linux-kernel - Re: [PATCH v2] perf/core: Avoid removing shared pmu

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20180921132658.GP24106@hirez.programming.kicks-ass.net>
Date:   Fri, 21 Sep 2018 15:26:58 +0200
From:   Peter Zijlstra <peterz@...radead.org>
To:     Chris Wilson <chris@...is-wilson.co.uk>
Cc:     linux-kernel@...r.kernel.org,
        David Carrillo-Cisneros <davidcc@...gle.com>,
        Ingo Molnar <mingo@...hat.com>,
        Mark Rutland <mark.rutland@....com>,
        Will Deacon <will.deacon@....com>
Subject: Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on
 unregister

On Fri, May 12, 2017 at 12:45:25PM +0100, Chris Wilson wrote:
> In commit 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu"),
> the search for another user of the pmu_cpu_context was removed, and so
> we unconditionally free it during perf_pmu_unregister. This leads to
> random corruption later and a BUG at mm/percpu.c:689.
> 
> v2: Check for shared pmu_contexts under the mutex.
> 
> Fixes: 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu")
> Signed-off-by: Chris Wilson <chris@...is-wilson.co.uk>
> Cc: David Carrillo-Cisneros <davidcc@...gle.com>
> Cc: Peter Zijlstra (Intel) <peterz@...radead.org>
> Cc: Ingo Molnar <mingo@...hat.com>
> Cc: <stable@...r.kernel.org> # v4.11+
> ---
>  kernel/events/core.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index aaefaa27e1a6..4f60f66b35ad 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -8983,10 +8983,12 @@ EXPORT_SYMBOL_GPL(perf_pmu_register);
>  void perf_pmu_unregister(struct pmu *pmu)
>  {
>  	int remove_device;
> +	int remove_context;
>  
>  	mutex_lock(&pmus_lock);
>  	remove_device = pmu_bus_running;
>  	list_del_rcu(&pmu->entry);
> +	remove_context = !find_pmu_context(pmu->task_ctx_nr);
>  	mutex_unlock(&pmus_lock);
>  
>  	/*
> @@ -9005,7 +9007,8 @@ void perf_pmu_unregister(struct pmu *pmu)
>  		device_del(pmu->dev);
>  		put_device(pmu->dev);
>  	}
> -	free_pmu_context(pmu);
> +	if (remove_context)
> +		free_pmu_context(pmu);
>  }
>  EXPORT_SYMBOL_GPL(perf_pmu_unregister);

I was recently made aware of this patch again; which for some reason
never got resumbitted.

Looking at it I'm not at all sure it is correct.

The first clue is that only task_ctx_nr == perf_sw_context PMUs should
ever be sharing a context; which was noted in the original patch
discussion but that never made it in a comment:

  https://lkml.kernel.org/r/20170118192454.58008-3-davidcc@google.com

And the software PMUs _should_ never get unregistered. Of course it
looks like some:

  arch/powerpc/perf/imc-pmu.c
  drivers/perf/arm_spe_pmu.c

seem to do just that. But I doubt you're running with any of those
drivers active.

Aah, it looks like Will actually fixed this when he did that SPE driver,
see commit:

  df0062b27ebf ("perf/core: Avoid freeing static PMU contexts when PMU is unregistered")

Still, there is another bug there, we should not be doing idr_remove()
outside the lock.

Still, no idea what you hit and why. Or if either or both of these
patches will fix that.

---
diff --git a/kernel/events/core.c b/kernel/events/core.c
index c80549bf82c6..a7ab1d31208c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -9425,9 +9425,7 @@ static void free_pmu_context(struct pmu *pmu)
 	if (pmu->task_ctx_nr > perf_invalid_context)
 		return;
 
-	mutex_lock(&pmus_lock);
 	free_percpu(pmu->pmu_cpu_context);
-	mutex_unlock(&pmus_lock);
 }
 
 /*
@@ -9697,6 +9695,7 @@ void perf_pmu_unregister(struct pmu *pmu)
 	synchronize_srcu(&pmus_srcu);
 	synchronize_rcu();
 
+	mutex_lock(&pmus_lock);
 	free_percpu(pmu->pmu_disable_count);
 	if (pmu->type >= PERF_TYPE_MAX)
 		idr_remove(&pmu_idr, pmu->type);
@@ -9707,6 +9706,7 @@ void perf_pmu_unregister(struct pmu *pmu)
 		put_device(pmu->dev);
 	}
 	free_pmu_context(pmu);
+	mutex_unlock(&pmus_lock);
 }
 EXPORT_SYMBOL_GPL(perf_pmu_unregister);