Oops (NULL pointer) with 'perf record' of selftest 'null_syscall'
Athira Rajeev
atrajeev at linux.vnet.ibm.com
Wed Jun 16 13:40:45 AEST 2021
> On 16-Jun-2021, at 8:53 AM, Madhavan Srinivasan <maddy at linux.ibm.com> wrote:
>
>
> On 6/15/21 8:35 PM, Christophe Leroy wrote:
>> For your information, I'm getting the following Oops. Detected with 5.13-rc6, it also oopses on 5.12 and 5.11.
>> Runs ok on 5.10. I'm starting bisecting now.
>
>
> Thanks for reporting, got the issue. What has happened in this case is that, pmu device is not registered
> and trying to access the instruction point which will land in perf_instruction_pointer(). And recently I have added
> a workaround patch for power10 DD1 which has caused this breakage. My bad. We are working on a fix patch
> for the same and will post it out. Sorry again.
>
Hi Christophe,
Can you please try with below patch in your environment and test if it works for you.
From 55d3afc9369dfbe28a7152c8e9f856c11c7fe43d Mon Sep 17 00:00:00 2001
From: Athira Rajeev <atrajeev at linux.vnet.ibm.com>
Date: Tue, 15 Jun 2021 22:28:11 -0400
Subject: [PATCH] powerpc/perf: Fix crash with 'perf_instruction_pointer' when
pmu is not set
On systems without any specific PMU driver support registered, running
perf record causes oops:
[ 38.841073] NIP [c00000000013af54] perf_instruction_pointer+0x24/0x100
[ 38.841079] LR [c0000000003c7358] perf_prepare_sample+0x4e8/0x820
[ 38.841085] --- interrupt: 300
[ 38.841088] [c00000001cf03440] [c0000000003c6ef8] perf_prepare_sample+0x88/0x820 (unreliable)
[ 38.841096] [c00000001cf034a0] [c0000000003c76d0] perf_event_output_forward+0x40/0xc0
[ 38.841104] [c00000001cf03520] [c0000000003b45e8] __perf_event_overflow+0x88/0x1b0
[ 38.841112] [c00000001cf03570] [c0000000003b480c] perf_swevent_hrtimer+0xfc/0x1a0
[ 38.841119] [c00000001cf03740] [c0000000002399cc] __hrtimer_run_queues+0x17c/0x380
[ 38.841127] [c00000001cf037c0] [c00000000023a5f8] hrtimer_interrupt+0x128/0x2f0
[ 38.841135] [c00000001cf03870] [c00000000002962c] timer_interrupt+0x13c/0x370
[ 38.841143i] [c00000001cf038d0] [c000000000009ba4] decrementer_common_virt+0x1a4/0x1b0
[ 38.841151] --- interrupt: 900 at copypage_power7+0xd4/0x1c0
During perf record session, perf_instruction_pointer() is called to
capture the sample ip. This function in core-book3s accesses ppmu->flags.
If a platform specific PMU driver is not registered, ppmu is set to NULL
and accessing its members results in a crash. Fix this crash by checking
if ppmu is set.
Signed-off-by: Athira Rajeev <atrajeev at linux.vnet.ibm.com>
Reported-by: Christophe Leroy <christophe.leroy at csgroup.eu>
---
arch/powerpc/perf/core-book3s.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/arch/powerpc/perf/core-book3s.c b/arch/powerpc/perf/core-book3s.c
index 16d4d1b6a1ff..816756588cb7 100644
--- a/arch/powerpc/perf/core-book3s.c
+++ b/arch/powerpc/perf/core-book3s.c
@@ -2254,7 +2254,7 @@ unsigned long perf_instruction_pointer(struct pt_regs *regs)
bool use_siar = regs_use_siar(regs);
unsigned long siar = mfspr(SPRN_SIAR);
- if (ppmu->flags & PPMU_P10_DD1) {
+ if (ppmu && ppmu->flags & PPMU_P10_DD1) {
if (siar)
return siar;
else
--
2.27.0
Thanks
Athira
> Maddy
>
>
>>
>> root at vgoippro:/tmp# perf record /root/null_syscall
>> [ 285.559987] BUG: Kernel NULL pointer dereference on read at 0x00000040
>> [ 285.566533] Faulting instruction address: 0xc0021f0c
>> [ 285.571486] Oops: Kernel access of bad area, sig: 11 [#1]
>> [ 285.576872] BE PAGE_SIZE=4K PREEMPT CMPCPRO
>> [ 285.581080] SAF3000 DIE NOTIFICATION
>> [ 285.584661] CPU: 0 PID: 442 Comm: null_syscall Not tainted 5.13.0-rc6-s3k-dev-01645-g7649ee3d2957 #5164
>> [ 285.594035] NIP: c0021f0c LR: c00e8ad8 CTR: c00d8a5c
>> [ 285.599074] REGS: e67757d0 TRAP: 0300 Not tainted (5.13.0-rc6-s3k-dev-01645-g7649ee3d2957)
>> [ 285.607576] MSR: 00001032 <ME,IR,DR,RI> CR: 44775b18 XER: 20000000
>> [ 285.614063] DAR: 00000040 DSISR: 20000000
>> [ 285.614063] GPR00: c00e8810 e6775880 c1c52640 e6775b20 7cb36ae0 f0000028 43ebeedc 5ccc47d0
>> [ 285.614063] GPR08: 00000000 00000900 e6775b20 00000001 00000000 1025b2c0 10013088 10012ee0
>> [ 285.614063] GPR16: b0000000 00000007 00000001 c00deb64 00000042 00000001 78db7b23 c0b13200
>> [ 285.614063] GPR24: 00000000 00000000 00000000 e6775b20 c13b8560 00000107 e6775940 e67758e8
>> [ 285.651693] NIP [c0021f0c] perf_instruction_pointer+0x10/0x60
>> [ 285.657460] LR [c00e8ad8] perf_prepare_sample+0x344/0x674
>> [ 285.662859] Call Trace:
>> [ 285.665301] [e6775880] [c00e8810] perf_prepare_sample+0x7c/0x674 (unreliable)
>> [ 285.672452] [e67758c0] [c00e8e44] perf_event_output_forward+0x3c/0x94
>> [ 285.678903] [e6775910] [c00dea8c] __perf_event_overflow+0x74/0x14c
>> [ 285.685108] [e6775930] [c00dec5c] perf_swevent_hrtimer+0xf8/0x170
>> [ 285.691217] [e6775a40] [c008c8d0] __hrtimer_run_queues.constprop.0+0x160/0x318
>> [ 285.698456] [e6775a90] [c008d94c] hrtimer_interrupt+0x148/0x3b0
>> [ 285.704394] [e6775ae0] [c000c0c0] timer_interrupt+0xc4/0x22c
>> [ 285.710067] [e6775b10] [c00046f0] Decrementer_virt+0xb8/0xbc
>> [ 285.715744] --- interrupt: 900 at pagecache_get_page+0x210/0x430
>> [ 285.721764] NIP: c00f52a8 LR: c00f5408 CTR: c00f59d8
>> [ 285.726805] REGS: e6775b20 TRAP: 0900 Not tainted (5.13.0-rc6-s3k-dev-01645-g7649ee3d2957)
>> [ 285.735306] MSR: 00009032 <EE,ME,IR,DR,RI> CR: 28422d68 XER: 00000000
>> [ 285.742056]
>> [ 285.742056] GPR00: c00f513c e6775bd0 c1c52640 c1c52640 00000000 00000000 00000000 c1382c38
>> [ 285.742056] GPR08: 00000000 00000000 00000001 00000000 88482d68 1025b2c0 10013088 10012ee0
>> [ 285.742056] GPR16: b0000000 00000007 00000001 10012ee0 c18187ac c0b87800 61c88647 c0c18c00
>> [ 285.742056] GPR24: 00000001 00000003 00000000 00000002 c18187a8 00100cca 00000044 00000000
>> [ 285.777079] NIP [c00f52a8] pagecache_get_page+0x210/0x430
>> [ 285.782482] LR [c00f5408] pagecache_get_page+0x370/0x430
>> [ 285.787796] --- interrupt: 900
>> [ 285.790843] [e6775bd0] [c00f513c] pagecache_get_page+0xa4/0x430 (unreliable)
>> [ 285.797910] [e6775c30] [c00f5ca8] filemap_fault+0x2d0/0x8e8
>> [ 285.803500] [e6775ca0] [c012d244] __do_fault+0x4c/0xd8
>> [ 285.808666] [e6775cb0] [c0130f64] handle_mm_fault+0x274/0x10b8
>> [ 285.814517] [e6775d30] [c0014f58] do_page_fault+0x1d4/0x67c
>> [ 285.820117] [e6775d60] [c000424c] DataAccess_virt+0xd4/0xe4
>> [ 285.825707] --- interrupt: 300 at __arch_clear_user+0x10/0xcc
>> [ 285.831458] NIP: c001a3cc LR: c01d5cfc CTR: 00000000
>> [ 285.836497] REGS: e6775d70 TRAP: 0300 Not tainted (5.13.0-rc6-s3k-dev-01645-g7649ee3d2957)
>> [ 285.845000] MSR: 00009032 <EE,ME,IR,DR,RI> CR: 48004264 XER: 20000000
>> [ 285.851751] DAR: 10012ee0 DSISR: 22000000
>> [ 285.851751] GPR00: c01d53fc e6775e20 c1c52640 00000000 00000120 00000008 c136241c 00000000
>> [ 285.851751] GPR08: 00000000 9ffed120 10012ee0 00000004 28004868 1025b2c0 10013088 10012ee0
>> [ 285.851751] GPR16: b0000000 00000007 00000001 10012ee0 10000000 10012d0c 10000000 c1d74240
>> [ 285.851751] GPR24: 10012ee0 00000000 c1345e80 c1343dc0 10000b38 00000000 c132ec00 c1386a00
>> [ 285.889384] NIP [c001a3cc] __arch_clear_user+0x10/0xcc
>> [ 285.894527] LR [c01d5cfc] load_elf_binary+0xec4/0x1340
>> [ 285.899682] --- interrupt: 300
>> [ 285.902730] [e6775e20] [c01d53fc] load_elf_binary+0x5c4/0x1340 (unreliable)
>> [ 285.909713] [e6775ea0] [c0163258] bprm_execve+0x200/0x55c
>> [ 285.915138] [e6775ef0] [c0163e00] do_execveat_common+0x178/0x1f4
>> [ 285.921162] [e6775f20] [c0165558] sys_execve+0x40/0x58
>> [ 285.926321] [e6775f40] [c001404c] ret_from_syscall+0x0/0x28
>> [ 285.931917] --- interrupt: c00 at 0xfc3ce78
>> [ 285.936097] NIP: 0fc3ce78 LR: 0fc3d7cc CTR: c01657cc
>> [ 285.941135] REGS: e6775f50 TRAP: 0c00 Not tainted (5.13.0-rc6-s3k-dev-01645-g7649ee3d2957)
>> [ 285.949636] MSR: 0000d032 <EE,PR,ME,IR,DR,RI> CR: 22004868 XER: 20000000
>> [ 285.956655]
>> [ 285.956655] GPR00: 0000000b afab1bf0 a7d77a50 afab6ee1 afab64c8 104bd9b0 fefefeff 7f7f7f7f
>> [ 285.956655] GPR08: afab6ee0 00000000 006df8f9 0000011d 24004864 1025b2c0 10231a50 10249108
>> [ 285.956655] GPR16: 104beeb0 10254830 105dd3f4 10250000 1018a124 10188448 10234e58 00000000
>> [ 285.956655] GPR24: 10231ae0 00000003 00000001 104bd9b0 afab64c8 afab6ee1 0fd25244 afab1bf0
>> [ 285.991684] NIP [0fc3ce78] 0xfc3ce78
>> [ 285.995257] LR [0fc3d7cc] 0xfc3d7cc
>> [ 285.998742] --- interrupt: c00
>> [ 286.001789] Instruction dump:
>> [ 286.004757] 3d20c07d 80a40010 3889847c 486bc444 80630084 546397fe 38630001 4e800020
>> [ 286.012556] 3d20c0b9 7c6a1b78 810915e4 812300a0 <81080040> 55290036 2c090f00 5508056a
>> [ 286.020531] ---[ end trace e381e6fcc2db5226 ]---
More information about the Linuxppc-dev
mailing list