| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <57fa247d-9c85-4f20-9723-d568272651f9@amd.com>
Date: Thu, 13 Feb 2025 13:22:55 +0530
From: Ravi Bangoria <ravi.bangoria@....com>
To: Peter Zijlstra <peterz@...radead.org>
Cc: mingo@...nel.org, lucas.demarchi@...el.com, linux-kernel@...r.kernel.org,
willy@...radead.org, acme@...nel.org, namhyung@...nel.org,
mark.rutland@....com, alexander.shishkin@...ux.intel.com, jolsa@...nel.org,
irogers@...gle.com, adrian.hunter@...el.com, kan.liang@...ux.intel.com,
Ravi Bangoria <ravi.bangoria@....com>
Subject: Re: [PATCH v2 24/24] perf: Make perf_pmu_unregister() useable
> Does this work?
>
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -2303,6 +2303,7 @@ static void perf_child_detach(struct per
>
> sync_child_event(event);
> list_del_init(&event->child_list);
> + event->parent = NULL;
> }
>
> static bool is_orphaned_event(struct perf_event *event)
Apparently not, it ends up with:
------------[ cut here ]------------
WARNING: CPU: 145 PID: 5459 at kernel/events/core.c:281 event_function+0xd2/0xf0
Modules linked in: [...]
CPU: 145 UID: 1002 PID: 5459 Comm: perf_fuzzer Kdump: loaded Not tainted 6.14.0-rc1-pmu-unregister+ #244
Hardware name: AMD Corporation RUBY/RUBY, BIOS RRR1009C 07/21/2023
RIP: 0010:event_function+0xd2/0xf0
Code: [...]
RSP: 0018:ffa000000647fac8 EFLAGS: 00010046
RAX: 0000000000000000 RBX: ff1100100d4b0ee0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffa000000647faf0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffa000000647fbb8
R13: 0000000000000000 R14: ff11000104cc9e00 R15: ff110001216fcec0
FS: 000070acabcae740(0000) GS:ff1100100d480000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000011d920005 CR4: 0000000000f71ff0
PKRU: 55555554
Call Trace:
<TASK>
? show_regs+0x6c/0x80
? __warn+0x8d/0x150
? event_function+0xd2/0xf0
? report_bug+0x182/0x1b0
? handle_bug+0x6e/0xb0
? exc_invalid_op+0x18/0x80
? asm_exc_invalid_op+0x1b/0x20
? event_function+0xd2/0xf0
? event_function+0x3d/0xf0
remote_function+0x4f/0x70
? __pfx_remote_function+0x10/0x10
generic_exec_single+0x7f/0x160
smp_call_function_single+0x110/0x160
? __pfx_remote_function+0x10/0x10
? ktime_get_ts64+0x49/0x150
event_function_call+0x98/0x1d0
? __pfx___perf_event_disable+0x10/0x10
? __pfx___perf_event_disable+0x10/0x10
? __pfx_event_function+0x10/0x10
? __pfx__perf_event_disable+0x10/0x10
_perf_event_disable+0x41/0x70
perf_event_for_each_child+0x40/0x90
? __pfx__perf_event_disable+0x10/0x10
_perf_ioctl+0xac/0xb00
? srso_alias_return_thunk+0x5/0xfbef5
? place_entity+0xa7/0x170
? srso_alias_return_thunk+0x5/0xfbef5
? __x2apic_send_IPI_dest+0x32/0x50
? srso_alias_return_thunk+0x5/0xfbef5
? x2apic_send_IPI+0x26/0x40
? srso_alias_return_thunk+0x5/0xfbef5
? native_send_call_func_single_ipi+0x13/0x20
? srso_alias_return_thunk+0x5/0xfbef5
? __smp_call_single_queue+0xf7/0x180
? srso_alias_return_thunk+0x5/0xfbef5
? generic_exec_single+0x38/0x160
? srso_alias_return_thunk+0x5/0xfbef5
? smp_call_function_single_async+0x22/0x50
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? mutex_lock+0x12/0x50
perf_ioctl+0x45/0x80
__x64_sys_ioctl+0xa7/0xe0
x64_sys_call+0x131e/0x2650
do_syscall_64+0x7e/0x170
? srso_alias_return_thunk+0x5/0xfbef5
? rcu_core+0x1d1/0x3a0
? srso_alias_return_thunk+0x5/0xfbef5
? rcu_core_si+0xe/0x20
? srso_alias_return_thunk+0x5/0xfbef5
? handle_softirqs+0xe7/0x330
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? irqentry_exit_to_user_mode+0x43/0x250
? srso_alias_return_thunk+0x5/0xfbef5
? irqentry_exit+0x43/0x50
? srso_alias_return_thunk+0x5/0xfbef5
? sysvec_apic_timer_interrupt+0x4f/0xc0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x70acabb24ded
Code: [...]
RSP: 002b:00007fffb3dd4a40 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fffb3dd6f28 RCX: 000070acabb24ded
RDX: 0000000066f26a61 RSI: 0000000000002401 RDI: 0000000000000013
RBP: 00007fffb3dd4a90 R08: 000070acabc03084 R09: 000070acabc030a0
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 00005e38a9ec5b60 R15: 000070acabd00000
</TASK>
---[ end trace 0000000000000000 ]---
------------[ cut here ]------------
WARNING: CPU: 145 PID: 5459 at kernel/events/core.c:286 event_function+0xd6/0xf0
Modules linked in: [...]
CPU: 145 UID: 1002 PID: 5459 Comm: perf_fuzzer Kdump: loaded Tainted: G W 6.14.0-rc1-pmu-unregister+ #244
Tainted: [W]=WARN
Hardware name: AMD Corporation RUBY/RUBY, BIOS RRR1009C 07/21/2023
RIP: 0010:event_function+0xd6/0xf0
Code: [...]
RSP: 0018:ffa000000647fac8 EFLAGS: 00010086
RAX: 0000000000000000 RBX: ff1100100d4b0ee0 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffa000000647faf0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000000 R12: ffa000000647fbb8
R13: 0000000000000000 R14: ff11000104cc9e00 R15: ff110001216fcec0
FS: 000070acabcae740(0000) GS:ff1100100d480000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffffffffff600000 CR3: 000000011d920005 CR4: 0000000000f71ff0
PKRU: 55555554
Call Trace:
<TASK>
? show_regs+0x6c/0x80
? __warn+0x8d/0x150
? event_function+0xd6/0xf0
? report_bug+0x182/0x1b0
? handle_bug+0x6e/0xb0
? exc_invalid_op+0x18/0x80
? asm_exc_invalid_op+0x1b/0x20
? event_function+0xd6/0xf0
? event_function+0x3d/0xf0
remote_function+0x4f/0x70
? __pfx_remote_function+0x10/0x10
generic_exec_single+0x7f/0x160
smp_call_function_single+0x110/0x160
? __pfx_remote_function+0x10/0x10
? ktime_get_ts64+0x49/0x150
event_function_call+0x98/0x1d0
? __pfx___perf_event_disable+0x10/0x10
? __pfx___perf_event_disable+0x10/0x10
? __pfx_event_function+0x10/0x10
? __pfx__perf_event_disable+0x10/0x10
_perf_event_disable+0x41/0x70
perf_event_for_each_child+0x40/0x90
? __pfx__perf_event_disable+0x10/0x10
_perf_ioctl+0xac/0xb00
? srso_alias_return_thunk+0x5/0xfbef5
? place_entity+0xa7/0x170
? srso_alias_return_thunk+0x5/0xfbef5
? __x2apic_send_IPI_dest+0x32/0x50
? srso_alias_return_thunk+0x5/0xfbef5
? x2apic_send_IPI+0x26/0x40
? srso_alias_return_thunk+0x5/0xfbef5
? native_send_call_func_single_ipi+0x13/0x20
? srso_alias_return_thunk+0x5/0xfbef5
? __smp_call_single_queue+0xf7/0x180
? srso_alias_return_thunk+0x5/0xfbef5
? generic_exec_single+0x38/0x160
? srso_alias_return_thunk+0x5/0xfbef5
? smp_call_function_single_async+0x22/0x50
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? mutex_lock+0x12/0x50
perf_ioctl+0x45/0x80
__x64_sys_ioctl+0xa7/0xe0
x64_sys_call+0x131e/0x2650
do_syscall_64+0x7e/0x170
? srso_alias_return_thunk+0x5/0xfbef5
? rcu_core+0x1d1/0x3a0
? srso_alias_return_thunk+0x5/0xfbef5
? rcu_core_si+0xe/0x20
? srso_alias_return_thunk+0x5/0xfbef5
? handle_softirqs+0xe7/0x330
? srso_alias_return_thunk+0x5/0xfbef5
? srso_alias_return_thunk+0x5/0xfbef5
? irqentry_exit_to_user_mode+0x43/0x250
? srso_alias_return_thunk+0x5/0xfbef5
? irqentry_exit+0x43/0x50
? srso_alias_return_thunk+0x5/0xfbef5
? sysvec_apic_timer_interrupt+0x4f/0xc0
entry_SYSCALL_64_after_hwframe+0x76/0x7e
RIP: 0033:0x70acabb24ded
Code: [...]
RSP: 002b:00007fffb3dd4a40 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
RAX: ffffffffffffffda RBX: 00007fffb3dd6f28 RCX: 000070acabb24ded
RDX: 0000000066f26a61 RSI: 0000000000002401 RDI: 0000000000000013
RBP: 00007fffb3dd4a90 R08: 000070acabc03084 R09: 000070acabc030a0
R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 00005e38a9ec5b60 R15: 000070acabd00000
</TASK>
---[ end trace 0000000000000000 ]---
watchdog: BUG: soft lockup - CPU#88 stuck for 26s! [perf_fuzzer:5740]
Modules linked in: [...]
CPU: 88 UID: 1002 PID: 5740 Comm: perf_fuzzer Kdump: loaded Tainted: G W 6.14.0-rc1-pmu-unregister+ #244
Tainted: [W]=WARN
Hardware name: AMD Corporation RUBY/RUBY, BIOS RRR1009C 07/21/2023
RIP: 0010:smp_call_function_single+0x11f/0x160
Code: [...]
RSP: 0000:ffa0000004b57ba0 EFLAGS: 00000202
RAX: 0000000000000000 RBX: ff11000153ad8000 RCX: 0000000000000000
RDX: 0000000000000011 RSI: 0000000000000000 RDI: 0000000000000000
RBP: ffa0000004b57be8 R08: 0000000000000000 R09: ffa0000004b57c20
R10: 0000000000000001 R11: ffffffff81621ef0 R12: ff11000104cc9e00
R13: ffa0000004b57c08 R14: ff1100013732af40 R15: ff1100100b830ee0
FS: 0000000000000000(0000) GS:ff1100100b800000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 00005e38a9ea8930 CR3: 0000000003440004 CR4: 0000000000f71ef0
PKRU: 55555554
Call Trace:
<IRQ>
? show_regs+0x6c/0x80
? watchdog_timer_fn+0x22b/0x2d0
? __pfx_watchdog_timer_fn+0x10/0x10
? __hrtimer_run_queues+0x112/0x2a0
? clockevents_program_event+0xc1/0x150
? hrtimer_interrupt+0xfd/0x260
? __sysvec_apic_timer_interrupt+0x56/0x130
? sysvec_apic_timer_interrupt+0x93/0xc0
</IRQ>
<TASK>
? asm_sysvec_apic_timer_interrupt+0x1b/0x20
? __pfx_remote_function+0x10/0x10
? smp_call_function_single+0x11f/0x160
? __pfx_remote_function+0x10/0x10
? event_function_call+0x115/0x1d0
? srso_alias_return_thunk+0x5/0xfbef5
event_function_call+0x98/0x1d0
? __pfx___perf_remove_from_context+0x10/0x10
? __pfx___perf_remove_from_context+0x10/0x10
? __pfx_event_function+0x10/0x10
perf_remove_from_context+0x46/0xa0
perf_event_release_kernel+0x1f3/0x210
perf_release+0x12/0x20
__fput+0xed/0x2d0
____fput+0x15/0x20
task_work_run+0x60/0xa0
do_exit+0x317/0xb00
? srso_alias_return_thunk+0x5/0xfbef5
do_group_exit+0x34/0x90
get_signal+0x934/0x940
arch_do_signal_or_restart+0x2f/0x250
? srso_alias_return_thunk+0x5/0xfbef5
? event_function+0xa4/0xf0
? __pfx_remote_function+0x10/0x10
? srso_alias_return_thunk+0x5/0xfbef5
? remote_function+0x4f/0x70
? srso_alias_return_thunk+0x5/0xfbef5
irqentry_exit_to_user_mode+0x1e0/0x250
irqentry_exit+0x43/0x50
sysvec_reschedule_ipi+0x5d/0x100
asm_sysvec_reschedule_ipi+0x1b/0x20
RIP: 0033:0x5e38a9eb87dd
Code: Unable to access opcode bytes at 0x5e38a9eb87b3.
RSP: 002b:00007fffb3dd4ae8 EFLAGS: 00000202
RAX: 0000000000001553 RBX: 00007fffb3dd6f28 RCX: 00000000000020da
RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000001
RBP: 00007fffb3dd4b00 R08: 0000000000000001 R09: 000070acabcae740
R10: 000070acabd010b8 R11: 0000000000000246 R12: 0000000000000001
R13: 0000000000000000 R14: 00005e38a9ec5b60 R15: 000070acabd00000
</TASK>
Something like below instead? I haven't tested it thoroughly though.
---
diff --git a/kernel/events/core.c b/kernel/events/core.c
index d2b87a425e75..4e131b1c37ad 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -13645,20 +13645,25 @@ perf_event_exit_event(struct perf_event *event,
unsigned long detach_flags = DETACH_EXIT;
if (parent_event) {
- /*
- * Do not destroy the 'original' grouping; because of the
- * context switch optimization the original events could've
- * ended up in a random child task.
- *
- * If we were to destroy the original group, all group related
- * operations would cease to function properly after this
- * random child dies.
- *
- * Do destroy all inherited groups, we don't care about those
- * and being thorough is better.
- */
- detach_flags |= DETACH_GROUP | DETACH_CHILD;
mutex_lock(&parent_event->child_mutex);
+ if (event->attach_state & PERF_ATTACH_CHILD) {
+ /*
+ * Do not destroy the 'original' grouping; because of the
+ * context switch optimization the original events could've
+ * ended up in a random child task.
+ *
+ * If we were to destroy the original group, all group related
+ * operations would cease to function properly after this
+ * random child dies.
+ *
+ * Do destroy all inherited groups, we don't care about those
+ * and being thorough is better.
+ */
+ detach_flags |= DETACH_GROUP | DETACH_CHILD;
+ } else {
+ mutex_unlock(&parent_event->child_mutex);
+ parent_event = NULL;
+ }
}
if (revoke)
---
Thanks,
Ravi
Powered by blists - more mailing lists