From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-15.7 required=3.0 tests=BAYES_00,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_CR_TRAILER, INCLUDES_PATCH,MAILING_LIST_MULTI,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 89EDBC4167B for ; Tue, 8 Dec 2020 08:35:31 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by mail.kernel.org (Postfix) with ESMTP id 547AE23A84 for ; Tue, 8 Dec 2020 08:35:31 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728279AbgLHIfV (ORCPT ); Tue, 8 Dec 2020 03:35:21 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39180 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727943AbgLHIfU (ORCPT ); Tue, 8 Dec 2020 03:35:20 -0500 Received: from casper.infradead.org (casper.infradead.org [IPv6:2001:8b0:10b:1236::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id A9E71C061749 for ; Tue, 8 Dec 2020 00:34:40 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=infradead.org; s=casper.20170209; h=In-Reply-To:Content-Type:MIME-Version: References:Message-ID:Subject:Cc:To:From:Date:Sender:Reply-To: Content-Transfer-Encoding:Content-ID:Content-Description; bh=5eN9bOq5BisU3LrIXD+xvKeOuXnCMEoU0VfsvsdlUUA=; b=U93NTA6VG6BYwoSv/DlNn0AMK5 hxtekoS7zDnZD5Pvsw1MCoJQMJXE9hVfITYKRS+mzx6VEnXF0cCeuaHa9aqe6NFdkOcpuwT4uBBVc hm8xMZNszIu7RUydx5CUFMRGQAfXcT4eEAVwVAdjIzxQ9KONR1PoCp8z/A6yPTrhE/B86hSZlMXM/ xc2rVIhMbSczGsd227jdPY1BqMEq5Y7gFkpogSszahJERedv/rHAW6tqzUKD688V2yMmcXYrqzVYp vobr+TtDruvgK5uxrfHK6zhClr/spAEl1yy6hIwcpJsgUWlYLKA2cYyIG3yw7Cxt2vMSiA+sP8sKf z3Tosqsw==; Received: from j217100.upc-j.chello.nl ([24.132.217.100] helo=noisy.programming.kicks-ass.net) by casper.infradead.org with esmtpsa (Exim 4.92.3 #3 (Red Hat Linux)) id 1kmYRr-0005IT-84; Tue, 08 Dec 2020 08:34:17 +0000 Received: from hirez.programming.kicks-ass.net (hirez.programming.kicks-ass.net [192.168.1.225]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (Client did not present a certificate) by noisy.programming.kicks-ass.net (Postfix) with ESMTPS id 2717A3059C6; Tue, 8 Dec 2020 09:34:13 +0100 (CET) Received: by hirez.programming.kicks-ass.net (Postfix, from userid 1000) id 06FF320815F05; Tue, 8 Dec 2020 09:34:12 +0100 (CET) Date: Tue, 8 Dec 2020 09:34:12 +0100 From: Peter Zijlstra To: Linus Torvalds Cc: Bernd Edlinger , "Eric W. Biederman" , Linux Kernel Mailing List , Ingo Molnar , Will Deacon , Jann Horn , Vasiliy Kulikov , Al Viro , Oleg Nesterov , Cyrill Gorcunov , Sargun Dhillon , Christian Brauner , Arnd Bergmann , Arnaldo Carvalho de Melo , Waiman Long , Davidlohr Bueso Subject: [PATCH] perf: Break deadlock involving exec_update_mutex Message-ID: <20201208083412.GR2414@hirez.programming.kicks-ass.net> References: <87tut2bqik.fsf@x220.int.ebiederm.org> <87ft4mbqen.fsf@x220.int.ebiederm.org> <875z5h4b7a.fsf@x220.int.ebiederm.org> <20201207090953.GF3040@hirez.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Dec 07, 2020 at 10:40:11AM -0800, Linus Torvalds wrote: > On Mon, Dec 7, 2020 at 1:10 AM Peter Zijlstra wrote: > > > > > PeterZ, is there something I'm missing? > > > > Like this? > > > > https://lkml.kernel.org/r/20200828123720.GZ1362448@hirez.programming.kicks-ass.net > > Yes, except I think you should remove the old ptrace_may_access() check. > I don't see any point at all in checking privileges twice, and I do > see real downsides. Not just that KCSAN issue, but also lack of > coverage (ie the second check will then effectively never be tested, > which is bad too). Fair enough, find below. I suppose I'll queue the below into tip/perf/core for next merge window, unless you want it in a hurry? --- Subject: perf: Break deadlock involving exec_update_mutex From: Peter Zijlstra Date: Fri, 28 Aug 2020 14:37:20 +0200 Syzbot reported a lock inversion involving perf. The sore point being perf holding exec_update_mutex() for a very long time, specifically across a whole bunch of filesystem ops in pmu::event_init() (uprobes) and anon_inode_getfile(). This then inverts against procfs code trying to take exec_update_mutex. Move the permission checks later, such that we need to hold the mutex over less code. Reported-by: syzbot+db9cdf3dd1f64252c6ef@syzkaller.appspotmail.com Signed-off-by: Peter Zijlstra (Intel) --- kernel/events/core.c | 46 +++++++++++++++++++++++----------------------- 1 file changed, 23 insertions(+), 23 deletions(-) --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -11832,24 +11832,6 @@ SYSCALL_DEFINE5(perf_event_open, goto err_task; } - if (task) { - err = mutex_lock_interruptible(&task->signal->exec_update_mutex); - if (err) - goto err_task; - - /* - * Preserve ptrace permission check for backwards compatibility. - * - * We must hold exec_update_mutex across this and any potential - * perf_install_in_context() call for this new event to - * serialize against exec() altering our credentials (and the - * perf_event_exit_task() that could imply). - */ - err = -EACCES; - if (!perfmon_capable() && !ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) - goto err_cred; - } - if (flags & PERF_FLAG_PID_CGROUP) cgroup_fd = pid; @@ -11857,7 +11839,7 @@ SYSCALL_DEFINE5(perf_event_open, NULL, NULL, cgroup_fd); if (IS_ERR(event)) { err = PTR_ERR(event); - goto err_cred; + goto err_task; } if (is_sampling_event(event)) { @@ -11976,6 +11958,24 @@ SYSCALL_DEFINE5(perf_event_open, goto err_context; } + if (task) { + err = mutex_lock_interruptible(&task->signal->exec_update_mutex); + if (err) + goto err_file; + + /* + * Preserve ptrace permission check for backwards compatibility. + * + * We must hold exec_update_mutex across this and any potential + * perf_install_in_context() call for this new event to + * serialize against exec() altering our credentials (and the + * perf_event_exit_task() that could imply). + */ + err = -EACCES; + if (!perfmon_capable() && !ptrace_may_access(task, PTRACE_MODE_READ_REALCREDS)) + goto err_cred; + } + if (move_group) { gctx = __perf_event_ctx_lock_double(group_leader, ctx); @@ -12151,7 +12151,10 @@ SYSCALL_DEFINE5(perf_event_open, if (move_group) perf_event_ctx_unlock(group_leader, gctx); mutex_unlock(&ctx->mutex); -/* err_file: */ +err_cred: + if (task) + mutex_unlock(&task->signal->exec_update_mutex); +err_file: fput(event_file); err_context: perf_unpin_context(ctx); @@ -12163,9 +12166,6 @@ SYSCALL_DEFINE5(perf_event_open, */ if (!event_file) free_event(event); -err_cred: - if (task) - mutex_unlock(&task->signal->exec_update_mutex); err_task: if (task) put_task_struct(task);