From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933431AbbLHQWx (ORCPT ); Tue, 8 Dec 2015 11:22:53 -0500 Received: from bombadil.infradead.org ([198.137.202.9]:56377 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932402AbbLHQWd (ORCPT ); Tue, 8 Dec 2015 11:22:33 -0500 Date: Tue, 8 Dec 2015 17:22:27 +0100 From: Peter Zijlstra To: Dmitry Vyukov Cc: Ingo Molnar , Arnaldo Carvalho de Melo , LKML , syzkaller , Kostya Serebryany , Alexander Potapenko , Eric Dumazet , Sasha Levin Subject: Re: use-after-free in __perf_install_in_context Message-ID: <20151208162227.GB6357@twins.programming.kicks-ass.net> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.5.21 (2012-12-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, Dec 04, 2015 at 09:04:35PM +0100, Dmitry Vyukov wrote: > Hello, > > While running syzkaller fuzzer I am seeing lots of the following > use-after-free reports. Unfortunately all my numerous attempts to > reproduce them in a controlled environment failed. They pop up during > fuzzing periodically (once in several hours in a single VM), but > whenever I try to stress-replay what happened in the VM before the > report, the use-after-free does not reproduce. Typical that :/ > Can somebody knowledgeable in perf subsystem look at the report? Maybe > it is possible to figure out what happened based purely on the report. > I can pretty reliably test any proposed fixes. So I'm still going over the code, but meanwhile I tried reproducing this using the perf_fuzzer and some debug code, but no luck with that. Since you seem to be able to reproduce, could you do a run with the below patch in to see if it tickles something? --- diff --git a/kernel/events/core.c b/kernel/events/core.c index 36babfd..58e504c 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -872,13 +872,22 @@ static void free_ctx(struct rcu_head *head) kfree(ctx); } +#define for_each_task_context_nr(ctxn) \ + for ((ctxn) = 0; (ctxn) < perf_nr_task_contexts; (ctxn)++) + static void put_ctx(struct perf_event_context *ctx) { if (atomic_dec_and_test(&ctx->refcount)) { if (ctx->parent_ctx) put_ctx(ctx->parent_ctx); - if (ctx->task) + if (ctx->task) { + int ctxn; + + for_each_task_context_nr(ctxn) + WARN_ON(ctx->task->perf_event_ctxp[ctxn] == ctx); + put_task_struct(ctx->task); + } call_rcu(&ctx->rcu_head, free_ctx); } } @@ -2649,9 +2658,6 @@ static void perf_pmu_sched_task(struct task_struct *prev, static void perf_event_switch(struct task_struct *task, struct task_struct *next_prev, bool sched_in); -#define for_each_task_context_nr(ctxn) \ - for ((ctxn) = 0; (ctxn) < perf_nr_task_contexts; (ctxn)++) - /* * Called from scheduler to remove the events of the current task, * with interrupts disabled. @@ -8931,6 +8937,8 @@ again: mutex_unlock(&ctx->mutex); + task->perf_event_ctxp[ctxn] = NULL; + put_ctx(ctx); } }