[PATCH] powerpc/perf: Fix crash with 'perf_instruction_pointer' when pmu is not set

[PATCH] powerpc/perf: Fix crash with 'perf_instruction_pointer' when pmu is not set

[Athira Rajeev]

On systems without any specific PMU driver support registered, running
perf record causes Oops.

The relevant portion from call trace:

BUG: Kernel NULL pointer dereference on read at 0x00000040
Faulting instruction address: 0xc0021f0c
Oops: Kernel access of bad area, sig: 11 [#1]
BE PAGE_SIZE=4K PREEMPT CMPCPRO
SAF3000 DIE NOTIFICATION
CPU: 0 PID: 442 Comm: null_syscall Not tainted 5.13.0-rc6-s3k-dev-01645-g7649ee3d2957 #5164
NIP:  c0021f0c LR: c00e8ad8 CTR: c00d8a5c
NIP [c0021f0c] perf_instruction_pointer+0x10/0x60
LR [c00e8ad8] perf_prepare_sample+0x344/0x674
Call Trace:
[e6775880] [c00e8810] perf_prepare_sample+0x7c/0x674 (unreliable)
[e67758c0] [c00e8e44] perf_event_output_forward+0x3c/0x94
[e6775910] [c00dea8c] __perf_event_overflow+0x74/0x14c
[e6775930] [c00dec5c] perf_swevent_hrtimer+0xf8/0x170
[e6775a40] [c008c8d0] __hrtimer_run_queues.constprop.0+0x160/0x318
[e6775a90] [c008d94c] hrtimer_interrupt+0x148/0x3b0
[e6775ae0] [c000c0c0] timer_interrupt+0xc4/0x22c
[e6775b10] [c00046f0] Decrementer_virt+0xb8/0xbc

During perf record session, perf_instruction_pointer() is called to
capture the sample ip. This function in core-book3s accesses ppmu->flags.
If a platform specific PMU driver is not registered, ppmu is set to NULL
and accessing its members results in a crash. Fix this crash by checking
if ppmu is set.

Fixes: 2ca13a4cc56c ("powerpc/perf: Use regs->nip when SIAR is zero")
[ Including stable for kernel versions 5.11 and 5.12 ]
Cc: stable@vger.kernel.org
Signed-off-by: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Reported-by: Christophe Leroy <christophe.leroy@csgroup.eu>
Tested-by: Christophe Leroy <christophe.leroy@csgroup.eu>
---
 arch/powerpc/perf/core-book3s.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 16d4d1b..5162241 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2254,7 +2254,7 @@ unsigned long perf_instruction_pointer(struct pt_regs *regs)
 	bool use_siar = regs_use_siar(regs);
 	unsigned long siar = mfspr(SPRN_SIAR);
 
-	if (ppmu->flags & PPMU_P10_DD1) {
+	if (ppmu && (ppmu->flags & PPMU_P10_DD1)) {
 		if (siar)
 			return siar;
 		else
-- 
1.8.3.1

Re: [PATCH] powerpc/perf: Fix crash with 'perf_instruction_pointer' when pmu is not set

[Michael Ellerman]

On Thu, 17 Jun 2021 13:55:06 -0400, Athira Rajeev wrote:
> On systems without any specific PMU driver support registered, running
> perf record causes Oops.
> 
> The relevant portion from call trace:
> 
> BUG: Kernel NULL pointer dereference on read at 0x00000040
> Faulting instruction address: 0xc0021f0c
> Oops: Kernel access of bad area, sig: 11 [#1]
> BE PAGE_SIZE=4K PREEMPT CMPCPRO
> SAF3000 DIE NOTIFICATION
> CPU: 0 PID: 442 Comm: null_syscall Not tainted 5.13.0-rc6-s3k-dev-01645-g7649ee3d2957 #5164
> NIP:  c0021f0c LR: c00e8ad8 CTR: c00d8a5c
> NIP [c0021f0c] perf_instruction_pointer+0x10/0x60
> LR [c00e8ad8] perf_prepare_sample+0x344/0x674
> Call Trace:
> [e6775880] [c00e8810] perf_prepare_sample+0x7c/0x674 (unreliable)
> [e67758c0] [c00e8e44] perf_event_output_forward+0x3c/0x94
> [e6775910] [c00dea8c] __perf_event_overflow+0x74/0x14c
> [e6775930] [c00dec5c] perf_swevent_hrtimer+0xf8/0x170
> [e6775a40] [c008c8d0] __hrtimer_run_queues.constprop.0+0x160/0x318
> [e6775a90] [c008d94c] hrtimer_interrupt+0x148/0x3b0
> [e6775ae0] [c000c0c0] timer_interrupt+0xc4/0x22c
> [e6775b10] [c00046f0] Decrementer_virt+0xb8/0xbc
> 
> [...]

Applied to powerpc/fixes.

[1/1] powerpc/perf: Fix crash with 'perf_instruction_pointer' when pmu is not set
      https://git.kernel.org/powerpc/c/60b7ed54a41b550d50caf7f2418db4a7e75b5bdc

cheers