From: tip-bot for Josh Poimboeuf <tipbot@zytor.com>
To: linux-tip-commits@vger.kernel.org
Cc: eranian@google.com, linux-kernel@vger.kernel.org, hpa@zytor.com,
mingo@kernel.org, acme@redhat.com, peterz@infradead.org,
vincent.weaver@maine.edu, jolsa@redhat.com, jpoimboe@redhat.com,
tglx@linutronix.de, torvalds@linux-foundation.org,
alexander.shishkin@linux.intel.com, acme@kernel.org
Subject: [tip:perf/urgent] perf/x86: Fix 32-bit perf user callgraph collection
Date: Sun, 3 Jul 2016 01:46:43 -0700 [thread overview]
Message-ID: <tip-fc18822510721fe694d273c5211c71ea52796d76@git.kernel.org> (raw)
In-Reply-To: <1a547f5077ec30f75f9b57074837c3c80df86e5e.1467432113.git.jpoimboe@redhat.com>
Commit-ID: fc18822510721fe694d273c5211c71ea52796d76
Gitweb: http://git.kernel.org/tip/fc18822510721fe694d273c5211c71ea52796d76
Author: Josh Poimboeuf <jpoimboe@redhat.com>
AuthorDate: Fri, 1 Jul 2016 23:02:05 -0500
Committer: Ingo Molnar <mingo@kernel.org>
CommitDate: Sun, 3 Jul 2016 10:43:00 +0200
perf/x86: Fix 32-bit perf user callgraph collection
A basic perf callgraph record operation causes an immediate panic on a
32-bit kernel compiled with CONFIG_CC_STACKPROTECTOR=y:
$ perf record -g ls
Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: c0404fbd
CPU: 0 PID: 998 Comm: ls Not tainted 4.7.0-rc5+ #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.9.1-1.fc24 04/01/2014
c0dd5967 ff7afe1c 00000086 f41dbc2c c07445a0 464c457f f41dbca8 f41dbc44
c05646f4 f41dbca8 464c457f f41dbca8 464c457f f41dbc54 c04625be c0ce56fc
c0404fbd f41dbc88 c0404fbd b74668f0 f41dc000 00000000 c0000000 00000000
Call Trace:
[<c07445a0>] dump_stack+0x58/0x78
[<c05646f4>] panic+0x8e/0x1c6
[<c04625be>] __stack_chk_fail+0x1e/0x30
[<c0404fbd>] ? perf_callchain_user+0x22d/0x230
[<c0404fbd>] perf_callchain_user+0x22d/0x230
[<c055f89f>] get_perf_callchain+0x1ff/0x270
[<c055f988>] perf_callchain+0x78/0x90
[<c055c7eb>] perf_prepare_sample+0x24b/0x370
[<c055c934>] perf_event_output_forward+0x24/0x70
[<c05531c0>] __perf_event_overflow+0xa0/0x210
[<c0550a93>] ? cpu_clock_event_read+0x43/0x50
[<c0553431>] perf_swevent_hrtimer+0x101/0x180
[<c0456235>] ? kmap_atomic_prot+0x35/0x140
[<c056dc69>] ? get_page_from_freelist+0x279/0x950
[<c058fdd8>] ? vma_interval_tree_remove+0x158/0x230
[<c05939f4>] ? wp_page_copy.isra.82+0x2f4/0x630
[<c05a050d>] ? page_add_file_rmap+0x1d/0x50
[<c0565611>] ? unlock_page+0x61/0x80
[<c0566755>] ? filemap_map_pages+0x305/0x320
[<c059769f>] ? handle_mm_fault+0xb7f/0x1560
[<c074cbeb>] ? timerqueue_del+0x1b/0x70
[<c04cfefe>] ? __remove_hrtimer+0x2e/0x60
[<c04d017b>] __hrtimer_run_queues+0xcb/0x2a0
[<c0553330>] ? __perf_event_overflow+0x210/0x210
[<c04d0a2a>] hrtimer_interrupt+0x8a/0x180
[<c043ecc2>] local_apic_timer_interrupt+0x32/0x60
[<c043f643>] smp_apic_timer_interrupt+0x33/0x50
[<c0b0cd38>] apic_timer_interrupt+0x34/0x3c
Kernel Offset: disabled
---[ end Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: c0404fbd
The panic is caused by the fact that perf_callchain_user() mistakenly
assumes it's 64-bit only and ends up corrupting the stack.
Signed-off-by: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: stable@vger.kernel.org # v4.5+
Fixes: 75925e1ad7f5 ("perf/x86: Optimize stack walk user accesses")
Link: http://lkml.kernel.org/r/1a547f5077ec30f75f9b57074837c3c80df86e5e.1467432113.git.jpoimboe@redhat.com
Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
arch/x86/events/core.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/arch/x86/events/core.c b/arch/x86/events/core.c
index 33787ee..26ced53 100644
--- a/arch/x86/events/core.c
+++ b/arch/x86/events/core.c
@@ -2319,7 +2319,7 @@ void
perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs)
{
struct stack_frame frame;
- const void __user *fp;
+ const unsigned long __user *fp;
if (perf_guest_cbs && perf_guest_cbs->is_in_guest()) {
/* TODO: We don't support guest os callchain now */
@@ -2332,7 +2332,7 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
if (regs->flags & (X86_VM_MASK | PERF_EFLAGS_VM))
return;
- fp = (void __user *)regs->bp;
+ fp = (unsigned long __user *)regs->bp;
perf_callchain_store(entry, regs->ip);
@@ -2345,16 +2345,17 @@ perf_callchain_user(struct perf_callchain_entry_ctx *entry, struct pt_regs *regs
pagefault_disable();
while (entry->nr < entry->max_stack) {
unsigned long bytes;
+
frame.next_frame = NULL;
frame.return_address = 0;
- if (!access_ok(VERIFY_READ, fp, 16))
+ if (!access_ok(VERIFY_READ, fp, sizeof(*fp) * 2))
break;
- bytes = __copy_from_user_nmi(&frame.next_frame, fp, 8);
+ bytes = __copy_from_user_nmi(&frame.next_frame, fp, sizeof(*fp));
if (bytes != 0)
break;
- bytes = __copy_from_user_nmi(&frame.return_address, fp+8, 8);
+ bytes = __copy_from_user_nmi(&frame.return_address, fp + 1, sizeof(*fp));
if (bytes != 0)
break;
prev parent reply other threads:[~2016-07-03 8:47 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-07-02 4:02 [PATCH] perf/x86: fix 32-bit perf user callgraph collection Josh Poimboeuf
2016-07-03 8:46 ` tip-bot for Josh Poimboeuf [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=tip-fc18822510721fe694d273c5211c71ea52796d76@git.kernel.org \
--to=tipbot@zytor.com \
--cc=acme@kernel.org \
--cc=acme@redhat.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=eranian@google.com \
--cc=hpa@zytor.com \
--cc=jolsa@redhat.com \
--cc=jpoimboe@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-tip-commits@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=peterz@infradead.org \
--cc=tglx@linutronix.de \
--cc=torvalds@linux-foundation.org \
--cc=vincent.weaver@maine.edu \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).