From: Zhipeng Xie xiezhipeng1@huawei.com

mainline inclusion from mainline-v5.18-rc4 commit 60490e7966659b26d74bf1fa4aa8693d9a94ca88 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8KFB3 CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?i...

--------------------------------

This problem can be reproduced with CONFIG_PERF_USE_VMALLOC enabled on both x86_64 and aarch64 arch when using sysdig -B(using ebpf)[1]. sysdig -B works fine after rebuilding the kernel with CONFIG_PERF_USE_VMALLOC disabled.

I tracked it down to the if condition event->rb->nr_pages != nr_pages in perf_mmap is true when CONFIG_PERF_USE_VMALLOC is enabled where event->rb->nr_pages = 1 and nr_pages = 2048 resulting perf_mmap to return -EINVAL. This is because when CONFIG_PERF_USE_VMALLOC is enabled, rb->nr_pages is always equal to 1.

Arch with CONFIG_PERF_USE_VMALLOC enabled by default: arc/arm/csky/mips/sh/sparc/xtensa

Arch with CONFIG_PERF_USE_VMALLOC disabled by default: x86_64/aarch64/...

Fix this problem by using data_page_nr()

[1] https://github.com/draios/sysdig

Fixes: 906010b2134e ("perf_event: Provide vmalloc() based mmap() backing") Signed-off-by: Zhipeng Xie xiezhipeng1@huawei.com Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Link: https://lkml.kernel.org/r/20220209145417.6495-1-xiezhipeng1@huawei.com

conflict: kernel/events/core.c kernel/events/internal.h kernel/events/ring_buffer.c

Signed-off-by: Yang Jihong yangjihong1@huawei.com --- kernel/events/core.c | 2 +- kernel/events/internal.h | 5 +++++ kernel/events/ring_buffer.c | 4 ---- 3 files changed, 6 insertions(+), 5 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c index a49860879777..a1f12009e5ef 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5760,7 +5760,7 @@ static int perf_mmap(struct file *file, struct vm_area_struct *vma) again: mutex_lock(&event->mmap_mutex); if (event->rb) { - if (event->rb->nr_pages != nr_pages) { + if (data_page_nr(event->rb) != nr_pages) { ret = -EINVAL; goto unlock; } diff --git a/kernel/events/internal.h b/kernel/events/internal.h index 8fc0ddc38cb6..578de8c2694b 100644 --- a/kernel/events/internal.h +++ b/kernel/events/internal.h @@ -114,6 +114,11 @@ static inline int page_order(struct ring_buffer *rb) } #endif

+static inline int data_page_nr(struct ring_buffer *rb) +{ + return rb->nr_pages << page_order(rb); +} + static inline unsigned long perf_data_size(struct ring_buffer *rb) { return rb->nr_pages << (PAGE_SHIFT + page_order(rb)); diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index 34e1667e4254..a69378d901fa 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -803,10 +803,6 @@ void rb_free(struct ring_buffer *rb) }

#else -static int data_page_nr(struct ring_buffer *rb) -{ - return rb->nr_pages << page_order(rb); -}

static struct page * __perf_mmap_to_page(struct ring_buffer *rb, unsigned long pgoff)