Commit 4f6fc782 authored by Peter Zijlstra's avatar Peter Zijlstra
Browse files

perf: Fix sample vs do_exit() 



Baisheng Gao reported an ARM64 crash, which Mark decoded as being a
synchronous external abort -- most likely due to trying to access
MMIO in bad ways.

The crash further shows perf trying to do a user stack sample while in
exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address
space it is trying to access.

It turns out that we stop perf after we tear down the userspace mm; a
receipie for disaster, since perf likes to access userspace for
various reasons.

Flip this order by moving up where we stop perf in do_exit().

Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER
to abort when the current task does not have an mm (exit_mm() makes
sure to set current->mm = NULL; before commencing with the actual
teardown). Such that CPU wide events don't trip on this same problem.

Fixes: c5ebcedb ("perf: Add ability to attach user stack dump to sample")
Reported-by: default avatarBaisheng Gao <baisheng.gao@unisoc.com>
Suggested-by: default avatarMark Rutland <mark.rutland@arm.com>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20250605110815.GQ39944@noisy.programming.kicks-ass.net
parent 86aa94cd

kernel/events/core.c

+7 −0
Original line number Diff line number Diff line
@@ -7439,6 +7439,10 @@ perf_sample_ustack_size(u16 stack_size, u16 header_size, 
	if (!regs)

		return 0;



	/* No mm, no stack, no dump. */

	if (!current->mm)

		return 0;



	/*

	 * Check if we fit in with the requested stack size into the:

	 * - TASK_SIZE
@@ -8150,6 +8154,9 @@ perf_callchain(struct perf_event *event, struct pt_regs *regs) 
	const u32 max_stack = event->attr.sample_max_stack;

	struct perf_callchain_entry *callchain;



	if (!current->mm)

		user = false;



	if (!kernel && !user)

		return &__empty_callchain;

kernel/exit.c

+9 −8
Original line number Diff line number Diff line
@@ -944,6 +944,15 @@ void __noreturn do_exit(long code) 
	taskstats_exit(tsk, group_dead);

	trace_sched_process_exit(tsk, group_dead);



	/*

	 * Since sampling can touch ->mm, make sure to stop everything before we

	 * tear it down.

	 *

	 * Also flushes inherited counters to the parent - before the parent

	 * gets woken up by child-exit notifications.

	 */

	perf_event_exit_task(tsk);



	exit_mm();



	if (group_dead)
@@ -959,14 +968,6 @@ void __noreturn do_exit(long code) 
	exit_task_work(tsk);

	exit_thread(tsk);



	/*

	 * Flush inherited counters to the parent - before the parent

	 * gets woken up by child-exit notifications.

	 *

	 * because of cgroup mode, must be called before cgroup_exit()

	 */

	perf_event_exit_task(tsk);



	sched_autogroup_exit_task(tsk);

	cgroup_exit(tsk);