linux-kernel - Re: [peterz-queue:perf/pmu-unregister] [perf] 4cbf3df69c: BUG:kernel_NULL_pointer

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20241025082017.GF14555@noisy.programming.kicks-ass.net>
Date: Fri, 25 Oct 2024 10:20:17 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: kernel test robot <oliver.sang@...el.com>
Cc: oe-lkp@...ts.linux.dev, lkp@...el.com, linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [peterz-queue:perf/pmu-unregister] [perf] 4cbf3df69c:
 BUG:kernel_NULL_pointer_dereference,address

On Fri, Oct 25, 2024 at 10:19:41AM +0800, kernel test robot wrote:
> 
> 
> Hello,
> 
> kernel test robot noticed "BUG:kernel_NULL_pointer_dereference,address" on:
> 
> commit: 4cbf3df69c5697061018989b08423d4c04bbe101 ("perf: Make perf_pmu_unregister() useable")
> https://git.kernel.org/cgit/linux/kernel/git/peterz/queue.git perf/pmu-unregister
> 
> in testcase: trinity
> version: trinity-x86_64-ba2360ed-1_20240923
> with following parameters:
> 
> 	runtime: 600s
> 
> 
> 
> config: x86_64-kexec
> compiler: clang-18
> test machine: qemu-system-x86_64 -enable-kvm -cpu SandyBridge -smp 2 -m 16G
> 
> (please refer to attached dmesg/kmsg for entire log/backtrace)
> 
> 
> +-----------------------------------------------------------+------------+------------+
> |                                                           | d4187ab34e | 4cbf3df69c |
> +-----------------------------------------------------------+------------+------------+
> | BUG:kernel_NULL_pointer_dereference,address               | 0          | 15         |
> | Oops                                                      | 0          | 15         |
> | RIP:__free_event                                          | 0          | 15         |
> | Kernel_panic-not_syncing:Fatal_exception                  | 0          | 15         |
> +-----------------------------------------------------------+------------+------------+
> 
> 
> If you fix the issue in a separate patch/commit (i.e. not just a new version of
> the same patch/commit), kindly add following tags
> | Reported-by: kernel test robot <oliver.sang@...el.com>
> | Closes: https://lore.kernel.org/oe-lkp/202410251048.2505fe51-lkp@intel.com
> 
> 
> [   27.301103][ T3733] BUG: kernel NULL pointer dereference, address: 0000000000000008
> [   27.302392][ T3733] #PF: supervisor write access in kernel mode
> [   27.303317][ T3733] #PF: error_code(0x0002) - not-present page
> [   27.304207][ T3733] PGD 80000001bfbc3067 P4D 80000001bfbc3067 PUD 1ae899067 PMD 0
> [   27.305417][ T3733] Oops: Oops: 0002 [#1] PREEMPT SMP PTI
> [   27.306260][ T3733] CPU: 0 UID: 65534 PID: 3733 Comm: trinity-c0 Not tainted 6.12.0-rc2-00028-g4cbf3df69c56 #1
> [   27.307747][ T3733] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.16.2-debian-1.16.2-1 04/01/2014
> [ 27.309232][ T3733] RIP: 0010:__free_event (include/linux/list.h:195 include/linux/list.h:218 include/linux/list.h:229 kernel/events/core.c:5395) 

> [ 27.334428][ T3733] ? __free_event (include/linux/list.h:195 include/linux/list.h:218 include/linux/list.h:229 kernel/events/core.c:5395) 
> [ 27.335253][ T3733] ? __free_event (include/linux/list.h:218 include/linux/list.h:229 kernel/events/core.c:5395) 
> [ 27.336027][ T3733] perf_event_alloc (kernel/events/core.c:12566) 
> [ 27.336836][ T3733] __se_sys_perf_event_open (kernel/events/core.c:12978) 
> [ 27.337703][ T3733] ? enqueue_hrtimer (kernel/time/hrtimer.c:1093) 
> [ 27.338512][ T3733] ? hrtimer_start_range_ns (kernel/time/hrtimer.c:1302) 
> [ 27.339427][ T3733] do_syscall_64 (arch/x86/entry/common.c:?) 
> [ 27.340215][ T3733] ? irqentry_exit_to_user_mode (arch/x86/include/asm/processor.h:701 arch/x86/include/asm/entry-common.h:100 include/linux/entry-common.h:364 kernel/entry/common.c:233) 

This might help... Let me fold that and push out an updated brranch.

--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -12395,6 +12395,7 @@ perf_event_alloc(struct perf_event_attr
 	INIT_LIST_HEAD(&event->active_entry);
 	INIT_LIST_HEAD(&event->addr_filters.list);
 	INIT_HLIST_NODE(&event->hlist_entry);
+	INIT_LIST_HEAD(&event->pmu_list);
 
 
 	init_waitqueue_head(&event->waitq);