Stable Archive on lore.kernel.org
 help / color / Atom feed
From: Sasha Levin <sashal@kernel.org>
To: linux-kernel@vger.kernel.org, stable@vger.kernel.org
Cc: Mao Han <han_mao@linux.alibaba.com>,
	Guo Ren <guoren@linux.alibaba.com>,
	Sasha Levin <sashal@kernel.org>
Subject: [PATCH AUTOSEL 5.4 26/32] csky: Fixup perf callchain unwind
Date: Fri, 22 May 2020 10:50:38 -0400
Message-ID: <20200522145044.434677-26-sashal@kernel.org> (raw)
In-Reply-To: <20200522145044.434677-1-sashal@kernel.org>

From: Mao Han <han_mao@linux.alibaba.com>

[ Upstream commit 229a0ddee1108a3f82a873e6cbbe35c92c540444 ]

 [ 5221.974084] Unable to handle kernel paging request at virtual address 0xfffff000, pc: 0x8002c18e
 [ 5221.985929] Oops: 00000000
 [ 5221.989488]
 [ 5221.989488] CURRENT PROCESS:
 [ 5221.989488]
 [ 5221.992877] COMM=callchain_test PID=11962
 [ 5221.995213] TEXT=00008000-000087e0 DATA=00009f1c-0000a018 BSS=0000a018-0000b000
 [ 5221.999037] USER-STACK=7fc18e20  KERNEL-STACK=be204680
 [ 5221.999037]
 [ 5222.003292] PC: 0x8002c18e (perf_callchain_kernel+0x3e/0xd4)
 [ 5222.007957] LR: 0x8002c198 (perf_callchain_kernel+0x48/0xd4)
 [ 5222.074873] Call Trace:
 [ 5222.074873] [<800a248e>] get_perf_callchain+0x20a/0x29c
 [ 5222.074873] [<8009d964>] perf_callchain+0x64/0x80
 [ 5222.074873] [<8009dc1c>] perf_prepare_sample+0x29c/0x4b8
 [ 5222.074873] [<8009de6e>] perf_event_output_forward+0x36/0x98
 [ 5222.074873] [<800497e0>] search_exception_tables+0x20/0x44
 [ 5222.074873] [<8002cbb6>] do_page_fault+0x92/0x378
 [ 5222.074873] [<80098608>] __perf_event_overflow+0x54/0xdc
 [ 5222.074873] [<80098778>] perf_swevent_hrtimer+0xe8/0x164
 [ 5222.074873] [<8002ddd0>] update_mmu_cache+0x0/0xd8
 [ 5222.074873] [<8002c014>] user_backtrace+0x58/0xc4
 [ 5222.074873] [<8002c0b4>] perf_callchain_user+0x34/0xd0
 [ 5222.074873] [<800a2442>] get_perf_callchain+0x1be/0x29c
 [ 5222.074873] [<8009d964>] perf_callchain+0x64/0x80
 [ 5222.074873] [<8009d834>] perf_output_sample+0x78c/0x858
 [ 5222.074873] [<8009dc1c>] perf_prepare_sample+0x29c/0x4b8
 [ 5222.074873] [<8009de94>] perf_event_output_forward+0x5c/0x98
 [ 5222.097846]
 [ 5222.097846] [<800a0300>] perf_event_exit_task+0x58/0x43c
 [ 5222.097846] [<8006c874>] hrtimer_interrupt+0x104/0x2ec
 [ 5222.097846] [<800a0300>] perf_event_exit_task+0x58/0x43c
 [ 5222.097846] [<80437bb6>] dw_apb_clockevent_irq+0x2a/0x4c
 [ 5222.097846] [<8006c770>] hrtimer_interrupt+0x0/0x2ec
 [ 5222.097846] [<8005f2e4>] __handle_irq_event_percpu+0xac/0x19c
 [ 5222.097846] [<80437bb6>] dw_apb_clockevent_irq+0x2a/0x4c
 [ 5222.097846] [<8005f408>] handle_irq_event_percpu+0x34/0x88
 [ 5222.097846] [<8005f480>] handle_irq_event+0x24/0x64
 [ 5222.097846] [<8006218c>] handle_level_irq+0x68/0xdc
 [ 5222.097846] [<8005ec76>] __handle_domain_irq+0x56/0xa8
 [ 5222.097846] [<80450e90>] ck_irq_handler+0xac/0xe4
 [ 5222.097846] [<80029012>] csky_do_IRQ+0x12/0x24
 [ 5222.097846] [<8002a3a0>] csky_irq+0x70/0x80
 [ 5222.097846] [<800ca612>] alloc_set_pte+0xd2/0x238
 [ 5222.097846] [<8002ddd0>] update_mmu_cache+0x0/0xd8
 [ 5222.097846] [<800a0340>] perf_event_exit_task+0x98/0x43c

The original fp check doesn't base on the real kernal stack region.
Invalid fp address may cause kernel panic.

Signed-off-by: Mao Han <han_mao@linux.alibaba.com>
Signed-off-by: Guo Ren <guoren@linux.alibaba.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 arch/csky/kernel/perf_callchain.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/arch/csky/kernel/perf_callchain.c b/arch/csky/kernel/perf_callchain.c
index e68ff375c8f8..ab55e98ee8f6 100644
--- a/arch/csky/kernel/perf_callchain.c
+++ b/arch/csky/kernel/perf_callchain.c
@@ -12,12 +12,17 @@ struct stackframe {
 
 static int unwind_frame_kernel(struct stackframe *frame)
 {
-	if (kstack_end((void *)frame->fp))
+	unsigned long low = (unsigned long)task_stack_page(current);
+	unsigned long high = low + THREAD_SIZE;
+
+	if (unlikely(frame->fp < low || frame->fp > high))
 		return -EPERM;
-	if (frame->fp & 0x3 || frame->fp < TASK_SIZE)
+
+	if (kstack_end((void *)frame->fp) || frame->fp & 0x3)
 		return -EPERM;
 
 	*frame = *(struct stackframe *)frame->fp;
+
 	if (__kernel_text_address(frame->lr)) {
 		int graph = 0;
 
-- 
2.25.1


  parent reply index

Thread overview: 32+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-05-22 14:50 [PATCH AUTOSEL 5.4 01/32] ARM: dts: rockchip: fix phy nodename for rk3228-evb Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 02/32] ARM: dts: rockchip: fix phy nodename for rk3229-xms6 Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 03/32] arm64: dts: rockchip: fix status for &gmac2phy in rk3328-evb.dts Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 04/32] arm64: dts: rockchip: swap interrupts interrupt-names rk3399 gpu node Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 05/32] ARM: dts: rockchip: swap clock-names of gpu nodes Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 06/32] ARM: dts: rockchip: fix pinctrl sub nodename for spi in rk322x.dtsi Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 07/32] gpio: tegra: mask GPIO IRQs during IRQ shutdown Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 08/32] ALSA: usb-audio: add mapping for ASRock TRX40 Creator Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 09/32] net: microchip: encx24j600: add missed kthread_stop Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 10/32] gfs2: move privileged user check to gfs2_quota_lock_check Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 11/32] gfs2: don't call quota_unhold if quotas are not locked Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 12/32] gfs2: Grab glock reference sooner in gfs2_add_revoke Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 13/32] drm/amdgpu: drop unnecessary cancel_delayed_work_sync on PG ungate Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 14/32] drm/amd/powerplay: perform PG ungate prior to CG ungate Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 15/32] drm/amdgpu: Use GEM obj reference for KFD BOs Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 16/32] Revert "gfs2: Don't demote a glock until its revokes are written" Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 17/32] cachefiles: Fix race between read_waiter and read_copier involving op->to_do Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 18/32] usb: dwc3: pci: Enable extcon driver for Intel Merrifield Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 19/32] usb: phy: twl6030-usb: Fix a resource leak in an error handling path in 'twl6030_usb_probe()' Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 20/32] usb: gadget: legacy: fix redundant initialization warnings Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 21/32] net: freescale: select CONFIG_FIXED_PHY where needed Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 22/32] IB/i40iw: Remove bogus call to netdev_master_upper_dev_get() Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 23/32] riscv: stacktrace: Fix undefined reference to `walk_stackframe' Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 24/32] clk: ti: am33xx: fix RTC clock parent Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 25/32] csky: Fixup msa highest 3 bits mask Sasha Levin
2020-05-22 14:50 ` Sasha Levin [this message]
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 27/32] csky: Fixup remove duplicate irq_disable Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 28/32] hwmon: (nct7904) Fix incorrect range of temperature limit registers Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 29/32] cifs: Fix null pointer check in cifs_read Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 30/32] csky: Fixup raw_copy_from_user() Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 31/32] samples: bpf: Fix build error Sasha Levin
2020-05-22 14:50 ` [PATCH AUTOSEL 5.4 32/32] drivers: net: hamradio: Fix suspicious RCU usage warning in bpqether.c Sasha Levin

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20200522145044.434677-26-sashal@kernel.org \
    --to=sashal@kernel.org \
    --cc=guoren@linux.alibaba.com \
    --cc=han_mao@linux.alibaba.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

Stable Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/stable/0 stable/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 stable stable/ https://lore.kernel.org/stable \
		stable@vger.kernel.org
	public-inbox-index stable

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.stable


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git