Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <40c4b292-e396-3a1b-f26f-ebbea93c02a8@linux.alibaba.com>
Date:   Mon, 10 Jul 2023 20:26:14 +0800
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:102.0)
 Gecko/20100101 Thunderbird/102.12.0
Subject: Re: [Patch v2] perf/core: Bail out early if the request AUX area is
 out of bound
Content-Language: en-US
To:     Peter Zijlstra <peterz@infradead.org>
Cc:     alexander.shishkin@linux.intel.com, james.clark@arm.com,
        leo.yan@linaro.org, mingo@redhat.com,
        baolin.wang@linux.alibaba.com, acme@kernel.org,
        mark.rutland@arm.com, jolsa@kernel.org, namhyung@kernel.org,
        irogers@google.com, adrian.hunter@intel.com,
        linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org,
        bpf@vger.kernel.org
References: <20230613123211.58393-1-xueshuai@linux.alibaba.com>
 <20230710120026.GA3034907@hirez.programming.kicks-ass.net>
From:   Shuai Xue <xueshuai@linux.alibaba.com>
In-Reply-To: <20230710120026.GA3034907@hirez.programming.kicks-ass.net>
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 2023/7/10 20:00, Peter Zijlstra wrote:
> On Tue, Jun 13, 2023 at 08:32:11PM +0800, Shuai Xue wrote:
> 
>>  kernel/events/ring_buffer.c              | 13 +++++++++++++
>>  tools/perf/Documentation/perf-record.txt |  3 ++-
>>  2 files changed, 15 insertions(+), 1 deletion(-)
>>
>> diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
>> index a0433f37b024..e514aaba9d42 100644
>> --- a/kernel/events/ring_buffer.c
>> +++ b/kernel/events/ring_buffer.c
>> @@ -673,6 +673,7 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
>>  	bool overwrite = !(flags & RING_BUFFER_WRITABLE);
>>  	int node = (event->cpu == -1) ? -1 : cpu_to_node(event->cpu);
>>  	int ret = -ENOMEM, max_order;
>> +	size_t bytes;
>>  
>>  	if (!has_aux(event))
>>  		return -EOPNOTSUPP;
>> @@ -699,6 +700,18 @@ int rb_alloc_aux(struct perf_buffer *rb, struct perf_event *event,
>>  		watermark = 0;
>>  	}
>>  
>> +	/*
>> +	 * 'rb->aux_pages' allocated by kcalloc() is a pointer array which is
>> +	 * used to maintains AUX trace pages. The allocated page for this array
>> +	 * is physically contiguous (and virtually contiguous) with an order of
>> +	 * 0..MAX_ORDER. If the size of pointer array crosses the limitation set
>> +	 * by MAX_ORDER, it reveals a WARNING.
>> +	 *
>> +	 * So bail out early if the request AUX area is out of bound.
>> +	 */
>> +	if (check_mul_overflow(nr_pages, sizeof(void *), &bytes) ||
>> +	    get_order(bytes) > MAX_ORDER)
>> +		return -EINVAL;
> 
> This is all quite horrific :/ What's wrong with something simple:
> 
> 	/* Can't allocate more than MAX_ORDER  */
> 	if (get_order((unsigned long)nr_pages * sizeof(void*)) > MAX_ORDER)
> 		return -EINVAL;
> 
> If you're on 32bit then nr_pages should never be big enough to overflow,
> fundamentally you'll only have 32-PAGE_SHIFT bits in nr_pages.

Well, you are right. Thank you for pointing it out.
I will send a new version with your simplified code :)

Best Regards,
Shuai

> 
> 
>>  	rb->aux_pages = kcalloc_node(nr_pages, sizeof(void *), GFP_KERNEL,
>>  				     node);
>