mirror of
https://github.com/torvalds/linux.git
synced 2026-05-29 17:43:52 +02:00
e9bbfb4bfa
It may happen that mm is already released, which leads to kernel panic. This adds the NULL check for current->mm, similarly to commit20afc60f89("x86, perf: Check that current->mm is alive before getting user callchain"). I was getting this panic when running a profiling BPF program (profile.py from bcc-tools): [26215.051935] Kernel attempted to read user page (588) - exploit attempt? (uid: 0) [26215.051950] BUG: Kernel NULL pointer dereference on read at 0x00000588 [26215.051952] Faulting instruction address: 0xc00000000020fac0 [26215.051957] Oops: Kernel access of bad area, sig: 11 [#1] [...] [26215.052049] Call Trace: [26215.052050] [c000000061da6d30] [c00000000020fc10] perf_callchain_user_64+0x2d0/0x490 (unreliable) [26215.052054] [c000000061da6dc0] [c00000000020f92c] perf_callchain_user+0x1c/0x30 [26215.052057] [c000000061da6de0] [c0000000005ab2a0] get_perf_callchain+0x100/0x360 [26215.052063] [c000000061da6e70] [c000000000573bc8] bpf_get_stackid+0x88/0xf0 [26215.052067] [c000000061da6ea0] [c008000000042258] bpf_prog_16d4ab9ab662f669_do_perf_event+0xf8/0x274 [...] In addition, move storing the top-level stack entry to generic perf_callchain_user to make sure the top-evel entry is always captured, even if current->mm is NULL. Fixes:20002ded4d("perf_counter: powerpc: Add callchain support") Signed-off-by: Viktor Malik <vmalik@redhat.com> Tested-by: Qiao Zhao <qzhao@redhat.com> Tested-by: Venkat Rao Bagalkote <venkat88@linux.ibm.com> Reviewed-by: Saket Kumar Bhaskar <skb99@linux.ibm.com> [Maddy: fixed message to avoid checkpatch format style error] Signed-off-by: Madhavan Srinivasan <maddy@linux.ibm.com> Link: https://patch.msgid.link/20260309144045.169427-1-vmalik@redhat.com
116 lines
2.8 KiB
C
116 lines
2.8 KiB
C
// SPDX-License-Identifier: GPL-2.0-or-later
|
|
/*
|
|
* Performance counter callchain support - powerpc architecture code
|
|
*
|
|
* Copyright © 2009 Paul Mackerras, IBM Corporation.
|
|
*/
|
|
#include <linux/kernel.h>
|
|
#include <linux/sched.h>
|
|
#include <linux/perf_event.h>
|
|
#include <linux/percpu.h>
|
|
#include <linux/uaccess.h>
|
|
#include <linux/mm.h>
|
|
#include <asm/ptrace.h>
|
|
#include <asm/sigcontext.h>
|
|
#include <asm/ucontext.h>
|
|
#include <asm/vdso.h>
|
|
#include <asm/pte-walk.h>
|
|
|
|
#include "callchain.h"
|
|
|
|
/*
|
|
* Is sp valid as the address of the next kernel stack frame after prev_sp?
|
|
* The next frame may be in a different stack area but should not go
|
|
* back down in the same stack area.
|
|
*/
|
|
static int valid_next_sp(unsigned long sp, unsigned long prev_sp)
|
|
{
|
|
if (sp & 0xf)
|
|
return 0; /* must be 16-byte aligned */
|
|
if (!validate_sp(sp, current))
|
|
return 0;
|
|
if (sp >= prev_sp + STACK_FRAME_MIN_SIZE)
|
|
return 1;
|
|
/*
|
|
* sp could decrease when we jump off an interrupt stack
|
|
* back to the regular process stack.
|
|
*/
|
|
if ((sp & ~(THREAD_SIZE - 1)) != (prev_sp & ~(THREAD_SIZE - 1)))
|
|
return 1;
|
|
return 0;
|
|
}
|
|
|
|
void __no_sanitize_address
|
|
perf_callchain_kernel(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
|
|
{
|
|
unsigned long sp, next_sp;
|
|
unsigned long next_ip;
|
|
unsigned long lr;
|
|
long level = 0;
|
|
unsigned long *fp;
|
|
|
|
lr = regs->link;
|
|
sp = regs->gpr[1];
|
|
perf_callchain_store(entry, perf_arch_instruction_pointer(regs));
|
|
|
|
if (!validate_sp(sp, current))
|
|
return;
|
|
|
|
for (;;) {
|
|
fp = (unsigned long *) sp;
|
|
next_sp = fp[0];
|
|
|
|
if (next_sp == sp + STACK_INT_FRAME_SIZE &&
|
|
validate_sp_size(sp, current, STACK_INT_FRAME_SIZE) &&
|
|
fp[STACK_INT_FRAME_MARKER_LONGS] == STACK_FRAME_REGS_MARKER) {
|
|
/*
|
|
* This looks like an interrupt frame for an
|
|
* interrupt that occurred in the kernel
|
|
*/
|
|
regs = (struct pt_regs *)(sp + STACK_INT_FRAME_REGS);
|
|
next_ip = regs->nip;
|
|
lr = regs->link;
|
|
level = 0;
|
|
perf_callchain_store_context(entry, PERF_CONTEXT_KERNEL);
|
|
|
|
} else {
|
|
if (level == 0)
|
|
next_ip = lr;
|
|
else
|
|
next_ip = fp[STACK_FRAME_LR_SAVE];
|
|
|
|
/*
|
|
* We can't tell which of the first two addresses
|
|
* we get are valid, but we can filter out the
|
|
* obviously bogus ones here. We replace them
|
|
* with 0 rather than removing them entirely so
|
|
* that userspace can tell which is which.
|
|
*/
|
|
if ((level == 1 && next_ip == lr) ||
|
|
(level <= 1 && !kernel_text_address(next_ip)))
|
|
next_ip = 0;
|
|
|
|
++level;
|
|
}
|
|
|
|
perf_callchain_store(entry, next_ip);
|
|
if (!valid_next_sp(next_sp, sp))
|
|
return;
|
|
sp = next_sp;
|
|
}
|
|
}
|
|
|
|
void
|
|
perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
|
|
{
|
|
perf_callchain_store(entry, perf_arch_instruction_pointer(regs));
|
|
|
|
if (!current->mm)
|
|
return;
|
|
|
|
if (!is_32bit_task())
|
|
perf_callchain_user_64(entry, regs);
|
|
else
|
|
perf_callchain_user_32(entry, regs);
|
|
}
|