stable.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	stable@vger.kernel.org, Greg Thelen <gthelen@google.com>,
	"Peter Zijlstra (Intel)" <peterz@infradead.org>
Subject: [PATCH 5.10 20/21] perf/core: Avoid put_page() when GUP fails
Date: Fri, 19 Nov 2021 18:37:55 +0100	[thread overview]
Message-ID: <20211119171444.534512068@linuxfoundation.org> (raw)
In-Reply-To: <20211119171443.892729043@linuxfoundation.org>

From: Greg Thelen <gthelen@google.com>

commit 4716023a8f6a0f4a28047f14dd7ebdc319606b84 upstream.

PEBS PERF_SAMPLE_PHYS_ADDR events use perf_virt_to_phys() to convert PMU
sampled virtual addresses to physical using get_user_page_fast_only()
and page_to_phys().

Some get_user_page_fast_only() error cases return false, indicating no
page reference, but still initialize the output page pointer with an
unreferenced page. In these error cases perf_virt_to_phys() calls
put_page(). This causes page reference count underflow, which can lead
to unintentional page sharing.

Fix perf_virt_to_phys() to only put_page() if get_user_page_fast_only()
returns a referenced page.

Fixes: fc7ce9c74c3ad ("perf/core, x86: Add PERF_SAMPLE_PHYS_ADDR")
Signed-off-by: Greg Thelen <gthelen@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20211111021814.757086-1-gthelen@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 kernel/events/core.c |   10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7036,7 +7036,6 @@ void perf_output_sample(struct perf_outp
 static u64 perf_virt_to_phys(u64 virt)
 {
 	u64 phys_addr = 0;
-	struct page *p = NULL;
 
 	if (!virt)
 		return 0;
@@ -7055,14 +7054,15 @@ static u64 perf_virt_to_phys(u64 virt)
 		 * If failed, leave phys_addr as 0.
 		 */
 		if (current->mm != NULL) {
+			struct page *p;
+
 			pagefault_disable();
-			if (get_user_page_fast_only(virt, 0, &p))
+			if (get_user_page_fast_only(virt, 0, &p)) {
 				phys_addr = page_to_phys(p) + virt % PAGE_SIZE;
+				put_page(p);
+			}
 			pagefault_enable();
 		}
-
-		if (p)
-			put_page(p);
 	}
 
 	return phys_addr;



  parent reply	other threads:[~2021-11-19 17:38 UTC|newest]

Thread overview: 39+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-11-19 17:37 [PATCH 5.10 00/21] 5.10.81-rc1 review Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 01/21] fortify: Explicitly disable Clang support Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 02/21] block: Add a helper to validate the block size Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 03/21] loop: Use blk_validate_block_size() to validate " Greg Kroah-Hartman
2021-11-19 21:45   ` Pavel Machek
2021-11-20  7:39     ` Greg Kroah-Hartman
2021-11-21 16:59       ` Pavel Machek
2021-11-19 17:37 ` [PATCH 5.10 04/21] bootconfig: init: Fix memblock leak in xbc_make_cmdline() Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 05/21] net: stmmac: add clocks management for gmac driver Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 06/21] net: stmmac: platform: fix build error with !CONFIG_PM_SLEEP Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 07/21] net: stmmac: fix missing unlock on error in stmmac_suspend() Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 08/21] net: stmmac: fix system hang if change mac address after interface ifdown Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 09/21] net: stmmac: fix issue where clk is being unprepared twice Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 10/21] net: stmmac: dwmac-rk: fix unbalanced pm_runtime_enable warnings Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 11/21] arm64: vdso32: suppress error message for make mrproper Greg Kroah-Hartman
2021-11-19 21:47   ` Pavel Machek
2021-11-19 22:24     ` Nick Desaulniers
2021-11-19 22:30       ` Nick Desaulniers
2021-11-21  7:48       ` Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 12/21] x86/iopl: Fake iopl(3) CLI/STI usage Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 13/21] parisc/entry: fix trace test in syscall exit path Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 14/21] PCI/MSI: Destroy sysfs before freeing entries Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 15/21] PCI/MSI: Deal with devices lying about their MSI mask capability Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 16/21] PCI: Add MSI masking quirk for Nvidia ION AHCI Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 17/21] erofs: remove the occupied parameter from z_erofs_pagevec_enqueue() Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 18/21] erofs: fix unsafe pagevec reuse of hooked pclusters Greg Kroah-Hartman
2021-11-19 17:37 ` [PATCH 5.10 19/21] scripts/lld-version.sh: Rewrite based on upstream ld-version.sh Greg Kroah-Hartman
2021-11-19 17:37 ` Greg Kroah-Hartman [this message]
2021-11-19 17:37 ` [PATCH 5.10 21/21] thermal: Fix NULL pointer dereferences in of_thermal_ functions Greg Kroah-Hartman
2021-11-19 18:46 ` [PATCH 5.10 00/21] 5.10.81-rc1 review Florian Fainelli
2021-11-19 19:46 ` Fox Chen
2021-11-20  0:49 ` Shuah Khan
2021-11-20  7:28 ` Pavel Machek
2021-11-20 15:21 ` Sudip Mukherjee
2021-11-20 15:27 ` Daniel Díaz
2021-11-20 16:06   ` Naresh Kamboju
2021-11-21  7:49     ` Greg Kroah-Hartman
2021-11-20 16:52 ` Guenter Roeck
2021-11-22  2:48 ` Samuel Zou

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20211119171444.534512068@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=gthelen@google.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=peterz@infradead.org \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).