j; break; } } if (j == i) break; range[i].start = range[k].start; range[i].end = range[k].end; range[k].start = 0; range[k].end = 0; k--; } /* count it */ for (i = 0; i < az; i++) { if (!range[i].end) { nr_range = i; break; } } /* sort them */ sort(range, nr_range, sizeof(struct range), cmp_range, NULL); return nr_range; } void sort_range(struct range *range, int nr_range) { /* sort them */ sort(range, nr_range, sizeof(struct range), cmp_range, NULL); } b/serial/whiteheat.h

diff options

author	Peter Zijlstra <peterz@infradead.org>	2017-01-26 16:39:55 +0100
committer	Ingo Molnar <mingo@kernel.org>	2017-01-30 11:41:25 +0100
commit	a76a82a3e38c8d3fb6499e3dfaeb0949241ab588 (patch)
tree	b5bc906278fe1ac66d75de984d26bf59b43b3ed8 /drivers/usb/serial/whiteheat.h
parent	566cf877a1fcb6d6dc0126b076aad062054c2637 (diff)

perf/core: Fix use-after-free bug

Dmitry reported a KASAN use-after-free on event->group_leader. It turns out there's a hole in perf_remove_from_context() due to event_function_call() not calling its function when the task associated with the event is already dead. In this case the event will have been detached from the task, but the grouping will have been retained, such that group operations might still work properly while there are live child events etc. This does however mean that we can miss a perf_group_detach() call when the group decomposes, this in turn can then lead to use-after-free. Fix it by explicitly doing the group detach if its still required. Reported-by: Dmitry Vyukov <dvyukov@google.com> Tested-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Mathieu Desnoyers <mathieu.desnoyers@efficios.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: stable@vger.kernel.org # v4.5+ Cc: syzkaller <syzkaller@googlegroups.com> Fixes: 63b6da39bb38 ("perf: Fix perf_event_exit_task() race") Link: http://lkml.kernel.org/r/20170126153955.GD6515@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org>

Diffstat (limited to 'drivers/usb/serial/whiteheat.h')