linux-kernel - Re: [bisected] perf: yet another fuzzer triggered crash

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 8 Jul 2013 15:50:48 +0200
From:	Jiri Olsa <jolsa@...hat.com>
To:	Peter Zijlstra <peterz@...radead.org>
Cc:	Vince Weaver <vincent.weaver@...ne.edu>,
	linux-kernel@...r.kernel.org, Paul Mackerras <paulus@...ba.org>,
	Ingo Molnar <mingo@...hat.com>,
	Arnaldo Carvalho de Melo <acme@...stprotocols.net>,
	trinity@...r.kernel.org
Subject: Re: [bisected] perf: yet another fuzzer triggered crash

On Wed, Jul 03, 2013 at 09:49:29AM +0200, Peter Zijlstra wrote:
> On Tue, Jul 02, 2013 at 11:15:59PM -0400, Vince Weaver wrote:
> > 
> > OK, I have bisected this problem to the following change:
> > 
> > commit 8dc85d547285668e509f86c177bcd4ea055bcaaf
> > Author: Peter Zijlstra <a.p.zijlstra@...llo.nl>
> > Date:   Thu Sep 2 16:50:03 2010 +0200
> > 
> >     perf: Multiple task contexts
> >     
> >     Provide the infrastructure for multiple task contexts.
> > 
> 
> Thanks, that narrows down the scope a bit. As it happens I was also
> narrowing down on that particular area so that's good.
> 

hi,
patch below gets rid of the warning, and probably the
crash as well

the reason seems to be when HW context is cloned based
on SW event that happened to get there because of the
HW leader, which got closed just before (fd[15] event
in the reproducer)

and the consequence is that in HW context we access
SW's cpuctx -> and thus overwriting its task_ctx variable
any time there's *sched_in routine

need to check if that does not break anything else ;-)

jirka

---
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1833bc5..1d1f030 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7465,7 +7465,7 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
 		 * child.
 		 */
 
-		child_ctx = alloc_perf_context(event->pmu, child);
+		child_ctx = alloc_perf_context(parent_ctx->pmu, child);
 		if (!child_ctx)
 			return -ENOMEM;
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/