Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1293915 > unrolled thread

Re: use-after-free in __perf_install_in_context

Back to article view | Back to linux.kernel

This discussion starts older than the indexed window; earlier articles aren't shown. The article labeled Started by below is the oldest one visible, not the original post.

Contents

  Re: use-after-free in __perf_install_in_context Peter Zijlstra <peterz@infradead.org> - 2015-12-17 15:10 +0100
    Re: use-after-free in __perf_install_in_context Dmitry Vyukov <dvyukov@google.com> - 2015-12-17 15:10 +0100
      Re: use-after-free in __perf_install_in_context Peter Zijlstra <peterz@infradead.org> - 2015-12-17 15:30 +0100
        Re: use-after-free in __perf_install_in_context Dmitry Vyukov <dvyukov@google.com> - 2015-12-17 15:40 +0100
          Re: use-after-free in __perf_install_in_context Peter Zijlstra <peterz@infradead.org> - 2015-12-17 15:50 +0100
            Re: use-after-free in __perf_install_in_context Dmitry Vyukov <dvyukov@google.com> - 2015-12-31 18:20 +0100
      Re: use-after-free in __perf_install_in_context Peter Zijlstra <peterz@infradead.org> - 2015-12-17 15:30 +0100

#1293915 — Re: use-after-free in __perf_install_in_context

On Thu, Dec 10, 2015 at 08:57:40PM +0100, Peter Zijlstra wrote:
> I'm not sure I can explain your problem with this, but I figure its
> worth a try.

Did it make a difference?

Also, does the syzkaller thing do cpu-hotplug during its runs?

> ---
>  kernel/events/core.c | 15 +++++----------
>  1 file changed, 5 insertions(+), 10 deletions(-)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index c3d61b92d805..d5293325d8c5 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -3136,15 +3136,16 @@ static int event_enable_on_exec(struct perf_event *event,
>   * Enable all of a task's events that have been marked enable-on-exec.
>   * This expects task == current.
>   */
> -static void perf_event_enable_on_exec(struct perf_event_context *ctx)
> +static void perf_event_enable_on_exec(int ctxn)
>  {
> -	struct perf_event_context *clone_ctx = NULL;
> +	struct perf_event_context *ctx, *clone_ctx = NULL;
>  	struct perf_event *event;
>  	unsigned long flags;
>  	int enabled = 0;
>  	int ret;
>  
>  	local_irq_save(flags);
> +	ctx = current->perf_event_ctxp[ctxn];
>  	if (!ctx || !ctx->nr_events)
>  		goto out;
>  
> @@ -3187,17 +3188,11 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)
>  
>  void perf_event_exec(void)
>  {
> -	struct perf_event_context *ctx;
>  	int ctxn;
>  
>  	rcu_read_lock();
> -	for_each_task_context_nr(ctxn) {
> -		ctx = current->perf_event_ctxp[ctxn];
> -		if (!ctx)
> -			continue;
> -
> -		perf_event_enable_on_exec(ctx);
> -	}
> +	for_each_task_context_nr(ctxn)
> +		perf_event_enable_on_exec(ctxn);
>  	rcu_read_unlock();
>  }
>  
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1293916

On Thu, Dec 17, 2015 at 3:06 PM, Peter Zijlstra <peterz@infradead.org> wrote:
> On Thu, Dec 10, 2015 at 08:57:40PM +0100, Peter Zijlstra wrote:
>> I'm not sure I can explain your problem with this, but I figure its
>> worth a try.
>
> Did it make a difference?
>
> Also, does the syzkaller thing do cpu-hotplug during its runs?

See my email on Dec 15.
I have CONFIG_HOTPLUG enabled, but I don't do actual hotplug (well,
actually I don't know how to do hotplug, but I still think I am not
doing it).



>> ---
>>  kernel/events/core.c | 15 +++++----------
>>  1 file changed, 5 insertions(+), 10 deletions(-)
>>
>> diff --git a/kernel/events/core.c b/kernel/events/core.c
>> index c3d61b92d805..d5293325d8c5 100644
>> --- a/kernel/events/core.c
>> +++ b/kernel/events/core.c
>> @@ -3136,15 +3136,16 @@ static int event_enable_on_exec(struct perf_event *event,
>>   * Enable all of a task's events that have been marked enable-on-exec.
>>   * This expects task == current.
>>   */
>> -static void perf_event_enable_on_exec(struct perf_event_context *ctx)
>> +static void perf_event_enable_on_exec(int ctxn)
>>  {
>> -     struct perf_event_context *clone_ctx = NULL;
>> +     struct perf_event_context *ctx, *clone_ctx = NULL;
>>       struct perf_event *event;
>>       unsigned long flags;
>>       int enabled = 0;
>>       int ret;
>>
>>       local_irq_save(flags);
>> +     ctx = current->perf_event_ctxp[ctxn];
>>       if (!ctx || !ctx->nr_events)
>>               goto out;
>>
>> @@ -3187,17 +3188,11 @@ static void perf_event_enable_on_exec(struct perf_event_context *ctx)
>>
>>  void perf_event_exec(void)
>>  {
>> -     struct perf_event_context *ctx;
>>       int ctxn;
>>
>>       rcu_read_lock();
>> -     for_each_task_context_nr(ctxn) {
>> -             ctx = current->perf_event_ctxp[ctxn];
>> -             if (!ctx)
>> -                     continue;
>> -
>> -             perf_event_enable_on_exec(ctx);
>> -     }
>> +     for_each_task_context_nr(ctxn)
>> +             perf_event_enable_on_exec(ctxn);
>>       rcu_read_unlock();
>>  }
>>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293928

On Thu, Dec 17, 2015 at 03:26:17PM +0100, Peter Zijlstra wrote:
> On Thu, Dec 17, 2015 at 03:08:49PM +0100, Dmitry Vyukov wrote:
> > On Thu, Dec 17, 2015 at 3:06 PM, Peter Zijlstra <peterz@infradead.org> wrote:
> > > On Thu, Dec 10, 2015 at 08:57:40PM +0100, Peter Zijlstra wrote:
> > >> I'm not sure I can explain your problem with this, but I figure its
> > >> worth a try.
> > >
> > > Did it make a difference?
> > >
> > > Also, does the syzkaller thing do cpu-hotplug during its runs?
> > 
> > See my email on Dec 15.
> 
> I have 4 emails from you on that day (and one private), they pertain to
> getting stuck in perf_{install,remove}_from_context(). None of those
> emails seem to contain an answer to either of the two above questions.
> 
>   CACT4Y+Za4L4q6FZLXjyGbnSYRwa7RJZYcG_s562q+CrNy9C75w@mail.gmail.com
>   CACT4Y+YUkYgCuQFW6eBTtdfRqdF7EEtrB3VaYJk+LUXE_-iGRQ@mail.gmail.com
>   CACT4Y+bvHWuyDZjoFhLAOiK1rfNQcfuSJCY0oS5xA=u8j04bXQ@mail.gmail.com
>   CACT4Y+an67KnTsVVzYVvrYKW9yg7PbDuC8WyB38PiWRoSt0UCQ@mail.gmail.com
> 
> and in private:
> 
>   CACT4Y+Zb1vU192JbCnyS9qY3cpsvfAUJdpBVUsmosueCtQjSXQ@mail.gmail.com
> 
> Did I miss an email?

Yes, I seem to have missed this one:

  CACT4Y+Y_YdEd-YGdWq-wQV6S+1M2nKA6atYO2DOFa8-wtQ8QWg@mail.gmail.com

found it, thanks!
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293939

On Thu, Dec 17, 2015 at 3:28 PM, Peter Zijlstra <peterz@infradead.org> wrote:
>> > >> I'm not sure I can explain your problem with this, but I figure its
>> > >> worth a try.
>> > >
>> > > Did it make a difference?
>> > >
>> > > Also, does the syzkaller thing do cpu-hotplug during its runs?
>> >
>> > See my email on Dec 15.
>>
>> I have 4 emails from you on that day (and one private), they pertain to
>> getting stuck in perf_{install,remove}_from_context(). None of those
>> emails seem to contain an answer to either of the two above questions.
>>
>>   CACT4Y+Za4L4q6FZLXjyGbnSYRwa7RJZYcG_s562q+CrNy9C75w@mail.gmail.com
>>   CACT4Y+YUkYgCuQFW6eBTtdfRqdF7EEtrB3VaYJk+LUXE_-iGRQ@mail.gmail.com
>>   CACT4Y+bvHWuyDZjoFhLAOiK1rfNQcfuSJCY0oS5xA=u8j04bXQ@mail.gmail.com
>>   CACT4Y+an67KnTsVVzYVvrYKW9yg7PbDuC8WyB38PiWRoSt0UCQ@mail.gmail.com
>>
>> and in private:
>>
>>   CACT4Y+Zb1vU192JbCnyS9qY3cpsvfAUJdpBVUsmosueCtQjSXQ@mail.gmail.com
>>
>> Did I miss an email?
>
> Yes, I seem to have missed this one:
>
>   CACT4Y+Y_YdEd-YGdWq-wQV6S+1M2nKA6atYO2DOFa8-wtQ8QWg@mail.gmail.com
>
> found it, thanks!

Yes, that one.
In short, I did not see use-after-frees but perf_event_open fuzzing
started hanging VMs very frequently, so testing is inconclusive.

And, no, nobody touches anything in /sys/devices.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293943

On Thu, Dec 17, 2015 at 03:35:32PM +0100, Dmitry Vyukov wrote:
> In short, I did not see use-after-frees but perf_event_open fuzzing
> started hanging VMs very frequently, so testing is inconclusive.

Right, I'll get back to staring at that one.

Running your test case on bare metal got my machine reproducably stuck
but in a different place than you've reported.

Takes a while too, so far no luck in explaining/debugging it. All my
added debug code remains silent :/

I'll go think up more .. 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1299712

On Thu, Dec 17, 2015 at 3:43 PM, Peter Zijlstra <peterz@infradead.org> wrote:
> On Thu, Dec 17, 2015 at 03:35:32PM +0100, Dmitry Vyukov wrote:
>> In short, I did not see use-after-frees but perf_event_open fuzzing
>> started hanging VMs very frequently, so testing is inconclusive.
>
> Right, I'll get back to staring at that one.
>
> Running your test case on bare metal got my machine reproducably stuck
> but in a different place than you've reported.
>
> Takes a while too, so far no luck in explaining/debugging it. All my
> added debug code remains silent :/
>
> I'll go think up more ..

Hi Peter,

Any progress with this?
I can't continue to test perf subsytem, as it reliably hangs my machines.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1293930

On Thu, Dec 17, 2015 at 03:08:49PM +0100, Dmitry Vyukov wrote:
> On Thu, Dec 17, 2015 at 3:06 PM, Peter Zijlstra <peterz@infradead.org> wrote:
> > On Thu, Dec 10, 2015 at 08:57:40PM +0100, Peter Zijlstra wrote:
> >> I'm not sure I can explain your problem with this, but I figure its
> >> worth a try.
> >
> > Did it make a difference?
> >
> > Also, does the syzkaller thing do cpu-hotplug during its runs?
> 
> See my email on Dec 15.

I have 4 emails from you on that day (and one private), they pertain to
getting stuck in perf_{install,remove}_from_context(). None of those
emails seem to contain an answer to either of the two above questions.

  CACT4Y+Za4L4q6FZLXjyGbnSYRwa7RJZYcG_s562q+CrNy9C75w@mail.gmail.com
  CACT4Y+YUkYgCuQFW6eBTtdfRqdF7EEtrB3VaYJk+LUXE_-iGRQ@mail.gmail.com
  CACT4Y+bvHWuyDZjoFhLAOiK1rfNQcfuSJCY0oS5xA=u8j04bXQ@mail.gmail.com
  CACT4Y+an67KnTsVVzYVvrYKW9yg7PbDuC8WyB38PiWRoSt0UCQ@mail.gmail.com

and in private:

  CACT4Y+Zb1vU192JbCnyS9qY3cpsvfAUJdpBVUsmosueCtQjSXQ@mail.gmail.com

Did I miss an email?

This is the thread about the difficult to deterministically reproduce
use-after-free.

> I have CONFIG_HOTPLUG enabled, but I don't do actual hotplug (well,
> actually I don't know how to do hotplug, but I still think I am not
> doing it).

You can do hotplug like:

echo 0 > /sys/devices/system/cpu/cpu1/online
echo 1 > /sys/devices/system/cpu/cpu1/online

so if syzkaller doesn't know about that, and I suppose you not
knowing this means syzkaller doesn't either, this isn't happening.

Thanks, that disqualifies a bunch of code.
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web