linux-kernel - Re: crash in perf_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20170131185042.GA44377@ast-mbp.thefacebook.com>
Date:   Tue, 31 Jan 2017 10:50:44 -0800
From:   Alexei Starovoitov <alexei.starovoitov@...il.com>
To:     Peter Zijlstra <peterz@...radead.org>
Cc:     linux-kernel@...r.kernel.org, Ingo Molnar <mingo@...nel.org>,
        eranian@...gle.com, davidcc@...gle.com
Subject: Re: crash in perf_event_read

On Tue, Jan 31, 2017 at 11:27:10AM +0100, Peter Zijlstra wrote:
> Subject: perf: Fix crash in perf_event_read()
> 
> Alexei had his box explode because doing read() on a package
> (rapl/uncore) event that isn't currently scheduled in ends up doing an
> out-of-bounds load.
> 
> Rework the code to more explicitly deal with event->oncpu being -1.
> 
> Reported-by: Alexei Starovoitov <alexei.starovoitov@...il.com>
> Cc: David Carrillo-Cisneros <davidcc@...gle.com>
> Cc: Stephane Eranian <eranian@...gle.com>
> Fixes: d6a2f9035bfc ("perf/core: Introduce PMU_EV_CAP_READ_ACTIVE_PKG")
> Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>

Thanks for the quick fix!
Everything is clean after several hours.
Tested-by: Alexei Starovoitov <ast@...nel.org>

>  		/*
>  		 * Purposely ignore the smp_call_function_single() return
> @@ -3702,7 +3706,8 @@ static int perf_event_read(struct perf_event *event, bool group)
>  		 * Therefore, either way, we'll have an up-to-date event count
>  		 * after this.
>  		 */

in that comment above (not shown in this diff) there is a line:
"If event->oncpu isn't a valid CPU it means..."
it doesn't match the code due to merge conflict resolution in 2cc538412a.
Probably makes sense to fix it s/event->oncpu/event_cpu/ as part of this diff.

> -		(void)smp_call_function_single(cpu_to_read, __perf_event_read, &data, 1);
> +		(void)smp_call_function_single(event_cpu, __perf_event_read, &data, 1);
> +		preempt_enable();
>  		ret = data.ret;
>  	} else if (event->state == PERF_EVENT_STATE_INACTIVE) {
>  		struct perf_event_context *ctx = event->ctx;