linux-kernel - Re: [PATCH perf] perf: get_perf_callchain return NULL for crosstask

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Fri, 10 Nov 2023 20:32:40 -0800
From:   Andrii Nakryiko <andrii.nakryiko@...il.com>
To:     Jordan Rome <linux@...danrome.com>
Cc:     linux-perf-users@...r.kernel.org, bpf@...r.kernel.org,
        linux-kernel@...r.kernel.org, Andrii Nakryiko <andrii@...nel.org>,
        Martin KaFai Lau <martin.lau@...nel.org>,
        Kernel Team <kernel-team@...com>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Song Liu <songliubraving@...com>
Subject: Re: [PATCH perf] perf: get_perf_callchain return NULL for crosstask

On Fri, Nov 10, 2023 at 4:43 PM Jordan Rome <linux@...danrome.com> wrote:
>
> On Fri, Nov 10, 2023 at 7:10 PM Andrii Nakryiko
> <andrii.nakryiko@...il.com> wrote:
> >
> > On Fri, Nov 10, 2023 at 3:51 PM Jordan Rome <linux@...danrome.com> wrote:
> > >
> > > Return NULL instead of returning 1 incorrect frame, which
> > > currently happens when trying to walk the user stack for
> > > any task that isn't current. Returning NULL is a better
> > > indicator that this behavior is not supported.
> > >
> > > This issue was found using bpf_get_task_stack inside a BPF
> > > iterator ("iter/task"), which iterates over all tasks. The
> > > single address/frame in the buffer when getting user stacks
> > > for tasks that aren't current could not be symbolized (testing
> > > multiple symbolizers).
> > >
> > > Signed-off-by: Jordan Rome <linux@...danrome.com>
> > > ---
> > >  kernel/events/callchain.c | 7 +++----
> > >  1 file changed, 3 insertions(+), 4 deletions(-)
> > >
> > > diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
> > > index 1273be84392c..430fa544fa80 100644
> > > --- a/kernel/events/callchain.c
> > > +++ b/kernel/events/callchain.c
> > > @@ -201,6 +201,9 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
> > >         }
> > >
> > >         if (user) {
> > > +               if (crosstask)
> > > +                       return NULL;
> >
> > I think you need that goto exit_put here.
> >
>
> Why is that? Wouldn't that be the same behavior that already exists?
> That being said we can probably move this check above get_callchain_entry
> and exit earlier.

If I read the code right, get_callchain_entry() does expect
put_callchain_entry(), which you are breaking with this return NULL.

But indeed, checking it early and bailing out might be the best solution here.

>
> > > +
> > >                 if (!user_mode(regs)) {
> > >                         if  (current->mm)
> > >                                 regs = task_pt_regs(current);
> > > @@ -209,9 +212,6 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
> > >                 }
> > >
> > >                 if (regs) {
> > > -                       if (crosstask)
> > > -                               goto exit_put;
> > > -
> > >                         if (add_mark)
> > >                                 perf_callchain_store_context(&ctx, PERF_CONTEXT_USER);
> > >
> > > @@ -219,7 +219,6 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
> > >                 }
> > >         }
> > >
> > > -exit_put:
> > >         put_callchain_entry(rctx);
> > >
> > >         return entry;
> > > --
> > > 2.39.3
> > >