linux-kernel - Re: [syzbot] KASAN: use-after-free Read in task_work

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <Y338pCjXlDT8Zu3z@elver.google.com>
Date:   Wed, 23 Nov 2022 11:57:40 +0100
From:   Marco Elver <elver@...gle.com>
To:     Dmitry Vyukov <dvyukov@...gle.com>
Cc:     syzbot <syzbot+9228d6098455bb209ec8@...kaller.appspotmail.com>,
        peterz@...radead.org, Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        LKML <linux-kernel@...r.kernel.org>,
        syzkaller-bugs@...glegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in task_work_run (2)

On Wed, Nov 23, 2022 at 10:49AM +0100, Dmitry Vyukov wrote:
> On Wed, 26 Oct 2022 at 20:29, syzbot
> <syzbot+9228d6098455bb209ec8@...kaller.appspotmail.com> wrote:
> >
> > syzbot has found a reproducer for the following issue on:
> >
> > HEAD commit:    88619e77b33d net: stmmac: rk3588: Allow multiple gmac cont..
> > git tree:       bpf
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1646d6f2880000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=a66c6c673fb555e8
> > dashboard link: https://syzkaller.appspot.com/bug?extid=9228d6098455bb209ec8
> > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12bc425e880000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1126516e880000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/f8435d5c2c21/disk-88619e77.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/551d8a013e81/vmlinux-88619e77.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/7d3f5c29064d/bzImage-88619e77.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+9228d6098455bb209ec8@...kaller.appspotmail.com
> 
> Should perf task work hold a reference to the event to prevent this?

Probably should cancel the task work?

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 88619e77b33d


diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5ddc88592ff8..1457725fa8a9 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4970,10 +4970,12 @@ static bool exclusive_event_installable(struct perf_event *event,
 
 static void perf_addr_filters_splice(struct perf_event *event,
 				       struct list_head *head);
+static void perf_pending_task(struct callback_head *head);
 
 static void _free_event(struct perf_event *event)
 {
 	irq_work_sync(&event->pending_irq);
+	task_work_cancel(current, perf_pending_task);
 
 	unaccount_event(event);