linux-kernel - [PATCH 6.1.y] perf/core: Fix possible deadlock in sys_perf_event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 07 Sep 2023 00:38:21 +0800
From:   "李棒(伯兮)" <libang.li@...group.com>
To:     peterz@...radead.org, mingo@...hat.com, acme@...nel.org,
        mark.rutland@....com, alexander.shishkin@...ux.intel.com,
        jolsa@...nel.org, namhyung@...nel.org
Cc:     <gregkh@...uxfoundation.org>, <linux-perf-users@...r.kernel.org>,
        <linux-kernel@...r.kernel.org>,
        "李棒(伯兮)" <libang.li@...group.com>
Subject: [PATCH 6.1.y] perf/core: Fix possible deadlock in sys_perf_event_open()

In certain scenarios, gctx and ctx may be equal in the
__perf_event_ctx_lock_double() function, resulting in a deadlock.

Thread 1, thread 2 and thread 3 belong to the same process, and the
process number is assumed to be M. The deadlock scenario is as follows:

1) Thread 1 creates a pure software group through the system call
   sys_perf_event_open() and returns an fd, assuming the value of fd is N.
   The parameters of sys_perf_event_open() are as follows.

   For example:
    perf_event_attr.type = PERF_TYPE_SOFTWARE;
    pid = M;
    cpu = 0;
    group_fd = -1;
    flags = 0;
    N = sys_perf_event_open(&perf_event_attr, pid, cpu, group_fd, flags);

2) Thread 2 and thread 3 call the perf_event_open() function concurrently
   with the same parameters on a different cpu. And use the fd generated
   by thread 1 as group_fd. The parameters of sys_perf_event_open() are
   as follows.

   For example:
    perf_event_attr.type = PERF_TYPE_HARDWARE;
    pid = M;
    cpu = 0;
    group_fd = N;
    flags = 0;
    sys_perf_event_open(&perf_event_attr, pid, cpu, group_fd, flags);

3) In the __perf_event_ctx_lock_double function, assuming that thread 2
   successfully acquires gctx->mutex and ctx->mutex first, thread 3 will
   wait here. At the same time, thread 2 will move the pure software gruop
   to the hardware context and change group_leader->ctx to the hardware
   context.

4) When thread 2 releases gctx->mutex and ctx->mutex, thread 3 acquires
   gctx->mutex and ctx->mutex. And find that group_leader->ctx != gctx,
   then reacquires gctx. At this time, gctx is equal to the ctx of thread
   3, triggering a deadlock.

Fixes: 321027c1fe77 ("perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race")
Signed-off-by: Bang Li <libang.li@...group.com>
---
 kernel/events/core.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index db1065daabb6..8af980cdd3a5 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -12161,6 +12161,11 @@ __perf_event_ctx_lock_double(struct perf_event *group_leader,
 	}
 	rcu_read_unlock();

+	if (gctx == ctx) {
+		put_ctx(gctx);
+		return NULL;
+	}
+
 	mutex_lock_double(&gctx->mutex, &ctx->mutex);

 	if (group_leader->ctx != gctx) {
@@ -12465,6 +12470,11 @@ SYSCALL_DEFINE5(perf_event_open,

 	if (move_group) {
 		gctx = __perf_event_ctx_lock_double(group_leader, ctx);
+		if (unlikely(!gctx)) {
+			mutex_lock(&ctx->mutex);
+			move_group = 0;
+			goto not_move_group;
+		}

 		if (gctx->task == TASK_TOMBSTONE) {
 			err = -ESRCH;
-- 
2.19.1.6.gb485710b