perf: Fix sample vs do_exit()

Baisheng Gao reported an ARM64 crash, which Mark decoded as being a
synchronous external abort -- most likely due to trying to access
MMIO in bad ways.

The crash further shows perf trying to do a user stack sample while in
exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address
space it is trying to access.

It turns out that we stop perf after we tear down the userspace mm; a
receipie for disaster, since perf likes to access userspace for
various reasons.

Flip this order by moving up where we stop perf in do_exit().

Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER
to abort when the current task does not have an mm (exit_mm() makes
sure to set current->mm = NULL; before commencing with the actual
teardown). Such that CPU wide events don't trip on this same problem.

Fixes: c5ebcedb566e ("perf: Add ability to attach user stack dump to sample")
Reported-by: Baisheng Gao <baisheng.gao@unisoc.com>
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20250605110815.GQ39944@noisy.programming.kicks-ass.net

diff --git a/kernel/events/core.c b/kernel/events/core.c
index f34c99f8ce8f446a659cb82f434b7673a3e597a4..26dec1d8a5ab64c1238c2cda5903cd0ea9326759 100644 (file)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7439,6 +7439,10 @@ perf_sample_ustack_size(u16 stack_size, u16 header_size,
        if (!regs)
                return 0;
 
+       /* No mm, no stack, no dump. */
+       if (!current->mm)
+               return 0;
+
        /*
         * Check if we fit in with the requested stack size into the:
         * - TASK_SIZE
@@ -8150,6 +8154,9 @@ perf_callchain(struct perf_event *event, struct pt_regs *regs)
        const u32 max_stack = event->attr.sample_max_stack;
        struct perf_callchain_entry *callchain;
 
+       if (!current->mm)
+               user = false;
+
        if (!kernel && !user)
                return &__empty_callchain;
 

diff --git a/kernel/exit.c b/kernel/exit.c
index 38645039dd8fcc13c6aa72a156c88fd88ed51f86..1883150c9422ef04c5a8bd4df47f1825e81a0811 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -944,6 +944,15 @@ void __noreturn do_exit(long code)
        taskstats_exit(tsk, group_dead);
        trace_sched_process_exit(tsk, group_dead);
 
+       /*
+        * Since sampling can touch ->mm, make sure to stop everything before we
+        * tear it down.
+        *
+        * Also flushes inherited counters to the parent - before the parent
+        * gets woken up by child-exit notifications.
+        */
+       perf_event_exit_task(tsk);
+
        exit_mm();
 
        if (group_dead)
@@ -959,14 +968,6 @@ void __noreturn do_exit(long code)
        exit_task_work(tsk);
        exit_thread(tsk);
 
-       /*
-        * Flush inherited counters to the parent - before the parent
-        * gets woken up by child-exit notifications.
-        *
-        * because of cgroup mode, must be called before cgroup_exit()
-        */
-       perf_event_exit_task(tsk);
-
        sched_autogroup_exit_task(tsk);
        cgroup_exit(tsk);