[PATCH] coresight: ETR: Fix ETR buffer use-after-free issue

[Suzuki K Poulose]

On 20/10/2025 11:18, Jie Gan wrote:
> 
> 
> On 10/20/2025 5:06 PM, Xiaoqi Zhuang wrote:
>> When ETR is enabled as CS_MODE_SYSFS, if the buffer size is changed
>> and enabled again, currently sysfs_buf will point to the newly
>> allocated memory(buf_new) and free the old memory(buf_old). But the
>> etr_buf that is being used by the ETR remains pointed to buf_old, not
>> updated to buf_new. In this case, it will result in a memory
>> use-after-free issue.
>>
>> Fix this by checking ETR's mode before updating and releasing buf_old,
>> if the mode is CS_MODE_SYSFS, then skip updating and releasing it.
>>
> 
> I think we need a fix tag for the fix patch:
> Fixes: de5461970b3e ("coresight: tmc: allocating memory when needed")
> 
> minor comment:
> Since ETR is enabled, we can't switch the sysfs buffer, can we exit 
> earlier by checking the CS_MODE to avoid allocating memory unnecessarily?

+1

Something like this:

diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c 
b/drivers/hwtracing/coresight/coresight-tmc-etr.c
index b07fcdb3fe1a..a9ddb05c10d9 100644
--- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
+++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
@@ -1252,6 +1252,12 @@ static struct etr_buf 
*tmc_etr_get_sysfs_buffer(struct coresight_device *csdev)
         raw_spin_lock_irqsave(&drvdata->spinlock, flags);
         sysfs_buf = READ_ONCE(drvdata->sysfs_buf);
         if (!sysfs_buf || (sysfs_buf->size != drvdata->size)) {
+               /*
+                * If the ETR is already enabled, continue with the existing
+                * buffer.
+                */
+               if (coresight_get_mode(csdev) == CS_MODE_SYSFS)
+                       goto out;
                 raw_spin_unlock_irqrestore(&drvdata->spinlock, flags);

                 /* Allocate memory with the locks released */

Suzuki>
> Besides,
> Looks good to me.
> 
> Thanks,
> Jie
> 
>> Signed-off-by: Xiaoqi Zhuang <xiaoqi.zhuang at oss.qualcomm.com>
>> ---
>>   drivers/hwtracing/coresight/coresight-tmc-etr.c | 7 +++++++
>>   1 file changed, 7 insertions(+)
>>
>> diff --git a/drivers/hwtracing/coresight/coresight-tmc-etr.c b/ 
>> drivers/hwtracing/coresight/coresight-tmc-etr.c
>> index b07fcdb3fe1a..3e73cf2c38a3 100644
>> --- a/drivers/hwtracing/coresight/coresight-tmc-etr.c
>> +++ b/drivers/hwtracing/coresight/coresight-tmc-etr.c
>> @@ -1268,6 +1268,13 @@ static struct etr_buf 
>> *tmc_etr_get_sysfs_buffer(struct coresight_device *csdev)
>>           goto out;
>>       }
>> +    /*
>> +     * Since this sink is already enabled, the existing buffer should 
>> not
>> +     * be released even if the buffer size has changed.
>> +     */
>> +    if (coresight_get_mode(csdev) == CS_MODE_SYSFS)
>> +        goto out;
>> +
>>       /*
>>        * If we don't have a buffer or it doesn't match the requested 
>> size,
>>        * use the buffer allocated above. Otherwise reuse the existing 
>> buffer.
>>
>> ---
>> base-commit: 98ac9cc4b4452ed7e714eddc8c90ac4ae5da1a09
>> change-id: 20251020-fix_etr_issue-02c706dbc899
>>
>> Best regards,
>