Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752119AbdLLM2n (ORCPT ); Tue, 12 Dec 2017 07:28:43 -0500 Received: from mx0b-001b2d01.pphosted.com ([148.163.158.5]:53530 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751274AbdLLM2j (ORCPT ); Tue, 12 Dec 2017 07:28:39 -0500 From: Ravi Bangoria To: mpe@ellerman.id.au Cc: benh@kernel.crashing.org, paulus@samba.org, maddy@linux.vnet.ibm.com, tglx@linutronix.de, kamalesh@linux.vnet.ibm.com, kan.liang@intel.com, linuxppc-dev@lists.ozlabs.org, linux-kernel@vger.kernel.org, naveen.n.rao@linux.vnet.ibm.com, Ravi Bangoria Subject: [PATCH] powerpc/perf: Dereference bhrb entries safely Date: Tue, 12 Dec 2017 17:59:15 +0530 X-Mailer: git-send-email 2.13.6 X-TM-AS-GCONF: 00 x-cbid: 17121212-0040-0000-0000-000003F929FE X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 17121212-0041-0000-0000-000025FC3624 Message-Id: <20171212122915.20338-1-ravi.bangoria@linux.vnet.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2017-12-12_08:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 priorityscore=1501 malwarescore=0 suspectscore=1 phishscore=0 bulkscore=0 spamscore=0 clxscore=1011 lowpriorityscore=0 impostorscore=0 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1709140000 definitions=main-1712120180 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1577 Lines: 43 It may very well happen that branch instructions recorded by bhrb entries already get unmapped before they get processed by the kernel. Hence, trying to dereference such memory location will endup in a crash. Ex, Unable to handle kernel paging request for data at address 0xc008000019c41764 Faulting instruction address: 0xc000000000084a14 NIP [c000000000084a14] branch_target+0x4/0x70 LR [c0000000000eb828] record_and_restart+0x568/0x5c0 Call Trace: [c0000000000eb3b4] record_and_restart+0xf4/0x5c0 (unreliable) [c0000000000ec378] perf_event_interrupt+0x298/0x460 [c000000000027964] performance_monitor_exception+0x54/0x70 [c000000000009ba4] performance_monitor_common+0x114/0x120 Fix this by deferefencing them safely. Suggested-by: Naveen N. Rao Signed-off-by: Ravi Bangoria --- arch/powerpc/perf/core-book3s.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c index 9e3da168d54c..5a68d2effdf9 100644 --- a/arch/powerpc/perf/core-book3s.c +++ b/arch/powerpc/perf/core-book3s.c @@ -410,8 +410,11 @@ static __u64 power_pmu_bhrb_to(u64 addr) int ret; __u64 target; - if (is_kernel_addr(addr)) - return branch_target((unsigned int *)addr); + if (is_kernel_addr(addr)) { + if (probe_kernel_address((void *)addr, instr)) + return 0; + return branch_target(&instr); + } /* Userspace: need copy instruction here then translate it */ pagefault_disable(); -- 2.13.6