linux-kernel - Re: perf: fuzzer triggers NULL pointer derefreence in x86_schedule

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 20 May 2015 15:49:22 +0200
From:	Peter Zijlstra <peterz@...radead.org>
To:	Vince Weaver <vincent.weaver@...ne.edu>
Cc:	Stephane Eranian <eranian@...gle.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Arnaldo Carvalho de Melo <acme@...nel.org>,
	Jiri Olsa <jolsa@...hat.com>, Ingo Molnar <mingo@...hat.com>,
	Paul Mackerras <paulus@...ba.org>
Subject: Re: perf: fuzzer triggers NULL pointer derefreence in
 x86_schedule_events

On Wed, May 20, 2015 at 03:03:12PM +0200, Peter Zijlstra wrote:

> Now, I've not quite figured out how that can intersect with scheduling,
> typically we only call put_event_constraints() when we're done with the
> event.

Ah, yes, I think I've found it.

We can do actual scheduling during perf_try_init_event(), and if the
event we're adding is part of an already existing event group, the group
itself might schedule and we get nested scheduling state.

This goes boom because while the cpuc we validate on is fake, the
event->hw.constraint state is 'global' and gets trampled on.

The really safe solution would be something like the below.

---
 kernel/events/core.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1a3bf48..a4f93fb 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7391,13 +7391,16 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
 		ctx = perf_event_ctx_lock_nested(event->group_leader,
 						 SINGLE_DEPTH_NESTING);
 		BUG_ON(!ctx);
+		raw_spin_lock_irq(&ctx->lock);
 	}
 
 	event->pmu = pmu;
 	ret = pmu->event_init(event);
 
-	if (ctx)
+	if (ctx) {
+		raw_spin_unlock_irq(&ctx->lock);
 		perf_event_ctx_unlock(event->group_leader, ctx);
+	}
 
 	if (ret)
 		module_put(pmu->module);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/