linux-kernel - Re: [tip: perf/urgent] perf: Fix perf_event_validate

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 15 Dec 2023 20:59:11 +0800
From: Pengfei Xu <pengfei.xu@...el.com>
To: "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
CC: "linux-tip-commits@...r.kernel.org" <linux-tip-commits@...r.kernel.org>,
	"De Marchi, Lucas" <lucas.demarchi@...el.com>, Mark Rutland
	<mark.rutland@....com>, "Peter Zijlstra (Intel)" <peterz@...radead.org>,
	"x86@...nel.org" <x86@...nel.org>
Subject: Re: [tip: perf/urgent] perf: Fix perf_event_validate_size() lockdep
 splat

Hi,

I tested the following patch on top of v6.7-rc5 kernel.
This perf issue was gone.
It's fixed.
Attached is the fixed dmesg log.

Thanks!


On 2023-12-15 at 19:42:58 +0800, tip-bot2 for Mark Rutland wrote:
> The following commit has been merged into the perf/urgent branch of tip:
> 
> Commit-ID:     7e2c1e4b34f07d9aa8937fab88359d4a0fce468e
> Gitweb:        https://git.kernel.org/tip/7e2c1e4b34f07d9aa8937fab88359d4a0fce468e
> Author:        Mark Rutland <mark.rutland@....com>
> AuthorDate:    Fri, 15 Dec 2023 11:24:50 
> Committer:     Peter Zijlstra <peterz@...radead.org>
> CommitterDate: Fri, 15 Dec 2023 12:33:23 +01:00
> 
> perf: Fix perf_event_validate_size() lockdep splat
> 
> When lockdep is enabled, the for_each_sibling_event(sibling, event)
> macro checks that event->ctx->mutex is held. When creating a new group
> leader event, we call perf_event_validate_size() on a partially
> initialized event where event->ctx is NULL, and so when
> for_each_sibling_event() attempts to check event->ctx->mutex, we get a
> splat, as reported by Lucas De Marchi:
> 
>   WARNING: CPU: 8 PID: 1471 at kernel/events/core.c:1950 __do_sys_perf_event_open+0xf37/0x1080
> 
> This only happens for a new event which is its own group_leader, and in
> this case there cannot be any sibling events. Thus it's safe to skip the
> check for siblings, which avoids having to make invasive and ugly
> changes to for_each_sibling_event().
> 
> Avoid the splat by bailing out early when the new event is its own
> group_leader.
> 
> Fixes: 382c27f4ed28f803 ("perf: Fix perf_event_validate_size()")
> Closes: https://lore.kernel.org/lkml/20231214000620.3081018-1-lucas.demarchi@intel.com/
> Closes: https://lore.kernel.org/lkml/ZXpm6gQ%2Fd59jGsuW@xpf.sh.intel.com/
> Reported-by: Lucas De Marchi <lucas.demarchi@...el.com>
> Reported-by: Pengfei Xu <pengfei.xu@...el.com>
> Signed-off-by: Mark Rutland <mark.rutland@....com>
> Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
> Link: https://lkml.kernel.org/r/20231215112450.3972309-1-mark.rutland@arm.com
> ---
>  kernel/events/core.c | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index c9d123e..9efd0d7 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -1947,6 +1947,16 @@ static bool perf_event_validate_size(struct perf_event *event)
>  				   group_leader->nr_siblings + 1) > 16*1024)
>  		return false;
>  
> +	/*
> +	 * When creating a new group leader, group_leader->ctx is initialized
> +	 * after the size has been validated, but we cannot safely use
> +	 * for_each_sibling_event() until group_leader->ctx is set. A new group
> +	 * leader cannot have any siblings yet, so we can safely skip checking
> +	 * the non-existent siblings.
> +	 */
> +	if (event == group_leader)
> +		return true;
> +
>  	for_each_sibling_event(sibling, group_leader) {
>  		if (__perf_event_read_size(sibling->attr.read_format,
>  					   group_leader->nr_siblings + 1) > 16*1024)

Tested-by: Pengfei Xu <pengfei.xu@...el.com>


View attachment "v6.5-rc7_perf_fix_pass.log" of type "text/plain" (38157 bytes)