linux-kernel - perf: bug in rdpmc/mmap accounting after exec

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 26 Jul 2017 15:39:01 -0400 (EDT)
From:   Vince Weaver <vincent.weaver@...ne.edu>
To:     linux-kernel@...r.kernel.org
cc:     Andy Lutomirski <luto@...nel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Stephane Eranian <eranian@...il.com>
Subject: perf: bug in rdpmc/mmap accounting after exec

Hello

so one last bug found by the PAPI testsuite.

This one involves the rdpmc auto-disable on last unmap of an event 
feature.

Failing test case:

	fd=perf_event_open();
	addr=mmap(fd);
	exec()  // without closing or unmapping the event
	fd=perf_event_open();
	addr=mmap(fd);
	rdpmc()	// GPFs due to rdpmc being disabled

I won't pretend to be able to follow the rdpmc disabling code, but if I 
add some printks it looks like 
	current->mm->context.perf_rdpmc_allowed
isn't properly being reset on exec?

In fact, current->mm->context.perf_rdpmc_allowed goes negative which seems
like it shouldn't happen?

Anyway, a test case for this can be found in the perf_event_tests,
	tests/rdpmc/rdpmc_exec_papi

Vince