Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1537562

[PATCH 4.8 30/35] perf/x86: Restore TASK_SIZE check on frame pointer

From Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups linux.kernel
Subject [PATCH 4.8 30/35] perf/x86: Restore TASK_SIZE check on frame pointer
Date 2016-12-07 08:20 +0100
Message-ID <sLEGe-5pa-25@gated-at.bofh.it> (permalink)
References <sLEwx-5hv-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

4.8-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Johannes Weiner <hannes@cmpxchg.org>

commit ae31fe51a3cceaa0cabdb3058f69669ecb47f12e upstream.

The following commit:

  75925e1ad7f5 ("perf/x86: Optimize stack walk user accesses")

... switched from copy_from_user_nmi() to __copy_from_user_nmi() with a manual
access_ok() check.

Unfortunately, copy_from_user_nmi() does an explicit check against TASK_SIZE,
whereas the access_ok() uses whatever the current address limit of the task is.

We are getting NMIs when __probe_kernel_read() has switched to KERNEL_DS, and
then see vmalloc faults when we access what looks like pointers into vmalloc
space:

  [] WARNING: CPU: 3 PID: 3685731 at arch/x86/mm/fault.c:435 vmalloc_fault+0x289/0x290
  [] CPU: 3 PID: 3685731 Comm: sh Tainted: G        W       4.6.0-5_fbk1_223_gdbf0f40 #1
  [] Call Trace:
  []  <NMI>  [<ffffffff814717d1>] dump_stack+0x4d/0x6c
  []  [<ffffffff81076e43>] __warn+0xd3/0xf0
  []  [<ffffffff81076f2d>] warn_slowpath_null+0x1d/0x20
  []  [<ffffffff8104a899>] vmalloc_fault+0x289/0x290
  []  [<ffffffff8104b5a0>] __do_page_fault+0x330/0x490
  []  [<ffffffff8104b70c>] do_page_fault+0xc/0x10
  []  [<ffffffff81794e82>] page_fault+0x22/0x30
  []  [<ffffffff81006280>] ? perf_callchain_user+0x100/0x2a0
  []  [<ffffffff8115124f>] get_perf_callchain+0x17f/0x190
  []  [<ffffffff811512c7>] perf_callchain+0x67/0x80
  []  [<ffffffff8114e750>] perf_prepare_sample+0x2a0/0x370
  []  [<ffffffff8114e840>] perf_event_output+0x20/0x60
  []  [<ffffffff8114aee7>] ? perf_event_update_userpage+0xc7/0x130
  []  [<ffffffff8114ea01>] __perf_event_overflow+0x181/0x1d0
  []  [<ffffffff8114f484>] perf_event_overflow+0x14/0x20
  []  [<ffffffff8100a6e3>] intel_pmu_handle_irq+0x1d3/0x490
  []  [<ffffffff8147daf7>] ? copy_user_enhanced_fast_string+0x7/0x10
  []  [<ffffffff81197191>] ? vunmap_page_range+0x1a1/0x2f0
  []  [<ffffffff811972f1>] ? unmap_kernel_range_noflush+0x11/0x20
  []  [<ffffffff814f2056>] ? ghes_copy_tofrom_phys+0x116/0x1f0
  []  [<ffffffff81040d1d>] ? x2apic_send_IPI_self+0x1d/0x20
  []  [<ffffffff8100411d>] perf_event_nmi_handler+0x2d/0x50
  []  [<ffffffff8101ea31>] nmi_handle+0x61/0x110
  []  [<ffffffff8101ef94>] default_do_nmi+0x44/0x110
  []  [<ffffffff8101f13b>] do_nmi+0xdb/0x150
  []  [<ffffffff81795187>] end_repeat_nmi+0x1a/0x1e
  []  [<ffffffff8147daf7>] ? copy_user_enhanced_fast_string+0x7/0x10
  []  [<ffffffff8147daf7>] ? copy_user_enhanced_fast_string+0x7/0x10
  []  [<ffffffff8147daf7>] ? copy_user_enhanced_fast_string+0x7/0x10
  []  <<EOE>>  <IRQ>  [<ffffffff8115d05e>] ? __probe_kernel_read+0x3e/0xa0

Fix this by moving the valid_user_frame() check to before the uaccess
that loads the return address and the pointer to the next frame.

Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: linux-kernel@vger.kernel.org
Fixes: 75925e1ad7f5 ("perf/x86: Optimize stack walk user accesses")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 arch/x86/events/core.c |   10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2344,7 +2344,7 @@ perf_callchain_user32(struct pt_regs *re
 		frame.next_frame     = 0;
 		frame.return_address = 0;
 
-		if (!access_ok(VERIFY_READ, fp, 8))
+		if (!valid_user_frame(fp, sizeof(frame)))
 			break;
 
 		bytes = __copy_from_user_nmi(&frame.next_frame, fp, 4);
@@ -2354,9 +2354,6 @@ perf_callchain_user32(struct pt_regs *re
 		if (bytes != 0)
 			break;
 
-		if (!valid_user_frame(fp, sizeof(frame)))
-			break;
-
 		perf_callchain_store(entry, cs_base + frame.return_address);
 		fp = compat_ptr(ss_base + frame.next_frame);
 	}
@@ -2405,7 +2402,7 @@ perf_callchain_user(struct perf_callchai
 		frame.next_frame	     = NULL;
 		frame.return_address = 0;
 
-		if (!access_ok(VERIFY_READ, fp, sizeof(*fp) * 2))
+		if (!valid_user_frame(fp, sizeof(frame)))
 			break;
 
 		bytes = __copy_from_user_nmi(&frame.next_frame, fp, sizeof(*fp));
@@ -2415,9 +2412,6 @@ perf_callchain_user(struct perf_callchai
 		if (bytes != 0)
 			break;
 
-		if (!valid_user_frame(fp, sizeof(frame)))
-			break;
-
 		perf_callchain_store(entry, frame.return_address);
 		fp = (void __user *)frame.next_frame;
 	}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.8 00/35] 4.8.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 16/35] PCI: Export pcie_find_root_port Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 11/35] ovl: fix d_real() for stacked fs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 01/35] libata-scsi: Fixup ata_gen_passthru_sense() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 25/35] drm/radeon: fix check for port PM availability Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 14/35] rcu: Fix soft lockup for rcu_nocb_kthread Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 21/35] drm/i915: drop the struct_mutex when wedged or trying to reset Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 02/35] scsi: hpsa: use bus 3 for legacy HBA devices Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 23/35] drm/radeon: fix power state when port pm is unavailable (v2) Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 26/35] arm64: dts: juno: fix cluster sleep state entry latency on all SoC versions Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:10 +0100
  [PATCH 4.8 07/35] thp: fix corner case of munlock() of PTE-mapped THPs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 10/35] mm: fix false-positive WARN_ON() in truncate/invalidate for hugetlb Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 29/35] drm/mediatek: fix null pointer dereference Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 08/35] zram: fix unbalanced idr management at hot removal Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 35/35] arm64: suspend: Reconfigure PSTATE after resume from idle Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 34/35] arm64: mm: Set PSTATE.PAN from the cpu_enable_pan() call Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 04/35] ARC: mm: PAE40: Fix crash at munmap Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 24/35] drm/amdgpu: fix check for port PM availability Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 20/35] drm/i915: Dont touch NULL sg on i915_gem_object_get_pages_gtt() error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 05/35] ARC: Dont use "+l" inline asm constraint Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 12/35] Input: change KEY_DATA from 0x275 to 0x277 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 30/35] perf/x86: Restore TASK_SIZE check on frame pointer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 28/35] pwm: Fix device reference leak Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 03/35] scsi: libfc: fix seconds_since_last_reset miscalculation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 32/35] batman-adv: Detect missing primaryif during tp_send as error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 33/35] arm64: cpufeature: Schedule enable() calls instead of calling them via IPI Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  [PATCH 4.8 09/35] kasan: update kasan_global for gcc 7 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-07 08:20 +0100
  Re: [PATCH 4.8 00/35] 4.8.13-stable review Guenter Roeck <linux@roeck-us.net> - 2016-12-07 17:10 +0100
    Re: [PATCH 4.8 00/35] 4.8.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-08 17:30 +0100
  Re: [PATCH 4.8 00/35] 4.8.13-stable review Shuah Khan <shuah.kh@samsung.com> - 2016-12-07 19:20 +0100
    Re: [PATCH 4.8 00/35] 4.8.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-08 17:30 +0100
  Re: [PATCH 4.8 00/35] 4.8.13-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-12-08 17:30 +0100

csiph-web