linux-kernel - Re: [PATCH v2] fix use-after-free in perf_sched_

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190522110823.GR8945@kernel.org>
Date:   Wed, 22 May 2019 08:08:23 -0300
From:   Arnaldo Carvalho de Melo <arnaldo.melo@...il.com>
To:     Wei Li <liwei391@...wei.com>
Cc:     Namhyung Kim <namhyung@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...nel.org>, Jiri Olsa <jolsa@...nel.org>,
        linux-kernel@...r.kernel.org, xiezhipeng1@...wei.com
Subject: Re: [PATCH v2] fix use-after-free in perf_sched__lat

Em Wed, May 22, 2019 at 03:56:10PM +0900, Namhyung Kim escreveu:
> On Wed, May 08, 2019 at 10:36:48PM +0800, Wei Li wrote:
> > After thread is added to machine->threads[i].dead in
> > __machine__remove_thread, the machine->threads[i].dead is freed
> > when calling free(session) in perf_session__delete(). So it get a
> > Segmentation fault when accessing it in thread__put().
> > 
> > In this patch, we delay the perf_session__delete until all threads
> > have been deleted.
> > 
> > This can be reproduced by following steps:
> > 	ulimit -c unlimited
> > 	export MALLOC_MMAP_THRESHOLD_=0
> > 	perf sched record sleep 10
> > 	perf sched latency --sort max
> > 	Segmentation fault (core dumped)
> > 
> > Signed-off-by: Zhipeng Xie <xiezhipeng1@...wei.com>
> > Signed-off-by: Wei Li <liwei391@...wei.com>
> 
> Acked-by: Namhyung Kim <namhyung@...nel.org>

I'll try to analyse this one soon, but my first impression was that we
should just grab reference counts when keeping a pointer to those
threads instead of keeping _all_ threads alive when supposedly we could
trow away unreferenced data structures.

But this is just a first impression from just reading the patch
description, probably I'm missing something.

Thanks for providing instructions on readily triggering the segfault.

- Arnaldo