From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751873AbdCPMFn (ORCPT ); Thu, 16 Mar 2017 08:05:43 -0400 Received: from bombadil.infradead.org ([65.50.211.133]:46432 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751037AbdCPMFl (ORCPT ); Thu, 16 Mar 2017 08:05:41 -0400 Date: Thu, 16 Mar 2017 13:05:32 +0100 From: Peter Zijlstra To: Oleg Nesterov Cc: Dmitry Vyukov , Ingo Molnar , Arnaldo Carvalho de Melo , Alexander Shishkin , LKML , Mathieu Desnoyers , syzkaller Subject: Re: perf: use-after-free in perf_release Message-ID: <20170316120532.oo3lbz5nphziffnj@hirez.programming.kicks-ass.net> References: <20170307165131.GA6097@redhat.com> <20170314125508.GK3343@twins.programming.kicks-ass.net> <20170314140302.GA28146@redhat.com> <20170314140754.GG3328@twins.programming.kicks-ass.net> <20170314143010.GA30351@redhat.com> <20170314150241.GO5680@worktop> <20170314151910.GA31766@redhat.com> <20170314152625.GP5680@worktop> <20170314155949.GE32474@worktop> <20170315164302.GA17317@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170315164302.GA17317@redhat.com> User-Agent: NeoMutt/20170113 (1.7.2) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Wed, Mar 15, 2017 at 05:43:02PM +0100, Oleg Nesterov wrote: > On 03/14, Peter Zijlstra wrote: > > > > --- a/kernel/events/core.c > > +++ b/kernel/events/core.c > > @@ -10346,6 +10346,17 @@ void perf_event_free_task(struct task_struct *task) > > continue; > > > > mutex_lock(&ctx->mutex); > > + raw_spin_lock_irq(&ctx->lock); > > + /* > > + * Destroy the task <-> ctx relation and mark the context dead. > > + * > > + * This is important because even though the task hasn't been > > + * exposed yet the context has been (through child_list). > > + */ > > + RCU_INIT_POINTER(task->perf_event_ctxp[ctxn], NULL); > > + WRITE_ONCE(ctx->task, TASK_TOMBSTONE); > > + put_task_struct(task); /* cannot be last */ > > + raw_spin_unlock_irq(&ctx->lock); > > Agreed, this is what I had in mind. Although you know, I spent 3 > hours looking at your patch and I still can't convince myself I am > really sure it closes all races ;) Ha; yes I know that feeling. I used to have a few sheets of paper filled with diagrams. Sadly I could not find them again. Must've been over eager cleaning my desk at some point. > > OK, I believe this is correct. And iiuc both RCU_INIT_POINTER(NULL) > and put_task_struct() are not strictly necessary? At least until we > add WARN_ON(tsk->usage != 2) before free_task() in copy process(). Right; I just kept the code similar to the other location. I even considered making a helper function to not duplicate, but in the end decided against it. > --------------------------------------------------------------------- > This is off-topic, but to me list_for_each_entry(event->child_list) > in perf_event_release_kernel() looks very confusing and misleading. > And list_first_entry_or_null(), we do not really need NULL if list > is empty, tmp == child should be F even if we use list_first_entry(). > And given that we already have list_is_last(), it would be nice to > add list_is_first() and cleanup perf_event_release_kernel() a bit: > Agreed; its a bit of a weird one. Let me go write proper patches for the things we have so far though.