From: Philippe Elie <phil.el@wanadoo.fr>
Instruction pointer returned by profile_pc() can be a random value. This

break the assumption than we can safely set struct op_sample.eip field to

a magic value to signal to the per-cpu buffer reader side special event

like task switch ending up in a segfault in get_task_mm() when profile_pc()

return ~0UL. Fixed by sanitizing the sampled eip and reject/log invalid eip.
Problem reported by Sami Farin, patch tested by him.
Signed-off-by: Philippe Elie <phil.el@wanadoo.fr>
---
 drivers/oprofile/cpu_buffer.c     |    7 +++++++

 drivers/oprofile/cpu_buffer.h     |    1 +

 drivers/oprofile/oprofile_stats.c |    4 ++++

 3 files changed, 12 insertions(+), 0 deletions(-)
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c

index a83c3db..c93d3d2 100644

--- a/drivers/oprofile/cpu_buffer.c

+++ b/drivers/oprofile/cpu_buffer.c

@@ -64,6 +64,8 @@ int alloc_cpu_buffers(void)

 		b->head_pos = 0;

 		b->sample_received = 0;

 		b->sample_lost_overflow = 0;

+		b->backtrace_aborted = 0;

+		b->sample_invalid_eip = 0;

 		b->cpu = i;

 		INIT_DELAYED_WORK(&b->work, wq_sync_buffer);

 	}

@@ -175,6 +177,11 @@ static int log_sample(struct oprofile_cpu_buffer * cpu_buf, unsigned long pc,
 	cpu_buf->sample_received++;
+	if (pc == ESCAPE_CODE) {

+		cpu_buf->sample_invalid_eip++;

+		return 0;

+	}

+

 	if (nr_available_slots(cpu_buf) < 3) {

 		cpu_buf->sample_lost_overflow++;

 		return 0;

diff --git a/drivers/oprofile/cpu_buffer.h b/drivers/oprofile/cpu_buffer.h

index 49900d9..c66c025 100644

--- a/drivers/oprofile/cpu_buffer.h

+++ b/drivers/oprofile/cpu_buffer.h

@@ -42,6 +42,7 @@ struct oprofile_cpu_buffer {

 	unsigned long sample_received;

 	unsigned long sample_lost_overflow;

 	unsigned long backtrace_aborted;

+	unsigned long sample_invalid_eip;

 	int cpu;

 	struct delayed_work work;

 } ____cacheline_aligned;

diff --git a/drivers/oprofile/oprofile_stats.c b/drivers/oprofi...
[ message continues ]