Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753681AbbETNtf (ORCPT ); Wed, 20 May 2015 09:49:35 -0400 Received: from bombadil.infradead.org ([198.137.202.9]:36949 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752247AbbETNtc (ORCPT ); Wed, 20 May 2015 09:49:32 -0400 Date: Wed, 20 May 2015 15:49:22 +0200 From: Peter Zijlstra To: Vince Weaver Cc: Stephane Eranian , LKML , Arnaldo Carvalho de Melo , Jiri Olsa , Ingo Molnar , Paul Mackerras Subject: Re: perf: fuzzer triggers NULL pointer derefreence in x86_schedule_events Message-ID: <20150520134922.GH18673@twins.programming.kicks-ass.net> References: <20150501125955.GF5029@twins.programming.kicks-ass.net> <20150507124300.GK23123@twins.programming.kicks-ass.net> <20150520130312.GL3644@twins.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150520130312.GL3644@twins.programming.kicks-ass.net> User-Agent: Mutt/1.5.21 (2012-12-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1574 Lines: 48 On Wed, May 20, 2015 at 03:03:12PM +0200, Peter Zijlstra wrote: > Now, I've not quite figured out how that can intersect with scheduling, > typically we only call put_event_constraints() when we're done with the > event. Ah, yes, I think I've found it. We can do actual scheduling during perf_try_init_event(), and if the event we're adding is part of an already existing event group, the group itself might schedule and we get nested scheduling state. This goes boom because while the cpuc we validate on is fake, the event->hw.constraint state is 'global' and gets trampled on. The really safe solution would be something like the below. --- kernel/events/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/kernel/events/core.c b/kernel/events/core.c index 1a3bf48..a4f93fb 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -7391,13 +7391,16 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) ctx = perf_event_ctx_lock_nested(event->group_leader, SINGLE_DEPTH_NESTING); BUG_ON(!ctx); + raw_spin_lock_irq(&ctx->lock); } event->pmu = pmu; ret = pmu->event_init(event); - if (ctx) + if (ctx) { + raw_spin_unlock_irq(&ctx->lock); perf_event_ctx_unlock(event->group_leader, ctx); + } if (ret) module_put(pmu->module); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/