linux-kernel - Re: [PATCH 1/1] perf/core: fix dangling cgroup pointer in cpuctx

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250604123725.GJ38114@noisy.programming.kicks-ass.net>
Date: Wed, 4 Jun 2025 14:37:25 +0200
From: Peter Zijlstra <peterz@...radead.org>
To: Yeoreum Yun <yeoreum.yun@....com>
Cc: Leo Yan <leo.yan@....com>, mingo@...hat.com, mingo@...nel.org,
	acme@...nel.org, namhyung@...nel.org, mark.rutland@....com,
	alexander.shishkin@...ux.intel.com, jolsa@...nel.org,
	irogers@...gle.com, adrian.hunter@...el.com,
	kan.liang@...ux.intel.com, linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org, David Wang <00107082@....com>
Subject: Re: [PATCH 1/1] perf/core: fix dangling cgroup pointer in cpuctx

On Wed, Jun 04, 2025 at 11:06:51AM +0100, Yeoreum Yun wrote:

> >  - EXIT means task that the even was assigned to died, but child events
> >    still live, and further children can still be created. But the event
> >    itself will never be active again. It can only transition to
> >    {REVOKED,DEAD};
> 
> I have a slight quetions. after parent event set EXIT,
> Does EXIT event should be inherited?
> 
> for example
> 
>    parent task(0, ...) -> parent_event(0, parent_event:NULL)
>      ` child_task(1, parent:0) -> child_event(1, parent_event:0)
>          ` child_task(2, parent:1) -> child_event(2, parent_event:0)
> 
> In this case when parent task(0) is exited,
> parent->event will be set as EXIT state.
> 
> But suppose the child_task(2) try to fork (child_task3) and
> inherit the event (create child_event(3, parent_event:0),
> and at the fork, forking can observe the parent event state as "EXIT".
> In thie situation why child_event(3, parent_event:0) should be created for
> child_task(3)?

Yes. You set out to monitor the whole hierarchy, so any child created
after the first task should be monitored, until such time that you close
the event.

Notably, a fair number of daemons go about their business by explicitly
closing their original task in order to detach from the tty.

Also, per the context switch optimization the original event doesn't
need to stay with the original parent, it can end up on a random child.