linux-kernel - [tip:perf/core] perf/core: Clear sibling list of detached events

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-bbb68468641547d56c83012670bcaf77f3dacd64@git.kernel.org>
Date:   Fri, 16 Mar 2018 07:37:23 -0700
From:   tip-bot for Mark Rutland <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     mark.rutland@....com, alexey.budankov@...ux.intel.com,
        hpa@...or.com, jolsa@...hat.com, linux-kernel@...r.kernel.org,
        peterz@...radead.org, mingo@...nel.org, tglx@...utronix.de
Subject: [tip:perf/core] perf/core: Clear sibling list of detached events

Commit-ID:  bbb68468641547d56c83012670bcaf77f3dacd64
Gitweb:     https://git.kernel.org/tip/bbb68468641547d56c83012670bcaf77f3dacd64
Author:     Mark Rutland <mark.rutland@....com>
AuthorDate: Fri, 16 Mar 2018 12:51:40 +0000
Committer:  Thomas Gleixner <tglx@...utronix.de>
CommitDate: Fri, 16 Mar 2018 15:34:24 +0100

perf/core: Clear sibling list of detached events

When perf_group_dettach() is called on a group leader, it updates each
sibling's group_leader field to point to that sibling, effectively
upgrading each siblnig to a group leader. After perf_group_detach has
completed, the caller may free the leader event.

We only remove siblings from the group leader's sibling_list when the
leader has a non-empty group_node. This was fine prior to commit:

  8343aae66167df67 ("perf/core: Remove perf_event::group_entry")

... as the sibling's sibling_list would be empty. However, now that we
use the sibling_list field as both the list head and the list entry,
this leaves each sibling with a non-empty sibling list, including the
stale leader event.

If perf_group_detach() is subsequently called on a sibling, it will
appear to be a group leader, and we'll walk the sibling_list,
potentially dereferencing these stale events. In 0day testing, this has
been observed to result in kernel panics.

Let's avoid this by always removing siblings from the sibling list when
we promote them to leaders.

Fixes: 8343aae66167df67 ("perf/core: Remove perf_event::group_entry")
Signed-off-by: Mark Rutland <mark.rutland@....com>
Signed-off-by: Thomas Gleixner <tglx@...utronix.de>
Cc: vincent.weaver@...ne.edu
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: torvalds@...ux-foundation.org
Cc: Alexey Budankov <alexey.budankov@...ux.intel.com>
Cc: valery.cherepennikov@...el.com
Cc: linux-tip-commits@...r.kernel.org
Cc: eranian@...gle.com
Cc: acme@...hat.com
Cc: alexander.shishkin@...ux.intel.com
Cc: davidcc@...gle.com
Cc: kan.liang@...el.com
Cc: Dmitry.Prohorov@...el.com
Cc: Jiri Olsa <jolsa@...hat.com>
Link: https://lkml.kernel.org/r/20180316131741.3svgr64yibc6vsid@lakrids.cambridge.arm.com
---
 kernel/events/core.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 4d7a460d6669..2776a660db15 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1906,12 +1906,12 @@ static void perf_group_detach(struct perf_event *event)
 	list_for_each_entry_safe(sibling, tmp, &event->sibling_list, sibling_list) {
 
 		sibling->group_leader = sibling;
+		list_del_init(&sibling->sibling_list);
 
 		/* Inherit group flags from the previous leader */
 		sibling->group_caps = event->group_caps;
 
 		if (!RB_EMPTY_NODE(&event->group_node)) {
-			list_del_init(&sibling->sibling_list);
 			add_event_to_groups(sibling, event->ctx);
 
 			if (sibling->state == PERF_EVENT_STATE_ACTIVE) {