linux_dsm_epyc7002/arch
Peter Zijlstra b371b59431 perf/x86: Fix event/group validation
Commit 43b4578071 ("perf/x86: Reduce stack usage of
x86_schedule_events()") violated the rule that 'fake' scheduling; as
used for event/group validation; should not change the event state.

This went mostly un-noticed because repeated calls of
x86_pmu::get_event_constraints() would give the same result. And
x86_pmu::put_event_constraints() would mostly not do anything.

Commit e979121b1b ("perf/x86/intel: Implement cross-HT corruption
bug workaround") made the situation much worse by actually setting the
event->hw.constraint value to NULL, so when validation and actual
scheduling interact we get NULL ptr derefs.

Fix it by removing the constraint pointer from the event and move it
back to an array, this time in cpuc instead of on the stack.

validate_group()
  x86_schedule_events()
    event->hw.constraint = c; # store

      <context switch>
        perf_task_event_sched_in()
          ...
            x86_schedule_events();
              event->hw.constraint = c2; # store

              ...

              put_event_constraints(event); # assume failure to schedule
                intel_put_event_constraints()
                  event->hw.constraint = NULL;

      <context switch end>

    c = event->hw.constraint; # read -> NULL

    if (!test_bit(hwc->idx, c->idxmsk)) # <- *BOOM* NULL deref

This in particular is possible when the event in question is a
cpu-wide event and group-leader, where the validate_group() tries to
add an event to the group.

Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Andrew Hunter <ahh@google.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Maria Dimakopoulou <maria.n.dimakopoulou@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: 43b4578071 ("perf/x86: Reduce stack usage of x86_schedule_events()")
Fixes: e979121b1b ("perf/x86/intel: Implement cross-HT corruption bug workaround")
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2015-05-27 08:46:44 +02:00
..
alpha alpha: forward declare struct pt_regs in processor.h 2015-04-17 09:03:53 -04:00
arc ARC: inline cache flush toggle helpers 2015-05-11 11:21:41 +05:30
arm Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2015-05-22 15:44:50 -07:00
arm64 ARM: SoC fixes for 4.1-rc3 2015-05-16 15:33:25 -07:00
avr32 Merge branch 'exec_domain_rip_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/misc 2015-04-15 13:53:55 -07:00
blackfin blackfin updates for Linux 4.1 2015-04-24 07:58:07 -07:00
c6x C6X Fixes for v4.1 2015-04-16 18:48:55 -04:00
cris CRIS changes for 4.1 2015-04-26 13:31:05 -07:00
frv Devicetree updates for 4.1: 2015-04-24 08:46:18 -07:00
hexagon Merge branch 'exec_domain_rip_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/misc 2015-04-15 13:53:55 -07:00
ia64 Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2015-04-26 17:22:07 -07:00
m32r m32r: make flush_cpumask non-volatile. 2015-05-09 11:09:29 -07:00
m68k Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu 2015-04-20 10:12:29 -07:00
metag Metag architecture changes for v4.1 2015-04-24 07:56:50 -07:00
microblaze microblaze: use asm-generic for seccomp.h 2015-04-17 09:04:10 -04:00
mips MIPS: tlb-r4k: Fix PG_ELPA comment 2015-05-15 22:02:50 +02:00
mn10300 Devicetree updates for 4.1: 2015-04-24 08:46:18 -07:00
nios2 nios2 update for v4.1-rc1 2015-04-24 07:59:07 -07:00
openrisc Merge branch 'akpm' (patches from Andrew) 2015-04-15 16:39:15 -07:00
parisc parisc,metag: Fix crashes due to stack randomization on stack-grows-upwards architectures 2015-05-12 22:03:44 +02:00
powerpc This pull request includes a fix for two oopses, one on PPC 2015-05-21 20:15:16 -07:00
s390 Merge git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6 2015-05-22 14:26:36 -07:00
score arch: Remove exec_domain from remaining archs 2015-04-12 21:03:30 +02:00
sh Merge branch 'for-linus' of git://git.infradead.org/users/vkoul/slave-dma 2015-04-24 09:49:37 -07:00
sparc Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc 2015-04-21 23:21:34 -07:00
tile tile: properly use node_isset() on a nodemask_t 2015-04-28 10:36:45 -04:00
um Merge branch 'exec_domain_rip_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/misc 2015-04-15 13:53:55 -07:00
unicore32 Merge branch 'exec_domain_rip_v2' of git://git.kernel.org/pub/scm/linux/kernel/git/rw/misc 2015-04-15 13:53:55 -07:00
x86 perf/x86: Fix event/group validation 2015-05-27 08:46:44 +02:00
xtensa Xtensa changes and fixes for 4.1 2015-04-17 15:32:30 -04:00
.gitignore
Kconfig powerpc updates for 4.1 2015-04-16 13:53:32 -05:00