LinuxLists.cc - [PATCH] perf/core: Fix syzkaller reported issue "Internal error in read

2022-08-04 11:18:26

Subject: [PATCH] perf/core: Fix syzkaller reported issue "Internal error in read_pmevcntrn"

syzkaller report a issue:
Internal error: Oops - undefined instruction: 0 [#1] SMP
Modules linked in:
CPU: 1 PID: 15523 Comm: syz-executor.3 Not tainted 5.10.0 #6
Hardware name: linux,dummy-virt (DT)
pstate: 80400005 (Nzcv daif +PAN -UAO -TCO BTYPE=--)
pc : read_pmevcntrn+0x1e4/0x1ec arch/arm64/kernel/perf_event.c:423
lr : read_pmevcntrn+0x1e4/0x1ec arch/arm64/kernel/perf_event.c:423
sp : ffffa000174d6ee0
x29: ffffa000174d6ee0 x28: ffffedbca6b17a40
x27: ffffa000174d7310 x26: ffff4b3ec102e398
x25: 00000000ffffffff x24: 00000000ffffffff
x23: ffff4b3ed8afb000 x22: ffff4b3ed8afb160
x21: ffff4b3ed8afb184 x20: ffffedbca46aa3e0
x19: ffffedbca2a524bc x18: 0000000000000000
x17: 0000000000000000 x16: 0000000000000000
x15: 0000000020000100 x14: 0000000000000000
x13: 0000000000000000 x12: ffff8967db15f63d
x11: 1fffe967db15f63c x10: ffff8967db15f63c
x9 : ffffedbca2a5273c x8 : ffff4b3ed8afb1e7
x7 : 0000000000000001 x6 : ffff8967db15f63c
x5 : ffff4b3f08b89400 x4 : 0000000000000000
x3 : ffffedbca2a00000 x2 : ffffedbca4690000
x1 : ffff4b3f08b89400 x0 : 0000000000000000
Call trace:
read_pmevcntrn+0x1e4/0x1ec arch/arm64/kernel/perf_event.c:423
armv8pmu_read_evcntr arch/arm64/kernel/perf_event.c:467 [inline]
armv8pmu_read_hw_counter arch/arm64/kernel/perf_event.c:475 [inline]
armv8pmu_read_counter+0x10c/0x1f0 arch/arm64/kernel/perf_event.c:528
armpmu_event_update+0x9c/0x1bc drivers/perf/arm_pmu.c:247
armpmu_read+0x24/0x30 drivers/perf/arm_pmu.c:264
perf_output_read_group+0x4cc/0x71c kernel/events/core.c:6806
perf_output_read+0x78/0x1c4 kernel/events/core.c:6845
perf_output_sample+0xafc/0x1000 kernel/events/core.c:6892
__perf_event_output kernel/events/core.c:7273 [inline]
perf_event_output_forward+0xd8/0x130 kernel/events/core.c:7287
__perf_event_overflow+0xbc/0x20c kernel/events/core.c:8943
perf_swevent_overflow kernel/events/core.c:9019 [inline]
perf_swevent_event+0x274/0x2c0 kernel/events/core.c:9047
do_perf_sw_event kernel/events/core.c:9160 [inline]
___perf_sw_event+0x150/0x1b4 kernel/events/core.c:9191
__perf_sw_event+0x58/0x7c kernel/events/core.c:9203
perf_sw_event include/linux/perf_event.h:1177 [inline]
mm_account_fault mm/memory.c:4707 [inline]
handle_mm_fault+0x364/0x3f0 mm/memory.c:4758
__do_page_fault arch/arm64/mm/fault.c:438 [inline]
do_page_fault+0x334/0x8f0 arch/arm64/mm/fault.c:537
do_translation_fault+0x188/0x1e0 arch/arm64/mm/fault.c:619
do_mem_abort+0x68/0x120 arch/arm64/mm/fault.c:743
el1_abort+0xc0/0x150 arch/arm64/kernel/entry-common.c:119
el1_sync_handler+0x118/0x150 arch/arm64/kernel/entry-common.c:202
el1_sync+0x74/0x100 arch/arm64/kernel/entry.S:665
__arch_clear_user+0x20/0xa0 arch/arm64/lib/clear_user.S:25
read_iter_zero+0x90/0x16c drivers/char/mem.c:718
call_read_iter include/linux/fs.h:1954 [inline]
do_iter_readv_writev+0x394/0x414 fs/read_write.c:735
do_iter_read+0x1b0/0x280 fs/read_write.c:798
vfs_readv+0xf0/0x150 fs/read_write.c:918
do_readv+0x108/0x270 fs/read_write.c:955
__do_sys_readv fs/read_write.c:1046 [inline]
__se_sys_readv fs/read_write.c:1043 [inline]
__arm64_sys_readv+0x54/0x64 fs/read_write.c:1043
__invoke_syscall arch/arm64/kernel/syscall.c:36 [inline]
invoke_syscall arch/arm64/kernel/syscall.c:48 [inline]
el0_svc_common.constprop.0+0xf4/0x414 arch/arm64/kernel/syscall.c:155
do_el0_svc+0x50/0x11c arch/arm64/kernel/syscall.c:217
el0_svc+0x20/0x30 arch/arm64/kernel/entry-common.c:353
el0_sync_handler+0xe4/0x1e0 arch/arm64/kernel/entry-common.c:369
el0_sync+0x148/0x180 arch/arm64/kernel/entry.S:683
Code: 940c387b d53be813 17ffff9c 940c3878 (d53bebd3)
---[ end trace 6aab9f4b33ebf0aa ]---
----------------
Code disassembly (best guess):
0: 940c387b bl 0x30e1ec
4: d53be813 mrs x19, pmevcntr0_el0
8: 17ffff9c b 0xfffffffffffffe78
c: 940c3878 bl 0x30e1ec
* 10: d53bebd3 mrs x19, pmevcntr30_el0 <-- trapping instruction

Interrupts is not disabled when perf_output_read_group reads PMU counter.
In this case, IPI request may be received from other cores.
As a result, PMU configuration is modified and an error occurs when
reading PMU counter:

CPU0 CPU1
__se_sys_perf_event_open
perf_install_in_context
perf_output_read_group smp_call_function_single
for_each_sibling_event(sub, leader) { generic_exec_single
if ((sub != event) && remote_function
(sub->state == PERF_EVENT_STATE_ACTIVE)) |
<enter IPI handler: __perf_install_in_context> <----RAISE IPI-----+
__perf_install_in_context
ctx_resched
event_sched_out
armpmu_del
...
hwc->idx = -1; // event->hwc.idx is set to -1
...
<exit IPI>
sub->pmu->read(sub);
armpmu_read
armv8pmu_read_counter
armv8pmu_read_hw_counter
int idx = event->hw.idx; // idx = -1
u64 val = armv8pmu_read_evcntr(idx);
u32 counter = ARMV8_IDX_TO_COUNTER(idx); // invalid counter = 30
read_pmevcntrn(counter) // undefined instruction

Signed-off-by: Yang Jihong <[email protected]>
---
kernel/events/core.c | 9 +++++++++
1 file changed, 9 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index c9d32d4d2e20..9a143ea25667 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6869,6 +6869,13 @@ static void perf_output_read_one(struct perf_output_handle *handle,
u64 read_format = event->attr.read_format;
u64 values[5];
int n = 0;
+ unsigned long flags;
+
+ /*
+ * Disabling interrupts avoids all counter scheduling
+ * (context switches, timer based rotation and IPIs).
+ */
+ local_irq_save(flags);

values[n++] = perf_event_count(event);
if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
@@ -6931,6 +6938,8 @@ static void perf_output_read_group(struct perf_output_handle *handle,

__output_copy(handle, values, n * sizeof(u64));
}
+
+ local_irq_restore(flags);
}

#define PERF_FORMAT_TOTAL_TIMES (PERF_FORMAT_TOTAL_TIME_ENABLED|\
--
2.30.GIT

2022-08-04 18:57:09

by kernel test robot

[permalink] [raw]

Subject: Re: [PATCH] perf/core: Fix syzkaller reported issue "Internal error in read_pmevcntrn"

Hi Yang,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on tip/perf/core]
[also build test WARNING on linus/master v5.19 next-20220803]
[cannot apply to acme/perf/core]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url: https://github.com/intel-lab-lkp/linux/commits/Yang-Jihong/perf-core-Fix-syzkaller-reported-issue-Internal-error-in-read_pmevcntrn/20220804-190347
base: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git 326ecc15c61c349cd49d1700ff9e3e31c6fd1cd5
config: x86_64-randconfig-a015 (https://download.01.org/0day-ci/archive/20220805/[email protected]/config)
compiler: gcc-11 (Debian 11.3.0-3) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/9c758a8d3d13d1ac89f651850b79d91b23b41b02
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Yang-Jihong/perf-core-Fix-syzkaller-reported-issue-Internal-error-in-read_pmevcntrn/20220804-190347
git checkout 9c758a8d3d13d1ac89f651850b79d91b23b41b02
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash kernel/events/

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <[email protected]>

All warnings (new ones prefixed by >>):

In file included from include/linux/spinlock.h:54,
from include/linux/wait.h:9,
from include/linux/wait_bit.h:8,
from include/linux/fs.h:6,
from kernel/events/core.c:11:
kernel/events/core.c: In function 'perf_output_read_group':
kernel/events/core.c:6942:27: error: 'flags' undeclared (first use in this function)
6942 | local_irq_restore(flags);
| ^~~~~
include/linux/typecheck.h:11:16: note: in definition of macro 'typecheck'
11 | typeof(x) __dummy2; \
| ^
include/linux/irqflags.h:228:22: note: in expansion of macro 'raw_irqs_disabled_flags'
228 | if (!raw_irqs_disabled_flags(flags)) \
| ^~~~~~~~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:9: note: in expansion of macro 'local_irq_restore'
6942 | local_irq_restore(flags);
| ^~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:27: note: each undeclared identifier is reported only once for each function it appears in
6942 | local_irq_restore(flags);
| ^~~~~
include/linux/typecheck.h:11:16: note: in definition of macro 'typecheck'
11 | typeof(x) __dummy2; \
| ^
include/linux/irqflags.h:228:22: note: in expansion of macro 'raw_irqs_disabled_flags'
228 | if (!raw_irqs_disabled_flags(flags)) \
| ^~~~~~~~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:9: note: in expansion of macro 'local_irq_restore'
6942 | local_irq_restore(flags);
| ^~~~~~~~~~~~~~~~~
>> include/linux/typecheck.h:12:25: warning: comparison of distinct pointer types lacks a cast
12 | (void)(&__dummy == &__dummy2); \
| ^~
include/linux/irqflags.h:193:17: note: in expansion of macro 'typecheck'
193 | typecheck(unsigned long, flags); \
| ^~~~~~~~~
include/linux/irqflags.h:228:22: note: in expansion of macro 'raw_irqs_disabled_flags'
228 | if (!raw_irqs_disabled_flags(flags)) \
| ^~~~~~~~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:9: note: in expansion of macro 'local_irq_restore'
6942 | local_irq_restore(flags);
| ^~~~~~~~~~~~~~~~~
>> include/linux/typecheck.h:12:25: warning: comparison of distinct pointer types lacks a cast
12 | (void)(&__dummy == &__dummy2); \
| ^~
include/linux/irqflags.h:182:17: note: in expansion of macro 'typecheck'
182 | typecheck(unsigned long, flags); \
| ^~~~~~~~~
include/linux/irqflags.h:230:17: note: in expansion of macro 'raw_local_irq_restore'
230 | raw_local_irq_restore(flags); \
| ^~~~~~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:9: note: in expansion of macro 'local_irq_restore'
6942 | local_irq_restore(flags);
| ^~~~~~~~~~~~~~~~~

vim +12 include/linux/typecheck.h

e0deaff470900a4c Andrew Morton 2008-07-25 4
e0deaff470900a4c Andrew Morton 2008-07-25 5 /*
e0deaff470900a4c Andrew Morton 2008-07-25 6 * Check at compile time that something is of a particular type.
e0deaff470900a4c Andrew Morton 2008-07-25 7 * Always evaluates to 1 so you may use it easily in comparisons.
e0deaff470900a4c Andrew Morton 2008-07-25 8 */
e0deaff470900a4c Andrew Morton 2008-07-25 9 #define typecheck(type,x) \
e0deaff470900a4c Andrew Morton 2008-07-25 10 ({ type __dummy; \
e0deaff470900a4c Andrew Morton 2008-07-25 11 typeof(x) __dummy2; \
e0deaff470900a4c Andrew Morton 2008-07-25 @12 (void)(&__dummy == &__dummy2); \
e0deaff470900a4c Andrew Morton 2008-07-25 13 1; \
e0deaff470900a4c Andrew Morton 2008-07-25 14 })
e0deaff470900a4c Andrew Morton 2008-07-25 15

--
0-DAY CI Kernel Test Service
https://01.org/lkp

2022-08-04 21:51:16

by kernel test robot

[permalink] [raw]

Subject: Re: [PATCH] perf/core: Fix syzkaller reported issue "Internal error in read_pmevcntrn"

Hi Yang,

Thank you for the patch! Yet something to improve:

[auto build test ERROR on tip/perf/core]
[also build test ERROR on linus/master v5.19 next-20220804]
[cannot apply to acme/perf/core]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url: https://github.com/intel-lab-lkp/linux/commits/Yang-Jihong/perf-core-Fix-syzkaller-reported-issue-Internal-error-in-read_pmevcntrn/20220804-190347
base: https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git 326ecc15c61c349cd49d1700ff9e3e31c6fd1cd5
config: x86_64-randconfig-a015 (https://download.01.org/0day-ci/archive/20220805/[email protected]/config)
compiler: gcc-11 (Debian 11.3.0-3) 11.3.0
reproduce (this is a W=1 build):
# https://github.com/intel-lab-lkp/linux/commit/9c758a8d3d13d1ac89f651850b79d91b23b41b02
git remote add linux-review https://github.com/intel-lab-lkp/linux
git fetch --no-tags linux-review Yang-Jihong/perf-core-Fix-syzkaller-reported-issue-Internal-error-in-read_pmevcntrn/20220804-190347
git checkout 9c758a8d3d13d1ac89f651850b79d91b23b41b02
# save the config file
mkdir build_dir && cp config build_dir/.config
make W=1 O=build_dir ARCH=x86_64 SHELL=/bin/bash

If you fix the issue, kindly add following tag where applicable
Reported-by: kernel test robot <[email protected]>

All errors (new ones prefixed by >>):

In file included from include/linux/spinlock.h:54,
from include/linux/wait.h:9,
from include/linux/wait_bit.h:8,
from include/linux/fs.h:6,
from kernel/events/core.c:11:
kernel/events/core.c: In function 'perf_output_read_group':
>> kernel/events/core.c:6942:27: error: 'flags' undeclared (first use in this function)
6942 | local_irq_restore(flags);
| ^~~~~
include/linux/typecheck.h:11:16: note: in definition of macro 'typecheck'
11 | typeof(x) __dummy2; \
| ^
include/linux/irqflags.h:228:22: note: in expansion of macro 'raw_irqs_disabled_flags'
228 | if (!raw_irqs_disabled_flags(flags)) \
| ^~~~~~~~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:9: note: in expansion of macro 'local_irq_restore'
6942 | local_irq_restore(flags);
| ^~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:27: note: each undeclared identifier is reported only once for each function it appears in
6942 | local_irq_restore(flags);
| ^~~~~
include/linux/typecheck.h:11:16: note: in definition of macro 'typecheck'
11 | typeof(x) __dummy2; \
| ^
include/linux/irqflags.h:228:22: note: in expansion of macro 'raw_irqs_disabled_flags'
228 | if (!raw_irqs_disabled_flags(flags)) \
| ^~~~~~~~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:9: note: in expansion of macro 'local_irq_restore'
6942 | local_irq_restore(flags);
| ^~~~~~~~~~~~~~~~~
include/linux/typecheck.h:12:25: warning: comparison of distinct pointer types lacks a cast
12 | (void)(&__dummy == &__dummy2); \
| ^~
include/linux/irqflags.h:193:17: note: in expansion of macro 'typecheck'
193 | typecheck(unsigned long, flags); \
| ^~~~~~~~~
include/linux/irqflags.h:228:22: note: in expansion of macro 'raw_irqs_disabled_flags'
228 | if (!raw_irqs_disabled_flags(flags)) \
| ^~~~~~~~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:9: note: in expansion of macro 'local_irq_restore'
6942 | local_irq_restore(flags);
| ^~~~~~~~~~~~~~~~~
include/linux/typecheck.h:12:25: warning: comparison of distinct pointer types lacks a cast
12 | (void)(&__dummy == &__dummy2); \
| ^~
include/linux/irqflags.h:182:17: note: in expansion of macro 'typecheck'
182 | typecheck(unsigned long, flags); \
| ^~~~~~~~~
include/linux/irqflags.h:230:17: note: in expansion of macro 'raw_local_irq_restore'
230 | raw_local_irq_restore(flags); \
| ^~~~~~~~~~~~~~~~~~~~~
kernel/events/core.c:6942:9: note: in expansion of macro 'local_irq_restore'
6942 | local_irq_restore(flags);
| ^~~~~~~~~~~~~~~~~

vim +/flags +6942 kernel/events/core.c

6896
6897 static void perf_output_read_group(struct perf_output_handle *handle,
6898 struct perf_event *event,
6899 u64 enabled, u64 running)
6900 {
6901 struct perf_event *leader = event->group_leader, *sub;
6902 u64 read_format = event->attr.read_format;
6903 u64 values[6];
6904 int n = 0;
6905
6906 values[n++] = 1 + leader->nr_siblings;
6907
6908 if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
6909 values[n++] = enabled;
6910
6911 if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
6912 values[n++] = running;
6913
6914 if ((leader != event) &&
6915 (leader->state == PERF_EVENT_STATE_ACTIVE))
6916 leader->pmu->read(leader);
6917
6918 values[n++] = perf_event_count(leader);
6919 if (read_format & PERF_FORMAT_ID)
6920 values[n++] = primary_event_id(leader);
6921 if (read_format & PERF_FORMAT_LOST)
6922 values[n++] = atomic64_read(&leader->lost_samples);
6923
6924 __output_copy(handle, values, n * sizeof(u64));
6925
6926 for_each_sibling_event(sub, leader) {
6927 n = 0;
6928
6929 if ((sub != event) &&
6930 (sub->state == PERF_EVENT_STATE_ACTIVE))
6931 sub->pmu->read(sub);
6932
6933 values[n++] = perf_event_count(sub);
6934 if (read_format & PERF_FORMAT_ID)
6935 values[n++] = primary_event_id(sub);
6936 if (read_format & PERF_FORMAT_LOST)
6937 values[n++] = atomic64_read(&sub->lost_samples);
6938
6939 __output_copy(handle, values, n * sizeof(u64));
6940 }
6941
> 6942 local_irq_restore(flags);
6943 }
6944

--
0-DAY CI Kernel Test Service
https://01.org/lkp

2022-08-05 01:01:09

by kernel test robot

[permalink] [raw]