lkml.org 
[lkml]   [2018]   [Apr]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[tip:perf/urgent] perf: Fix sample_max_stack maximum check
    Commit-ID:  5af44ca53d019de47efe6dbc4003dd518e5197ed
    Gitweb: https://git.kernel.org/tip/5af44ca53d019de47efe6dbc4003dd518e5197ed
    Author: Jiri Olsa <jolsa@kernel.org>
    AuthorDate: Sun, 15 Apr 2018 11:23:51 +0200
    Committer: Arnaldo Carvalho de Melo <acme@redhat.com>
    CommitDate: Tue, 17 Apr 2018 09:47:40 -0300

    perf: Fix sample_max_stack maximum check

    The syzbot hit KASAN bug in perf_callchain_store having the entry stored
    behind the allocated bounds [1].

    We miss the sample_max_stack check for the initial event that allocates
    callchain buffers. This missing check allows to create an event with
    sample_max_stack value bigger than the global sysctl maximum:

    # sysctl -a | grep perf_event_max_stack
    kernel.perf_event_max_stack = 127

    # perf record -vv -C 1 -e cycles/max-stack=256/ kill
    ...
    perf_event_attr:
    size 112
    ...
    sample_max_stack 256
    ------------------------------------------------------------
    sys_perf_event_open: pid -1 cpu 1 group_fd -1 flags 0x8 = 4

    Note the '-C 1', which forces perf record to create just single event.
    Otherwise it opens event for every cpu, then the sample_max_stack check
    fails on the second event and all's fine.

    The fix is to run the sample_max_stack check also for the first event
    with callchains.

    [1] https://marc.info/?l=linux-kernel&m=152352732920874&w=2

    Reported-by: syzbot+7c449856228b63ac951e@syzkaller.appspotmail.com
    Signed-off-by: Jiri Olsa <jolsa@kernel.org>
    Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Cc: Andi Kleen <andi@firstfloor.org>
    Cc: H. Peter Anvin <hpa@zytor.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: syzkaller-bugs@googlegroups.com
    Cc: x86@kernel.org
    Fixes: 97c79a38cd45 ("perf core: Per event callchain limit")
    Link: http://lkml.kernel.org/r/20180415092352.12403-2-jolsa@kernel.org
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    ---
    kernel/events/callchain.c | 21 ++++++++++++---------
    1 file changed, 12 insertions(+), 9 deletions(-)

    diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
    index 772a43fea825..73cc26e321de 100644
    --- a/kernel/events/callchain.c
    +++ b/kernel/events/callchain.c
    @@ -119,19 +119,22 @@ int get_callchain_buffers(int event_max_stack)
    goto exit;
    }

    + /*
    + * If requesting per event more than the global cap,
    + * return a different error to help userspace figure
    + * this out.
    + *
    + * And also do it here so that we have &callchain_mutex held.
    + */
    + if (event_max_stack > sysctl_perf_event_max_stack) {
    + err = -EOVERFLOW;
    + goto exit;
    + }
    +
    if (count > 1) {
    /* If the allocation failed, give up */
    if (!callchain_cpus_entries)
    err = -ENOMEM;
    - /*
    - * If requesting per event more than the global cap,
    - * return a different error to help userspace figure
    - * this out.
    - *
    - * And also do it here so that we have &callchain_mutex held.
    - */
    - if (event_max_stack > sysctl_perf_event_max_stack)
    - err = -EOVERFLOW;
    goto exit;
    }

    \
     
     \ /
      Last update: 2018-04-21 09:51    [W:4.141 / U:0.000 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site