linux-kernel - Re: [PATCH 6.1.y] perf/core: Fix possible deadlock in sys_perf_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <2023090652-obsessed-scrutiny-d388@gregkh>
Date:   Wed, 6 Sep 2023 20:46:02 +0100
From:   Greg KH <gregkh@...uxfoundation.org>
To:     李棒(伯兮) <libang.li@...group.com>
Cc:     peterz@...radead.org, mingo@...hat.com, acme@...nel.org,
        mark.rutland@....com, alexander.shishkin@...ux.intel.com,
        jolsa@...nel.org, namhyung@...nel.org,
        linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH 6.1.y] perf/core: Fix possible deadlock in
 sys_perf_event_open()

On Thu, Sep 07, 2023 at 12:38:21AM +0800, 李棒(伯兮) wrote:
> In certain scenarios, gctx and ctx may be equal in the
> __perf_event_ctx_lock_double() function, resulting in a deadlock.
> 
> Thread 1, thread 2 and thread 3 belong to the same process, and the
> process number is assumed to be M. The deadlock scenario is as follows:
> 
> 1) Thread 1 creates a pure software group through the system call
>    sys_perf_event_open() and returns an fd, assuming the value of fd is N.
>    The parameters of sys_perf_event_open() are as follows.
> 
>    For example:
>     perf_event_attr.type = PERF_TYPE_SOFTWARE;
>     pid = M;
>     cpu = 0;
>     group_fd = -1;
>     flags = 0;
>     N = sys_perf_event_open(&perf_event_attr, pid, cpu, group_fd, flags);
> 
> 2) Thread 2 and thread 3 call the perf_event_open() function concurrently
>    with the same parameters on a different cpu. And use the fd generated
>    by thread 1 as group_fd. The parameters of sys_perf_event_open() are
>    as follows.
> 
>    For example:
>     perf_event_attr.type = PERF_TYPE_HARDWARE;
>     pid = M;
>     cpu = 0;
>     group_fd = N;
>     flags = 0;
>     sys_perf_event_open(&perf_event_attr, pid, cpu, group_fd, flags);
> 
> 3) In the __perf_event_ctx_lock_double function, assuming that thread 2
>    successfully acquires gctx->mutex and ctx->mutex first, thread 3 will
>    wait here. At the same time, thread 2 will move the pure software gruop
>    to the hardware context and change group_leader->ctx to the hardware
>    context.
> 
> 4) When thread 2 releases gctx->mutex and ctx->mutex, thread 3 acquires
>    gctx->mutex and ctx->mutex. And find that group_leader->ctx != gctx,
>    then reacquires gctx. At this time, gctx is equal to the ctx of thread
>    3, triggering a deadlock.
> 
> Fixes: 321027c1fe77 ("perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race")
> Signed-off-by: Bang Li <libang.li@...group.com>
> ---
>  kernel/events/core.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 

<formletter>

This is not the correct way to submit patches for inclusion in the
stable kernel tree.  Please read:
    https://www.kernel.org/doc/html/latest/process/stable-kernel-rules.html
for how to do this properly.

</formletter>