Re: crash in perf_event_read

[Alexei Starovoitov]

On Tue, Jan 31, 2017 at 11:27:10AM +0100, Peter Zijlstra wrote:
> Subject: perf: Fix crash in perf_event_read()
> 
> Alexei had his box explode because doing read() on a package
> (rapl/uncore) event that isn't currently scheduled in ends up doing an
> out-of-bounds load.
> 
> Rework the code to more explicitly deal with event->oncpu being -1.
> 
> Reported-by: Alexei Starovoitov <alexei.starovoitov@xxxxxxxxx>
> Cc: David Carrillo-Cisneros <davidcc@xxxxxxxxxx>
> Cc: Stephane Eranian <eranian@xxxxxxxxxx>
> Fixes: d6a2f9035bfc ("perf/core: Introduce PMU_EV_CAP_READ_ACTIVE_PKG")
> Signed-off-by: Peter Zijlstra (Intel) <peterz@xxxxxxxxxxxxx>

Thanks for the quick fix!
Everything is clean after several hours.
Tested-by: Alexei Starovoitov <ast@xxxxxxxxxx>

>  		/*
>  		 * Purposely ignore the smp_call_function_single() return
> @@ -3702,7 +3706,8 @@ static int perf_event_read(struct perf_event *event, bool group)
>  		 * Therefore, either way, we'll have an up-to-date event count
>  		 * after this.
>  		 */

in that comment above (not shown in this diff) there is a line:
"If event->oncpu isn't a valid CPU it means..."
it doesn't match the code due to merge conflict resolution in 2cc538412a.
Probably makes sense to fix it s/event->oncpu/event_cpu/ as part of this diff.

> -		(void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1);
> +		(void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1);
> +		preempt_enable();
>  		ret = data.ret;
>  	} else if (event->state == PERF_EVENT_STATE_INACTIVE) {
>  		struct perf_event_context *ctx = event->ctx;