Commit-ID: 88b0193d9418c00340e45e0a913a0813bc6c8c96 Gitweb: http://git.kernel.org/tip/88b0193d9418c00340e45e0a913a0813bc6c8c96 Author: Will Deacon <will.deacon@xxxxxxx> AuthorDate: Tue, 9 May 2017 18:00:04 +0100 Committer: Ingo Molnar <mingo@xxxxxxxxxx> CommitDate: Wed, 10 May 2017 07:54:00 +0200 perf/callchain: Force USER_DS when invoking perf_callchain_user() Perf can generate and record a user callchain in response to a synchronous request, such as a tracepoint firing. If this happens under set_fs(KERNEL_DS), then we can end up walking the user stack (and dereferencing/saving whatever we find there) without the protections usually afforded by checks such as access_ok. Rather than play whack-a-mole with each architecture's stack unwinding implementation, fix the root of the problem by ensuring that we force USER_DS when invoking perf_callchain_user from the perf core. Reported-by: Al Viro <viro@xxxxxxxxxxxxxxxxxx> Signed-off-by: Will Deacon <will.deacon@xxxxxxx> Acked-by: Peter Zijlstra <peterz@xxxxxxxxxxxxx> Cc: Alexander Shishkin <alexander.shishkin@xxxxxxxxxxxxxxx> Cc: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx> Cc: Jiri Olsa <jolsa@xxxxxxxxxx> Cc: Linus Torvalds <torvalds@xxxxxxxxxxxxxxxxxxxx> Cc: Thomas Gleixner <tglx@xxxxxxxxxxxxx> Signed-off-by: Ingo Molnar <mingo@xxxxxxxxxx> --- kernel/events/callchain.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c index c04917c..1b2be63 100644 --- a/kernel/events/callchain.c +++ b/kernel/events/callchain.c @@ -229,12 +229,18 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user, } if (regs) { + mm_segment_t fs; + if (crosstask) goto exit_put; if (add_mark) perf_callchain_store_context(&ctx, PERF_CONTEXT_USER); + + fs = get_fs(); + set_fs(USER_DS); perf_callchain_user(&ctx, regs); + set_fs(fs); } } -- To unsubscribe from this list: send the line "unsubscribe linux-tip-commits" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html