[PATCH] trace: Fix check for trace_percpu_buffer validity in get_trace_buf()

[PATCH] trace: Fix check for trace_percpu_buffer validity in get_trace_buf()

[Naveen N. Rao]

With the new osnoise tracer, we are seeing the below splat:
    Kernel attempted to read user page (c7d880000) - exploit attempt? (uid: 0)
    BUG: Unable to handle kernel data access on read at 0xc7d880000
    Faulting instruction address: 0xc0000000002ffa10
    Oops: Kernel access of bad area, sig: 11 [#1]
    LE PAGE_SIZE=64K MMU=Radix SMP NR_CPUS=2048 NUMA pSeries
    ...
    NIP [c0000000002ffa10] __trace_array_vprintk.part.0+0x70/0x2f0
    LR [c0000000002ff9fc] __trace_array_vprintk.part.0+0x5c/0x2f0
    Call Trace:
    [c0000008bdd73b80] [c0000000001c49cc] put_prev_task_fair+0x3c/0x60 (unreliable)
    [c0000008bdd73be0] [c000000000301430] trace_array_printk_buf+0x70/0x90
    [c0000008bdd73c00] [c0000000003178b0] trace_sched_switch_callback+0x250/0x290
    [c0000008bdd73c90] [c000000000e70d60] __schedule+0x410/0x710
    [c0000008bdd73d40] [c000000000e710c0] schedule+0x60/0x130
    [c0000008bdd73d70] [c000000000030614] interrupt_exit_user_prepare_main+0x264/0x270
    [c0000008bdd73de0] [c000000000030a70] syscall_exit_prepare+0x150/0x180
    [c0000008bdd73e10] [c00000000000c174] system_call_vectored_common+0xf4/0x278

osnoise tracer on ppc64le is triggering osnoise_taint() for negative
duration in get_int_safe_duration() called from
trace_sched_switch_callback()->thread_exit().

The problem though is that the check for a valid trace_percpu_buffer is
incorrect in get_trace_buf(). The check is being done after calculating
the pointer for the current cpu, rather than on the main percpu pointer.
Fix the check to be against trace_percpu_buffer. Also tag
trace_percpu_buffer as a percpu pointer.

Fixes: e2ace001176dc9 ("tracing: Choose static tp_printk buffer by explicit nesting count")
Cc: stable@vger.kernel.org
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
---
 kernel/trace/trace.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 88de94da596b13..6a8bf33c413c99 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -3207,7 +3207,7 @@ struct trace_buffer_struct {
 	char buffer[4][TRACE_BUF_SIZE];
 };
 
-static struct trace_buffer_struct *trace_percpu_buffer;
+static struct trace_buffer_struct __percpu *trace_percpu_buffer;
 
 /*
  * This allows for lockless recording.  If we're nested too deeply, then
@@ -3217,7 +3217,7 @@ static char *get_trace_buf(void)
 {
 	struct trace_buffer_struct *buffer = this_cpu_ptr(trace_percpu_buffer);
 
-	if (!buffer || buffer->nesting >= 4)
+	if (!trace_percpu_buffer || buffer->nesting >= 4)
 		return NULL;
 
 	buffer->nesting++;

base-commit: f7f0bb5eaecb1aff9cc8ab13425d43690b71ec44
-- 
2.34.1

Re: [PATCH] trace: Fix check for trace_percpu_buffer validity in get_trace_buf()

[kernel test robot]

Hi "Naveen,

I love your patch! Perhaps something to improve:

[auto build test WARNING on f7f0bb5eaecb1aff9cc8ab13425d43690b71ec44]

url:    https://github.com/0day-ci/linux/commits/Naveen-N-Rao/trace-Fix-check-for-trace_percpu_buffer-validity-in-get_trace_buf/20211222-002823
base:   f7f0bb5eaecb1aff9cc8ab13425d43690b71ec44
config: x86_64-randconfig-s021-20211219 (https://download.01.org/0day-ci/archive/20211222/202112220904.4XhObpcQ-lkp@intel.com/config)
compiler: gcc-9 (Debian 9.3.0-22) 9.3.0
reproduce:
        # apt-get install sparse
        # sparse version: v0.6.4-dirty
        # https://github.com/0day-ci/linux/commit/95971333cdb4ace06eb41bd7ca1dee65f77487d2
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Naveen-N-Rao/trace-Fix-check-for-trace_percpu_buffer-validity-in-get_trace_buf/20211222-002823
        git checkout 95971333cdb4ace06eb41bd7ca1dee65f77487d2
        # save the config file to linux build tree
        mkdir build_dir
        make W=1 C=1 CF='-fdiagnostic-prefix -D__CHECK_ENDIAN__' O=build_dir ARCH=x86_64 SHELL=/bin/bash kernel/trace/

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>


sparse warnings: (new ones prefixed by >>)
   kernel/trace/trace.c:392:28: sparse: sparse: incorrect type in argument 1 (different address spaces) @@     expected struct trace_export **list @@     got struct trace_export [noderef] __rcu ** @@
   kernel/trace/trace.c:392:28: sparse:     expected struct trace_export **list
   kernel/trace/trace.c:392:28: sparse:     got struct trace_export [noderef] __rcu **
   kernel/trace/trace.c:406:33: sparse: sparse: incorrect type in argument 1 (different address spaces) @@     expected struct trace_export **list @@     got struct trace_export [noderef] __rcu ** @@
   kernel/trace/trace.c:406:33: sparse:     expected struct trace_export **list
   kernel/trace/trace.c:406:33: sparse:     got struct trace_export [noderef] __rcu **
   kernel/trace/trace.c:2836:38: sparse: sparse: incorrect type in argument 1 (different address spaces) @@     expected struct event_filter *filter @@     got struct event_filter [noderef] __rcu *filter @@
   kernel/trace/trace.c:2836:38: sparse:     expected struct event_filter *filter
   kernel/trace/trace.c:2836:38: sparse:     got struct event_filter [noderef] __rcu *filter
   kernel/trace/trace.c:3244:17: sparse: sparse: incorrect type in assignment (different address spaces) @@     expected struct trace_buffer_struct *buffers @@     got struct trace_buffer_struct [noderef] __percpu * @@
   kernel/trace/trace.c:3244:17: sparse:     expected struct trace_buffer_struct *buffers
   kernel/trace/trace.c:3244:17: sparse:     got struct trace_buffer_struct [noderef] __percpu *
>> kernel/trace/trace.c:3248:29: sparse: sparse: incorrect type in assignment (different address spaces) @@     expected struct trace_buffer_struct [noderef] __percpu *static [toplevel] trace_percpu_buffer @@     got struct trace_buffer_struct *buffers @@
   kernel/trace/trace.c:3248:29: sparse:     expected struct trace_buffer_struct [noderef] __percpu *static [toplevel] trace_percpu_buffer
   kernel/trace/trace.c:3248:29: sparse:     got struct trace_buffer_struct *buffers
   kernel/trace/trace.c:346:9: sparse: sparse: incompatible types in comparison expression (different address spaces):
   kernel/trace/trace.c:346:9: sparse:    struct trace_export [noderef] __rcu *
   kernel/trace/trace.c:346:9: sparse:    struct trace_export *
   kernel/trace/trace.c:361:9: sparse: sparse: incompatible types in comparison expression (different address spaces):
   kernel/trace/trace.c:361:9: sparse:    struct trace_export [noderef] __rcu *
   kernel/trace/trace.c:361:9: sparse:    struct trace_export *

vim +3248 kernel/trace/trace.c

07d777fe8c3985 Steven Rostedt          2011-09-22  3236  
07d777fe8c3985 Steven Rostedt          2011-09-22  3237  static int alloc_percpu_trace_buffer(void)
07d777fe8c3985 Steven Rostedt          2011-09-22  3238  {
07d777fe8c3985 Steven Rostedt          2011-09-22  3239  	struct trace_buffer_struct *buffers;
07d777fe8c3985 Steven Rostedt          2011-09-22  3240  
38ce2a9e33db61 Steven Rostedt (VMware  2020-08-06  3241) 	if (trace_percpu_buffer)
38ce2a9e33db61 Steven Rostedt (VMware  2020-08-06  3242) 		return 0;
38ce2a9e33db61 Steven Rostedt (VMware  2020-08-06  3243) 
07d777fe8c3985 Steven Rostedt          2011-09-22  3244  	buffers = alloc_percpu(struct trace_buffer_struct);
24589e3a20876d Steven Rostedt (VMware  2020-01-25  3245) 	if (MEM_FAIL(!buffers, "Could not allocate percpu trace_printk buffer"))
e2ace001176dc9 Andy Lutomirski         2016-05-26  3246  		return -ENOMEM;
07d777fe8c3985 Steven Rostedt          2011-09-22  3247  
07d777fe8c3985 Steven Rostedt          2011-09-22 @3248  	trace_percpu_buffer = buffers;
07d777fe8c3985 Steven Rostedt          2011-09-22  3249  	return 0;
07d777fe8c3985 Steven Rostedt          2011-09-22  3250  }
07d777fe8c3985 Steven Rostedt          2011-09-22  3251  

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org