From: Zhipeng Xie <xiezhipeng1@huawei.com> mainline inclusion from mainline-v5.18-rc4 commit 60490e7966659b26d74bf1fa4aa category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8KFB3 CVE: NA Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i... -------------------------------- This problem can be reproduced with CONFIG_PERF_USE_VMALLOC enabled on both x86_64 and aarch64 arch when using sysdig -B(using ebpf)[1]. sysdig -B works fine after rebuilding the kernel with CONFIG_PERF_USE_VMALLOC disabled. I tracked it down to the if condition event->rb->nr_pages != nr_pages in perf_mmap is true when CONFIG_PERF_USE_VMALLOC is enabled where event->rb->nr_pages = 1 and nr_pages = 2048 resulting perf_mmap to return -EINVAL. This is because when CONFIG_PERF_USE_VMALLOC is enabled, rb->nr_pages is always equal to 1. Arch with CONFIG_PERF_USE_VMALLOC enabled by default: arc/arm/csky/mips/sh/sparc/xtensa Arch with CONFIG_PERF_USE_VMALLOC disabled by default: x86_64/aarch64/... Fix this problem by using data_page_nr() [1] https://github.com/draios/sysdig Fixes: 906010b2134e ("perf_event: Provide vmalloc() based mmap() backing") Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Link: https://lkml.kernel.org/r/20220209145417.6495-1-xiezhipeng1@huawei.com conflict: kernel/events/core.c kernel/events/internal.h kernel/events/ring_buffer.c Signed-off-by: Yang Jihong <yangjihong1@huawei.com> --- kernel/events/core.c | 2 +- kernel/events/internal.h | 5 +++++ kernel/events/ring_buffer.c | 4 ---- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index a49860879777..a1f12009e5ef 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5760,7 +5760,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) again: mutex_lock(&event->mmap_mutex); if (event->rb) { - if (event->rb->nr_pages != nr_pages) { + if (data_page_nr(event->rb) != nr_pages) { ret = -EINVAL; goto unlock; } diff --git a/kernel/events/internal.h b/kernel/events/internal.h index 8fc0ddc38cb6..578de8c2694b 100644 --- a/kernel/events/internal.h +++ b/kernel/events/internal.h @@ -114,6 +114,11 @@ static inline int page_order(struct ring_buffer *rb) } #endif +static inline int data_page_nr(struct ring_buffer *rb) +{ + return rb->nr_pages << page_order(rb); +} + static inline unsigned long perf_data_size(struct ring_buffer *rb) { return rb->nr_pages << (PAGE_SHIFT + page_order(rb)); diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index 34e1667e4254..a69378d901fa 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -803,10 +803,6 @@ void rb_free(struct ring_buffer *rb) } #else -static int data_page_nr(struct ring_buffer *rb) -{ - return rb->nr_pages << page_order(rb); -} static struct page * __perf_mmap_to_page(struct ring_buffer *rb, unsigned long pgoff) -- 2.34.1