perf/callchain: Force USER_DS when invoking perf_callchain_user()

Perf can generate and record a user callchain in response to a synchronous
request, such as a tracepoint firing. If this happens under set_fs(KERNEL_DS),
then we can end up walking the user stack (and dereferencing/saving whatever we
find there) without the protections usually afforded by checks such as
access_ok.

Rather than play whack-a-mole with each architecture's stack unwinding
implementation, fix the root of the problem by ensuring that we force USER_DS
when invoking perf_callchain_user from the perf core.

Reported-by: Al Viro <[email protected]>
Signed-off-by: Will Deacon <[email protected]>
Acked-by: Peter Zijlstra <[email protected]>
Cc: Alexander Shishkin <[email protected]>
Cc: Arnaldo Carvalho de Melo <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Linus Torvalds <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Signed-off-by: Ingo Molnar <[email protected]>

diff --git a/kernel/events/callchain.c b/kernel/events/callchain.c
index c04917cad1bfdc50fe4f00b08eaa58c9e7e7692e..1b2be63c85282fdb6f910e145853f97c23d8efb4 100644 (file)
--- a/kernel/events/callchain.c
+++ b/kernel/events/callchain.c
@@ -229,12 +229,18 @@ get_perf_callchain(struct pt_regs *regs, u32 init_nr, bool kernel, bool user,
                }
 
                if (regs) {
+                       mm_segment_t fs;
+
                        if (crosstask)
                                goto exit_put;
 
                        if (add_mark)
                                perf_callchain_store_context(&ctx, PERF_CONTEXT_USER);
+
+                       fs = get_fs();
+                       set_fs(USER_DS);
                        perf_callchain_user(&ctx, regs);
+                       set_fs(fs);
                }
        }