From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751754AbdAaSva (ORCPT ); Tue, 31 Jan 2017 13:51:30 -0500 Received: from mail-pf0-f194.google.com ([209.85.192.194]:33960 "EHLO mail-pf0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751464AbdAaSvV (ORCPT ); Tue, 31 Jan 2017 13:51:21 -0500 Date: Tue, 31 Jan 2017 10:50:44 -0800 From: Alexei Starovoitov To: Peter Zijlstra Cc: linux-kernel@vger.kernel.org, Ingo Molnar , eranian@google.com, davidcc@google.com Subject: Re: crash in perf_event_read Message-ID: <20170131185042.GA44377@ast-mbp.thefacebook.com> References: <20170131070406.GA18460@ast-mbp.thefacebook.com> <20170131102710.GL6515@twins.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170131102710.GL6515@twins.programming.kicks-ass.net> User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Tue, Jan 31, 2017 at 11:27:10AM +0100, Peter Zijlstra wrote: > Subject: perf: Fix crash in perf_event_read() > > Alexei had his box explode because doing read() on a package > (rapl/uncore) event that isn't currently scheduled in ends up doing an > out-of-bounds load. > > Rework the code to more explicitly deal with event->oncpu being -1. > > Reported-by: Alexei Starovoitov > Cc: David Carrillo-Cisneros > Cc: Stephane Eranian > Fixes: d6a2f9035bfc ("perf/core: Introduce PMU_EV_CAP_READ_ACTIVE_PKG") > Signed-off-by: Peter Zijlstra (Intel) Thanks for the quick fix! Everything is clean after several hours. Tested-by: Alexei Starovoitov > /* > * Purposely ignore the smp_call_function_single() return > @@ -3702,7 +3706,8 @@ static int perf_event_read(struct perf_event *event, bool group) > * Therefore, either way, we'll have an up-to-date event count > * after this. > */ in that comment above (not shown in this diff) there is a line: "If event->oncpu isn't a valid CPU it means..." it doesn't match the code due to merge conflict resolution in 2cc538412a. Probably makes sense to fix it s/event->oncpu/event_cpu/ as part of this diff. > - (void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1); > + (void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1); > + preempt_enable(); > ret = data.ret; > } else if (event->state == PERF_EVENT_STATE_INACTIVE) { > struct perf_event_context *ctx = event->ctx;