Re: [syzbot] KASAN: use-after-free Read in task_work_run (2)

[Marco Elver <elver@google.com>]

On Wed, Nov 23, 2022 at 10:49AM +0100, Dmitry Vyukov wrote:
> On Wed, 26 Oct 2022 at 20:29, syzbot
> <syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com> wrote:
> >
> > syzbot has found a reproducer for the following issue on:
> >
> > HEAD commit:    88619e77b33d net: stmmac: rk3588: Allow multiple gmac cont..
> > git tree:       bpf
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1646d6f2880000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=a66c6c673fb555e8
> > dashboard link: https://syzkaller.appspot.com/bug?extid=9228d6098455bb209ec8
> > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12bc425e880000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1126516e880000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/f8435d5c2c21/disk-88619e77.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/551d8a013e81/vmlinux-88619e77.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/7d3f5c29064d/bzImage-88619e77.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com
> 
> Should perf task work hold a reference to the event to prevent this?

Probably should cancel the task work?

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 88619e77b33d


diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5ddc88592ff8..1457725fa8a9 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4970,10 +4970,12 @@ static bool exclusive_event_installable(struct perf_event *event,
 
 static void perf_addr_filters_splice(struct perf_event *event,
 				       struct list_head *head);
+static void perf_pending_task(struct callback_head *head);
 
 static void _free_event(struct perf_event *event)
 {
 	irq_work_sync(&event->pending_irq);
+	task_work_cancel(current, perf_pending_task);
 
 	unaccount_event(event);