linux-kernel - Re: [PATCH] perf: fix use after free of perf_trace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190319093122.70bfc751@gandalf.local.home>
Date:   Tue, 19 Mar 2019 09:31:22 -0400
From:   Steven Rostedt <rostedt@...dmis.org>
To:     Prateek Sood <prsood@...eaurora.org>
Cc:     mingo@...hat.com, linux-kernel@...r.kernel.org,
        sramana@...eaurora.org, fweisbec@...il.com, jolsa@...hat.com
Subject: Re: [PATCH] perf: fix use after free of perf_trace_buf

On Tue, 19 Mar 2019 17:51:00 +0530
Prateek Sood <prsood@...eaurora.org> wrote:

> SyS_perf_event_open()
>   free_event()
>     _free_event()
>       tp_perf_event_destroy()
>         perf_trace_destroy()
>           perf_trace_event_unreg() //free perf_trace_buf
> 
> trace_cpu_frequency()
>   perf_trace_cpu()
>     perf_trace_buf_alloc() //access perf_trace_buf
> 
> 	CPU0					CPU1
> perf_trace_event_unreg()                perf_trace_cpu()
> 					head = (event_call->perf_events)
> 

But here there's a:

  tracepoint_synchronize_unregister();

Which is suppose to prevent this. Are you saying that the
tracepoint_synchronize_unregister() is broken?

-- Steve


> free_percpu(tp_event->perf_events)
> tp_event->perf_events = NULL
> --total_ref_count
> free_percpu(perf_trace_buf[i])
> perf_trace_buf[i] = NULL
> 
> 					raw_data = perf_trace_buf[rctx]
> 					memset(raw_data)
> 
> A potential race exists between access of perf_trace_buf from
> perf_trace_buf_alloc() and perf_trace_event_unreg(). This can
> result in perf_trace_buf[rctx] being NULL during access from memset()
> in perf_trace_buf_alloc().
>