perf: Fix sample vs do_exit()

[ Upstream commit 4f6fc782128355931527cefe3eb45338abd8ab39 ]

Baisheng Gao reported an ARM64 crash, which Mark decoded as being a
synchronous external abort -- most likely due to trying to access
MMIO in bad ways.

The crash further shows perf trying to do a user stack sample while in
exit_mmap()'s tlb_finish_mmu() -- i.e. while tearing down the address
space it is trying to access.

It turns out that we stop perf after we tear down the userspace mm; a
receipie for disaster, since perf likes to access userspace for
various reasons.

Flip this order by moving up where we stop perf in do_exit().

Additionally, harden PERF_SAMPLE_CALLCHAIN and PERF_SAMPLE_STACK_USER
to abort when the current task does not have an mm (exit_mm() makes
sure to set current->mm = NULL; before commencing with the actual
teardown). Such that CPU wide events don't trip on this same problem.

Fixes: c5ebcedb566e ("perf: Add ability to attach user stack dump to sample")
Reported-by: Baisheng Gao <baisheng.gao@unisoc.com>
Suggested-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://lkml.kernel.org/r/20250605110815.GQ39944@noisy.programming.kicks-ass.net
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 21f56dd6c05a3bc2281510eda54d149f6f348f55..b133abe23a4b1fb253367615852fe7a775a98724 100644 (file)
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -6628,6 +6628,10 @@ perf_sample_ustack_size(u16 stack_size, u16 header_size,
        if (!regs)
                return 0;
 
+       /* No mm, no stack, no dump. */
+       if (!current->mm)
+               return 0;
+
        /*
         * Check if we fit in with the requested stack size into the:
         * - TASK_SIZE
@@ -7228,6 +7232,9 @@ perf_callchain(struct perf_event *event, struct pt_regs *regs)
        const u32 max_stack = event->attr.sample_max_stack;
        struct perf_callchain_entry *callchain;
 
+       if (!current->mm)
+               user = false;
+
        if (!kernel && !user)
                return &__empty_callchain;
 

diff --git a/kernel/exit.c b/kernel/exit.c
index af9c8e794e4d70774b6ebf727e39e28222b64333..cfdf2d275bba809cfb4238418c0b9446e57e021b 100644 (file)
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -844,6 +844,15 @@ void __noreturn do_exit(long code)
        tsk->exit_code = code;
        taskstats_exit(tsk, group_dead);
 
+       /*
+        * Since sampling can touch ->mm, make sure to stop everything before we
+        * tear it down.
+        *
+        * Also flushes inherited counters to the parent - before the parent
+        * gets woken up by child-exit notifications.
+        */
+       perf_event_exit_task(tsk);
+
        exit_mm();
 
        if (group_dead)
@@ -860,14 +869,6 @@ void __noreturn do_exit(long code)
        exit_task_work(tsk);
        exit_thread(tsk);
 
-       /*
-        * Flush inherited counters to the parent - before the parent
-        * gets woken up by child-exit notifications.
-        *
-        * because of cgroup mode, must be called before cgroup_exit()
-        */
-       perf_event_exit_task(tsk);
-
        sched_autogroup_exit_task(tsk);
        cgroup_exit(tsk);