perf/callchain: Force USER_DS when invoking perf_callchain_user()
authorWill Deacon <will.deacon@arm.com>
Tue, 9 May 2017 17:00:04 +0000 (18:00 +0100)
committerIngo Molnar <mingo@kernel.org>
Wed, 10 May 2017 05:54:00 +0000 (07:54 +0200)
commit88b0193d9418c00340e45e0a913a0813bc6c8c96
tree027a83b76832b465f3f120471ce58518e4fce2e0
parentcefec668868be847ac3733c927ccd527c305b529
perf/callchain: Force USER_DS when invoking perf_callchain_user()

Perf can generate and record a user callchain in response to a synchronous
request, such as a tracepoint firing. If this happens under set_fs(KERNEL_DS),
then we can end up walking the user stack (and dereferencing/saving whatever we
find there) without the protections usually afforded by checks such as
access_ok.

Rather than play whack-a-mole with each architecture's stack unwinding
implementation, fix the root of the problem by ensuring that we force USER_DS
when invoking perf_callchain_user from the perf core.

Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Acked-by: Peter Zijlstra <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
kernel/events/callchain.c