linux-kernel - Re: [PATCH] perf: Don't enable the perf_event without in PERF_ATTACH

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20140714132756.GY19379@twins.programming.kicks-ass.net>
Date:	Mon, 14 Jul 2014 15:27:56 +0200
From:	Peter Zijlstra <peterz@...radead.org>
To:	Chen LinX <linx.z.chen@...el.com>
Cc:	paulus@...ba.org, mingo@...hat.com, acme@...stprotocols.net,
	linux-kernel@...r.kernel.org, yanmin_zhang@...ux.intel.com,
	Yanmin Zhang <yanmin.zhang@...el.com>
Subject: Re: [PATCH] perf: Don't enable the perf_event without in
 PERF_ATTACH_CONTEXT status

On Thu, Jul 03, 2014 at 11:36:38AM +0800, Chen LinX wrote:
> From: "Chen LinX" <linx.z.chen@...el.com>
> 
> when do cpu hotplug test and run below perf test together, pmu may access freed perf_event
> 
> while true;
> do
> perf record -a -g -f sleep 10
> rm perf.*
> done
> 
> the scenario is that when cpu offline firstly, the 'perf_cpu_notify' will disable event on the
> pmu and remove it from the context list. after cpu online, the perf app may enable the event

But it does not, right?

> that without linked in context list again. when cpu offine the second time, the 'perf_cpu_notify'
> can't disable event on the pmu as the event doesn't link to context list. the perf app may free
> this event later(the free procedure try to disable event on the pmu but as the cpu is offline,
> the 'cpu_function_call(event->cpu, __perf_remove_from_context, event)' is failed)

Failed how, below is __perf_install_in_context.

> . then after
> cpu online again, pmu will access freed perf_event and hit panic.
> 
> so adding PERF_ATTACH_CONTEXT flag check before enable event to avoid this scenario.

In fact it does not. If you look at perf_event_enable() there's a code
path that doesn't call __perf_event_enable().

> [  157.670138 ]  [<ffffffff8216321f>] __perf_install_in_context+0xff/0x170

And yet, __perf_install_in_context isn't mentioned at all in the above.

> Change-Id: I7265d83159b9180e9be3a370ba50e067385547bd
> Signed-off-by: Yanmin Zhang <yanmin.zhang@...el.com>
> Signed-off-by: Chen LinX <linx.z.chen@...el.com>

Wrong SoB-chain, Yanmin didn't author this patch did he, seeing how From
is you. And Yanmin didn't actually send me this patch either.

Content of type "application/pgp-signature" skipped