perf/core: Fix crash in perf_event_read()

Alexei had his box explode because doing read() on a package
(rapl/uncore) event that isn't currently scheduled in ends up doing an
out-of-bounds load.

Rework the code to more explicitly deal with event->oncpu being -1.

Reported-by: Alexei Starovoitov <alexei.starovoitov@gmail.com>
Tested-by: Alexei Starovoitov <ast@kernel.org>
Tested-by: David Carrillo-Cisneros <davidcc@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: eranian@google.com
Fixes: d6a2f9035bfc ("perf/core: Introduce PMU_EV_CAP_READ_ACTIVE_PKG")
Link: http://lkml.kernel.org/r/20170131102710.GL6515@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>

1 files changed, 15 insertions, 10 deletions

diff --git a/kernel/events/core.c b/kernel/events/core.c
index e5aaa806702d..e235bb991bdd 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -3487,14 +3487,15 @@ struct perf_read_data {
         int ret;
 };
 
-static int find_cpu_to_read(struct perf_event *event, int local_cpu)
+static int __perf_event_read_cpu(struct perf_event *event, int event_cpu)
 {
-        int event_cpu = event->oncpu;
         u16 local_pkg, event_pkg;
 
         if (event->group_caps & PERF_EV_CAP_READ_ACTIVE_PKG) {
-                event_pkg =  topology_physical_package_id(event_cpu);
-                local_pkg =  topology_physical_package_id(local_cpu);
+                int local_cpu = smp_processor_id();
+
+                event_pkg = topology_physical_package_id(event_cpu);
+                local_pkg = topology_physical_package_id(local_cpu);
 
                 if (event_pkg == local_pkg)
                         return local_cpu;
@@ -3624,7 +3625,7 @@ u64 perf_event_read_local(struct perf_event *event)
 
 static int perf_event_read(struct perf_event *event, bool group)
 {
-        int ret = 0, cpu_to_read, local_cpu;
+        int event_cpu, ret = 0;
 
         /*
          * If event is enabled and currently active on a CPU, update the
@@ -3637,21 +3638,25 @@ static int perf_event_read(struct perf_event *event, bool group)
                         .ret = 0,
                 };
 
-                local_cpu = get_cpu();
-                cpu_to_read = find_cpu_to_read(event, local_cpu);
-                put_cpu();
+                event_cpu = READ_ONCE(event->oncpu);
+                if ((unsigned)event_cpu >= nr_cpu_ids)
+                        return 0;
+
+                preempt_disable();
+                event_cpu = __perf_event_read_cpu(event, event_cpu);
 
                 /*
                  * Purposely ignore the smp_call_function_single() return
                  * value.
                  *
-                 * If event->oncpu isn't a valid CPU it means the event got
+                 * If event_cpu isn't a valid CPU it means the event got
                  * scheduled out and that will have updated the event count.
                  *
                  * Therefore, either way, we'll have an up-to-date event count
                  * after this.
                  */
-                (void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1);
+                (void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1);
+                preempt_enable();
                 ret = data.ret;
         } else if (event->state == PERF_EVENT_STATE_INACTIVE) {
                 struct perf_event_context *ctx = event->ctx;