From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EE23C3A4F36 for ; Mon, 9 Mar 2026 12:17:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=170.10.133.124 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773058685; cv=none; b=j13Sx3l+9PGtQJRYnnG2o5IPstbJDmCSmllMkLcw4PoHaO5/kDozWBY9kzUAaqKQp2UQGOJYBrYO7YTJIYhcW/5rJIRRYJSvAocFAe2ddgWM3tt1oLXL/SjXuknHpzxgRzRLMGJB4tgmt1fpqo+rC2G6wcwtPHUNYYCfMxs1pKo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773058685; c=relaxed/simple; bh=OozR2JHfgFlcf3yfRLJXVdOhqh9iyrFEXwOX6FN3Zks=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=CHu9Sts7exc73FCOdp9g6uAAHXe27ZKxSC0Os6YOE0G56FpsSxhSfgTNZYArJQtofBH7bdFHK+7BSPidOUj39BEG4tgw9zd1cHDo8u2E5JyvjnxO7yHAWZIOF0V2GyESRZrbmE2wqOQHUN03K5mH1Rcez8WvdMCSGpSI64Lj41o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com; spf=pass smtp.mailfrom=redhat.com; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b=RRd+KvIP; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b=OA+TOY7b; arc=none smtp.client-ip=170.10.133.124 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=redhat.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=redhat.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="RRd+KvIP"; dkim=pass (2048-bit key) header.d=redhat.com header.i=@redhat.com header.b="OA+TOY7b" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1773058678; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=HNyyMMOd63VribfqOYS2i0x1XZyTkPZ+RO24bylfwjk=; b=RRd+KvIPQ2WsRxPpAp7rW0p5rwsd7cV7yLUInS2NS2fRUHmCm8qUBKSAmkos6cDo1O+i+q Q1JV3Pv/9NEdWXjTAb9jlSXBlHQ0KwNfWGNpitIY92LvZ9epVZ2gYMYieo9ozMfbhbRpAc 4ngjmIISJ0Rs1ihS3GKlyn/ebVDI4Qg= Received: from mail-wr1-f70.google.com (mail-wr1-f70.google.com [209.85.221.70]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_256_GCM_SHA384) id us-mta-664-Obc5ZMN_OOCrD3Gqm8Rudg-1; Mon, 09 Mar 2026 08:17:56 -0400 X-MC-Unique: Obc5ZMN_OOCrD3Gqm8Rudg-1 X-Mimecast-MFC-AGG-ID: Obc5ZMN_OOCrD3Gqm8Rudg_1773058675 Received: by mail-wr1-f70.google.com with SMTP id ffacd0b85a97d-439af7ba802so7759417f8f.2 for ; Mon, 09 Mar 2026 05:17:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=google; t=1773058675; x=1773663475; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=HNyyMMOd63VribfqOYS2i0x1XZyTkPZ+RO24bylfwjk=; b=OA+TOY7bYnETjwsupMctjwmkaHn+KPkAUSkmGpG5vY9IN1beWH5PfP4sagaUe7xXcb NBPxaD5urH1T4y8nlxa9ZpLmFUjWxVtXQBsMC8qe2eYn2mXDW12cLSIqG1YJeUIbf53O NHCRzsqmonheoSBcHBQmTWe7BJQem6yVTTTxDtSZLPzHDbugxexst+IiDsuFsdTO8Hs7 qZHcRCP30ymn1y/2Jdjo9lJO3g+GeWeXQ3xOnWC/kqKoRNRh4QfTs+vVU7ifkG8XCMJN A9CjJs6tspEOsT6ut/Az4DnCmFeCk3sjE9rzhDzeowJa5tT3PW3vWrAdXlBC02YrUzH1 4sFQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773058675; x=1773663475; h=content-transfer-encoding:in-reply-to:content-language:from :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=HNyyMMOd63VribfqOYS2i0x1XZyTkPZ+RO24bylfwjk=; b=UK3fw1amNn8SX75zHmiQq8sLsGISf5QL+DyBqHtafJRob3Fq5h57LPY0sunx19+J6M pmTw+vCZro1UPPZIbXkm3atVYJrxWW5+/aAAGrj8P0RP56m5SGDHABlt0FCKTA60dYCt nMhRhUKNudnSACK6AA5dDB+ZT0/2/bLXOvRpxLgr/DTIzHS3wku93Jh7BO+tehjwX54Q 3hlgfcZRdRhtjbiMAl1BYDOr+jeB1am0BIlwvIGiEQ6uGqfOqMKrFFtqVmkYy8sq4Apa rqJsnsRQpouYC7eNRQW6okZO5TzGOaUr4dedRmJ3AWtCkxgT8oenyGuX3SKZaZ6dTKg0 STgw== X-Forwarded-Encrypted: i=1; AJvYcCWe50+FgqhoHDZdq/6+aaWfQiTJ0qn/6+5H6gmJVQ4KfmKD0UmDauTxDi4LfrIIZ4U8Po6XHwFtCoxvzm4=@vger.kernel.org X-Gm-Message-State: AOJu0Yy7A6KwebNT5SUxFz2WejBkORcABimmYfvpw7I0qHP5US+RmwUc eNZfD0/WFzlj5vo0zVv2T0f9zqbTUXSQ5Cc+MfKMpWNUGIraf8yFhtjtxNOwKFY2BAgt5fInfIG rh6KUiQn5WvDJkIukBYbjM+jl+q33ZUTgibuzaFx8cgDSbxtZuYICzGMlB7izVGN7 X-Gm-Gg: ATEYQzxCxENgYd1MlUfAKtckJIzy+pZNpOW2OQ/+6ppNAq/Ihh949NmaEi5s+Fo45Ua GoFov6UM3+R7Nr/2Y+zsrR/zIAmW/nI8q4EdfzxrzSx9kWdhnL+olSOXwhLSTL4Gf9slOQfPtqw jRl0KfgRpMH/KF1abIrQKyZsXTgt0OudR6jVUAFfHf86yHgtkz4oLNprNEqtJ5j64cuCViwaTuR dmfU1CaraHdxApE+y9VCXStUgotHtt8/WFm+9T3Zkxtk6GLbsheXqob5D/69YMYWz05Vbl25ow0 /hv60Cw6nc5kuJ/tfHnCniV5NwWDjG+HCPPzy4a088ngWdEQj43ilQvb6Z5cKadccM0x0P6KGk3 6I1LxnzAUq0YvNv0alnox9m2XAVZ6ytn37NRYTvRqenh8/C7Trqb/mCPF X-Received: by 2002:a05:6000:290c:b0:439:b3d2:376b with SMTP id ffacd0b85a97d-439da66207amr19413533f8f.14.1773058674896; Mon, 09 Mar 2026 05:17:54 -0700 (PDT) X-Received: by 2002:a05:6000:290c:b0:439:b3d2:376b with SMTP id ffacd0b85a97d-439da66207amr19413477f8f.14.1773058674321; Mon, 09 Mar 2026 05:17:54 -0700 (PDT) Received: from [192.168.0.135] (185-219-167-205-static.vivo.cz. [185.219.167.205]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-439dad8da01sm27690413f8f.1.2026.03.09.05.17.53 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 09 Mar 2026 05:17:53 -0700 (PDT) Message-ID: Date: Mon, 9 Mar 2026 13:17:52 +0100 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH] powerpc, perf: Check that current->mm is alive before getting user callchain To: Saket Kumar Bhaskar Cc: linuxppc-dev@lists.ozlabs.org, Madhavan Srinivasan , Michael Ellerman , Nicholas Piggin , "Christophe Leroy (CS GROUP)" , Joe Perches , Paul Mackerras , Benjamin Herrenschmidt , atrajeev@linux.ibm.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, bpf@vger.kernel.org References: <20260227082502.1882395-1-vmalik@redhat.com> <80766050-c745-411b-8ee6-8141d2cfe4ff@redhat.com> From: Viktor Malik Content-Language: en-US In-Reply-To: Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 3/9/26 12:05, Saket Kumar Bhaskar wrote: > On Thu, Mar 05, 2026 at 01:45:44PM +0100, Viktor Malik wrote: >> On 3/3/26 15:58, Saket Kumar Bhaskar wrote: >>> On Fri, Feb 27, 2026 at 09:25:02AM +0100, Viktor Malik wrote: >>>> It may happen that mm is already released, which leads to kernel panic. >>>> This adds the NULL check for current->mm, similarly to 20afc60f892d >>>> ("x86, perf: Check that current->mm is alive before getting user >>>> callchain"). >>>> >>>> I was getting this panic when running a profiling BPF program >>>> (profile.py from bcc-tools): >>>> >>>> [26215.051935] Kernel attempted to read user page (588) - exploit attempt? (uid: 0) >>>> [26215.051950] BUG: Kernel NULL pointer dereference on read at 0x00000588 >>>> [26215.051952] Faulting instruction address: 0xc00000000020fac0 >>>> [26215.051957] Oops: Kernel access of bad area, sig: 11 [#1] >>>> [...] >>>> [26215.052049] Call Trace: >>>> [26215.052050] [c000000061da6d30] [c00000000020fc10] perf_callchain_user_64+0x2d0/0x490 (unreliable) >>>> [26215.052054] [c000000061da6dc0] [c00000000020f92c] perf_callchain_user+0x1c/0x30 >>>> [26215.052057] [c000000061da6de0] [c0000000005ab2a0] get_perf_callchain+0x100/0x360 >>>> [26215.052063] [c000000061da6e70] [c000000000573bc8] bpf_get_stackid+0x88/0xf0 >>>> [26215.052067] [c000000061da6ea0] [c008000000042258] bpf_prog_16d4ab9ab662f669_do_perf_event+0xf8/0x274 >>>> [...] >>>> >>>> Fixes: 20002ded4d93 ("perf_counter: powerpc: Add callchain support") >>>> Signed-off-by: Viktor Malik >>>> --- >>>> arch/powerpc/perf/callchain_32.c | 3 +++ >>>> arch/powerpc/perf/callchain_64.c | 3 +++ >>>> 2 files changed, 6 insertions(+) >>>> >>>> diff --git a/arch/powerpc/perf/callchain_32.c b/arch/powerpc/perf/callchain_32.c >>>> index ddcc2d8aa64a..b46e21679566 100644 >>>> --- a/arch/powerpc/perf/callchain_32.c >>>> +++ b/arch/powerpc/perf/callchain_32.c >>>> @@ -144,6 +144,9 @@ void perf_callchain_user_32(struct perf_callchain_entry_ctx *entry, >>>> sp = regs->gpr[1]; >>>> perf_callchain_store(entry, next_ip); >>>> >>>> + if (!current->mm) >>>> + return; >>>> + >>>> while (entry->nr < entry->max_stack) { >>>> fp = (unsigned int __user *) (unsigned long) sp; >>>> if (invalid_user_sp(sp) || read_user_stack_32(fp, &next_sp)) >>>> diff --git a/arch/powerpc/perf/callchain_64.c b/arch/powerpc/perf/callchain_64.c >>>> index 115d1c105e8a..eaaadd6fa81b 100644 >>>> --- a/arch/powerpc/perf/callchain_64.c >>>> +++ b/arch/powerpc/perf/callchain_64.c >>>> @@ -79,6 +79,9 @@ void perf_callchain_user_64(struct perf_callchain_entry_ctx *entry, >>>> sp = regs->gpr[1]; >>>> perf_callchain_store(entry, next_ip); >>>> >>>> + if (!current->mm) >>>> + return; >>>> + >>>> while (entry->nr < entry->max_stack) { >>>> fp = (unsigned long __user *) sp; >>>> if (invalid_user_sp(sp) || read_user_stack_64(fp, &next_sp)) >>>> -- >>>> 2.53.0 >>>> >>> Sorry, I missed adding cc list for the last conversation so adding this for reference: >>> >>>> Wouldn't be good if we check this in perf_callchain_user() as it will >>>> cover both cases. >>> >>> to which Viktor replied: >>> I considered it but in that case, we'd also miss the top-level stack >>> frame (the perf_callchain_store call above). Other arches include it so >>> I followed the behavior for powerpc. >>> >>> Viktor, agreed with your first point. I have another concern: >>> >>> I was hitting this issue with stacktrace_build_id_nmi in bpf and >>> applied this patch https://lore.kernel.org/bpf/20260126074331.815684-1-chen.dylane@linux.dev/T/#mf901967ebe77506f1bd6e3d876c2a85824d9519d >>> >>> Wondering if the above generic fix is working do we need to add this >>> check in powerpc specific code? >> >> I tried to apply that patch series but, unfortunately, keep getting the >> panic when running the BCC profile tool. >> >> Also, looking at the patch, it seems that it would only solve the issue >> when perf_callchain_user is called from a BPF context, however, I assume >> that it may be called from other contexts, too. >> >> Since perf_callchain_user_{32,64} are dereferencing current->mm while >> walking the stack, I think that an explicit protection against >> current->mm being NULL makes sense here, even in the presence of the >> above patch. Especially since other arches have it, too. >> >> Viktor >> > Ok that looks convincing then, another thing is that, how about moving perf_callchain_store > to perf_callchain_user and checking current->mm == NULL there for both perf_callchain_user_32/64. > next_ip, lr and sp can be passed to perf_callchain_user_32/64. Yeah, that should be possible. I'll send v2. Viktor > > Thanks, > Saket >