linux-kernel - Re: perf: wrong event->count report (Was: perf basic-test-aarch64 failures)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20160217145632.GE6357@twins.programming.kicks-ass.net>
Date:	Wed, 17 Feb 2016 15:56:32 +0100
From:	Peter Zijlstra <peterz@...radead.org>
To:	Jiri Olsa <jolsa@...hat.com>
Cc:	Oleg Nesterov <oleg@...hat.com>,
	Pratyush Anand <panand@...hat.com>,
	Jeff Bastian <jbastian@...hat.com>,
	Michael Petlan <mpetlan@...hat.com>,
	linux-kernel@...r.kernel.org, arm-devel@...hat.com
Subject: Re: perf: wrong event->count report (Was: perf basic-test-aarch64
 failures)

On Wed, Feb 17, 2016 at 03:44:56PM +0100, Jiri Olsa wrote:
> > +++ b/kernel/events/core.c
> > @@ -3173,6 +3173,10 @@ static void perf_event_enable_on_exec(in
> >  
> >  	cpuctx = __get_cpu_context(ctx);
> >  	perf_ctx_lock(cpuctx, ctx);
> > +
> > +	update_context_time(ctx);
> > +	update_cgrp_time_from_cpuctx(cpuctx);
> > +
> >  	list_for_each_entry(event, &ctx->event_list, event_entry)
> >  		enabled |= event_enable_on_exec(event, ctx);
> >  
> 
> that gives me attached fault
> 
> jirka
> 
> 
> ---
> ibm-x3650m4-01 login: [  670.771477] kernel tried to execute NX-protected page - exploit attempt? (uid: 0)
> [  670.779831] BUG: unable to handle kernel paging request at ffff88047fad6e30
> [  670.787618] IP: [<ffff88047fad6e30>] 0xffff88047fad6e30
> [  670.793455] PGD 2033067 PUD 275e8f063 PMD 800000047fa001e3
> [  670.799699] Oops: 0011 [#1] SMP
> [  670.803312] Modules linked in: intel_rapl x86_pkg_temp_thermal intel_powerclamp coretemp kvm_intel kvm irqbypass crct10dif_pclmul crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ipmi_ssif ablk_helper iTCO_wdt cryptd cdc_ether ipmi_devintf usbnet sb_edac iTCO_vendor_support edac_core ipmi_si mii shpchp lpc_ich pcspkr sg ipmi_msghandler wmi ioatdma nfsd mfd_core i2c_i801 auth_rpcgss nfs_acl lockd grace sunrpc ip_tables xfs libcrc32c sd_mod sr_mod cdrom mgag200 drm_kms_helper syscopyarea sysfillrect sysimgblt fb_sys_fops ttm igb drm ptp ahci libahci pps_core libata crc32c_intel dca megaraid_sas i2c_algo_bit i2c_core dm_mirror dm_region_hash dm_log dm_mod
> [  670.870508] CPU: 13 PID: 11185 Comm: exact_counts Not tainted 4.5.0-rc2peterz+ #12
> [  670.878955] Hardware name: IBM System x3650 M4 : -[7915E2G]-/00Y7683, BIOS -[VVE124AUS-1.30]- 11/21/2012
> [  670.889535] task: ffff8802750795c0 ti: ffff88003532c000 task.ti: ffff88003532c000
> [  670.897884] RIP: 0010:[<ffff88047fad6e30>]  [<ffff88047fad6e30>] 0xffff88047fad6e30
> [  670.906437] RSP: 0000:ffff88003532fd90  EFLAGS: 00010286
> [  670.912362] RAX: ffff880474e009e8 RBX: ffff88003532fe58 RCX: ffff88047fad6e30
> [  670.920323] RDX: ffff88003532fdb0 RSI: ffff88047148e180 RDI: ffff880474e009e8
> [  670.928284] RBP: ffff88003532fd98 R08: 0000000000000000 R09: ffff88003532fe58
> [  670.936245] R10: 00003fffffe00000 R11: 00003ffffffff000 R12: ffff880272dfd540
> [  670.944206] R13: 0000000000000002 R14: ffff8800350f0ff8 R15: ffff88047148e180
> [  670.952168] FS:  00007fe8e4e57740(0000) GS:ffff880277bc0000(0000) knlGS:0000000000000000
> [  670.961197] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [  670.967608] CR2: ffff88047fad6e30 CR3: 0000000035527000 CR4: 00000000000406e0
> [  670.975569] Stack:
> [  670.977811]  ffffffff811bf1a1 ffff88003532fdf8 ffffffff811b65ed ffffea0000d3ab40
> [  670.986096]  024000c000000054 0000000000000000 00007fffffffe000 0000000000000000
> [  670.994383]  0000000000000000 00007fffffffe080 ffff880272dfd540 000000006be5d191
> [  671.002671] Call Trace:
> [  671.005403]  [<ffffffff811bf1a1>] ? special_mapping_fault+0x31/0x90
> [  671.012396]  [<ffffffff811b65ed>] __do_fault+0x6d/0xe0
> [  671.018127]  [<ffffffff811bb076>] handle_mm_fault+0xd96/0x1ab0
> [  671.024637]  [<ffffffff81182e40>] ? uprobe_notify_resume+0x700/0xa10
> [  671.031729]  [<ffffffff81211a53>] ? __fput+0x193/0x220
> [  671.037462]  [<ffffffff8106908b>] __do_page_fault+0x18b/0x400
> [  671.043872]  [<ffffffff81069330>] do_page_fault+0x30/0x80
> [  671.049898]  [<ffffffff816ab608>] page_fault+0x28/0x30
> [  671.055628] Code: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 6e ad 7f 04 88 ff ff 20 6e ad 7f 04 88 ff ff <00> 00 00 00 00 00 00 00 00 00 00 00 10 00 00 00 40 6e ad 7f 04
> [  671.077296] RIP  [<ffff88047fad6e30>] 0xffff88047fad6e30
> [  671.083231]  RSP <ffff88003532fd90>
> [  671.087119] CR2: ffff88047fad6e30
> [  671.094220] ---[ end trace 17a74a9c13f887c1 ]---

That's a particularly useless splat; how can it not show what code
triggered the pagefault!?

The RIP not getting a symbolic name also doesn't inspire confidence.

Too weird.