From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=209.85.216.71 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793051573; b=U1Snq17hf/6KQW7KzA5d+4ifw1q3YVnwGpMG2+7nX/sNbaKp4S8QXopv++4p572BWE9v z2K0mdFhlhRjSinTf/vw+YF9LyI6IDDz6x01q8GqL3zNSPPe1IGWdqk9k+qli+4DfWeeG 3op/Qt4ijonhjp0BXDsIaiaifQ8zO02owrmXwUAh3YPb4eh2VhxS2lH/T+KjxURxv5Ob2 JK0wiLL42S4xsA7vvlIaGRGg8DSIdL+C95M1SHcCztANcC5qPYalscllVGC0rEjSPX8wl QPSpcl4NxIxp4NtfuVtEjQ1KZFV+m3pwi9eFQl/20m8xO3Nc4dDJn1w5Pl4PtEbACYg== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793051573; h=DMARC-Filter:Received:DKIM-Signature:X-Google-DKIM-Signature: X-Forwarded-Encrypted:X-Gm-Message-State:X-Received:Date:In-Reply-To: Mime-Version:References:X-Mailer:Message-ID:Subject:From:To:Cc: Content-Type; bh=OQEJn1r6phHG9JJTEKXNjl8UbrwqhLU2o1gcr6ks6C0=; b=I3I5MUDM+7pQe4Xs9ooO/hQu7U7rbbLTfrCK3sVeu1lopdnZjDNOv+gxjy6wvRUtFREx SaYdnPJQHQ97kaU5IXOipTM5VjWc83iB9gUpAy2IOqOpz8oSxVtz7iAAI4CAgwsbAf3Uh aj/c90v1oNM/X+szCk/yPVdmemM/S8mQu5PItfU/TUf0ya/1XlEebt5vgi2/2Le4asFJ7 cXcoezv4Hq1BAfpHQ0NzD9cSE2NkQJW8lPMgFxtpjAmQWrB9R77Qlikj/10KQrYBiMxFj xJxyutVwvZH1R79CFp2UBJPBwYXgK6hr9JGUNivn+hRuJZ6vRRv8fF4mZ7Kh8BrPaZQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass header.from=google.com; spf=pass smtp.mailfrom=flex--jthoughton.bounces.google.com; dkim=pass header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=ApDjmBZ2; arc=none smtp.remote-ip=209.85.216.71 Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) (using TLSv1.3 with cipher TLS_AES_128_GCM_SHA256 (128/128 bits) key-exchange X25519 server-signature ECDSA (prime256v1) server-digest SHA256) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC52E60A382B for ; Mon, 26 Oct 2026 21:52:52 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.4.2 smtp.subspace.kernel.org EC52E60A382B Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--jthoughton.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=google.com header.i=@google.com header.a=rsa-sha256 header.s=20251104 header.b=ApDjmBZ2 Received: by mail-pj1-f71.google.com with SMTP id 98e67ed59e1d1-3ad436a9d00so3166599a91.0 for ; Mon, 26 Oct 2026 14:52:52 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1793051572; x=1793656372; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=OQEJn1r6phHG9JJTEKXNjl8UbrwqhLU2o1gcr6ks6C0=; b=ApDjmBZ2P5IY9M07VtIw4q1PCPK6CpIgTYTWQMTnhd4WbvnSeK4y3f8atnn7QA9cjB pATuIJVRmfxmUb6DVTcY2TSWeqihjk7sAkqWl2p7EJ+Outh4lOM6tfOP5bdm3xMdvvxm Gz5j1WDaxuKn1Qo4ZRLEMmGLuAM8u+S9GjSAdvAH/B5Z9aOkw665P34Qp/haslR+DdAh 6Cf+TsLq3VxdxXfhvV5luqaTWzWAuM2gDcXBE0x9iCsw+vaQTyRrV4cFglmiecBVNbcN 5aCJa8Oo3N1GkKfrvyeHtHj7KXN2+Rosy5Vsb+br/0l+WNOkW/XGL3x3Tqqyd1sNMI9t cLgw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1793051572; x=1793656372; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=OQEJn1r6phHG9JJTEKXNjl8UbrwqhLU2o1gcr6ks6C0=; b=wPJ0/dDwlBkSWsAW0aNYTMuYsngY+UmnkJWYLERnhJJ/MTP4xLM07EF3AeTwotJwPP fm/2y44jgP9Bf1gYHwhlD1yOXKn1H9lFysLHKlJZseU8Zl8vG/J3m19UrBhMqnK8fswY 1u9TLHqpxjoYzYFXDoMfMPOtFRnTm+FHJzNz2/FoJhMoquF2S3JdfNap84QZJXloGb8K 0DCSbJYcj/1sa4w8QhhEbMf5OvQEWN2IWxvJqZf/h7Hj+wuNoqqdHjaxIiaRhtA2NEyE nWwTpu3BuG0OnpXVhPwh8OPCK5Qu2nWqVSAq8DlCDfcheZ1vW+yMHK0VfBvI9Si8PzHq glJQ== X-Forwarded-Encrypted: i=1; AKwUvBxA8BwftrCI7Na25GbmVM7e5XhDCkLUWg1iNFIwufTNgDzSRNVTsPrJULPafZ1/mJXtxqiRmWvwxz2Oa17yhX9Q@vger.kernel.org X-Gm-Message-State: AFq9FYK5pXJTvXlAlm4EML0ZBd/7syVSri9onDssoouLr9Rfb8H5cNlV nmLU8uO3RoI/bwbr2a3vPIYUMaxWXeIAIDqUjzCFQY85fkg2880UKD2iKckbB6WM53tsmWlbImv aYPWm9entSrkoLHCYlTDA5g== X-Received: from pjbee5.prod.google.com ([2002:a17:90a:fc45:b0:3ad:f864:f94f]) (user=jthoughton job=prod-delivery.src-stubby-dispatcher) by 2002:a17:90b:4d8c:b0:3ac:a521:95e with SMTP id 98e67ed59e1d1-3adead4f7ebmr6876350a91.47.1793051572060; Mon, 26 Oct 2026 14:52:52 -0700 (PDT) Date: Mon, 26 Oct 2026 21:52:21 +0000 In-Reply-To: <20261026215226.3713941-1-jthoughton@google.com> X-Mailing-List: linux-perf-users@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list Mime-Version: 1.0 References: <20261026215226.3713941-1-jthoughton@google.com> X-Mailer: git-send-email 2.56.0.307.g5fe7bd680c-goog Message-ID: <20261026215226.3713941-6-jthoughton@google.com> Subject: [RFC PATCH 05/10] perf/core: Don't unwind the user stack without an mm From: James Houghton To: Andrew Morton , Alexander Viro Cc: Thomas Gleixner , Peter Zijlstra , Kees Cook , Arnd Bergmann , David Hildenbrand , Lorenzo Stoakes , "Liam R. Howlett" , Vlastimil Babka , Mike Rapoport , Suren Baghdasaryan , Michal Hocko , Sean Christopherson , Paolo Bonzini , Jim Mattson , Jens Axboe , Pavel Begunkov , "James E.J. Bottomley" , "Martin K. Petersen" , David Sterba , Chris Mason , Alexei Starovoitov , Daniel Borkmann , John Fastabend , Josh Poimboeuf , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , linux-mm@kvack.org, linux-fsdevel@vger.kernel.org, kvm@vger.kernel.org, io-uring@vger.kernel.org, linux-scsi@vger.kernel.org, linux-btrfs@vger.kernel.org, bpf@vger.kernel.org, linux-trace-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, James Houghton Content-Type: text/plain; charset="UTF-8" get_perf_callchain() only checks is_user_task(current) when the regs it is given aren't user mode regs. However, BPF's bpf_get_task_stack() (and bpf_get_task_stack_sleepable()) pass task_pt_regs(current) when called on the current task, which are user mode regs for a user task, even if that task has already gone through exit_mm(), e.g. when called from a program attached to exit_files() or to the dying task's final sched_switch. perf_callchain_user() then unwinds the user stack without an mm. That access does not reliably fail: the user half of the address space belongs to whatever mm happens to be lazily loaded, if any, so the unwinder may read another task's memory. This affects e.g. arm64, riscv, loongarch and csky, whose perf_callchain_user() doesn't check current->mm itself. perf events themselves are not affected, as perf_callchain() already clears the user callchain request when current is not a user task with an mm. Check is_user_task(current) regardless of the regs' mode. Fixes: fa28dcb82a38 ("bpf: Introduce helper bpf_get_task_stack()") Signed-off-by: James Houghton --- kernel/events/callchain.c | 12 ++++++++---- 1 file changed, 8 insertions(+), 4 deletions(-) diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c index 9d24b6e0c91f..a451ca2a5573 100644 --- a/kernel/events/callchain.c +++ b/kernel/events/callchain.c @@ -245,11 +245,15 @@ get_perf_callchain(struct pt_regs *regs, bool kernel, bool user, } if (user && !crosstask) { - if (!user_mode(regs)) { - if (!is_user_task(current)) - goto exit_put; + /* + * Even if @regs are user mode regs, e.g. task_pt_regs(current) + * passed in by bpf_get_task_stack(), current may already have + * gone through exit_mm(). + */ + if (!is_user_task(current)) + goto exit_put; + if (!user_mode(regs)) regs = task_pt_regs(current); - } if (defer_cookie) { /* -- 2.56.0.307.g5fe7bd680c-goog