Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Wed, 23 Nov 2022 11:57:40 +0100
From:   Marco Elver <elver@google.com>
To:     Dmitry Vyukov <dvyukov@google.com>
Cc:     syzbot <syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com>,
        peterz@infradead.org, Ingo Molnar <mingo@redhat.com>,
        Arnaldo Carvalho de Melo <acme@kernel.org>,
        LKML <linux-kernel@vger.kernel.org>,
        syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in task_work_run (2)
Message-ID: <Y338pCjXlDT8Zu3z@elver.google.com>
References: <000000000000fad77705e7fd40fb@google.com>
 <000000000000e7513905ebf4346f@google.com>
 <CACT4Y+aHHV-+ECUux1=DR11P3Xd-apJN7ALE4GsOxq-MBGo-Lg@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <CACT4Y+aHHV-+ECUux1=DR11P3Xd-apJN7ALE4GsOxq-MBGo-Lg@mail.gmail.com>
User-Agent: Mutt/2.2.7 (2022-08-07)
Precedence: bulk

On Wed, Nov 23, 2022 at 10:49AM +0100, Dmitry Vyukov wrote:
> On Wed, 26 Oct 2022 at 20:29, syzbot
> <syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com> wrote:
> >
> > syzbot has found a reproducer for the following issue on:
> >
> > HEAD commit:    88619e77b33d net: stmmac: rk3588: Allow multiple gmac cont..
> > git tree:       bpf
> > console output: https://syzkaller.appspot.com/x/log.txt?x=1646d6f2880000
> > kernel config:  https://syzkaller.appspot.com/x/.config?x=a66c6c673fb555e8
> > dashboard link: https://syzkaller.appspot.com/bug?extid=9228d6098455bb209ec8
> > compiler:       gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
> > syz repro:      https://syzkaller.appspot.com/x/repro.syz?x=12bc425e880000
> > C reproducer:   https://syzkaller.appspot.com/x/repro.c?x=1126516e880000
> >
> > Downloadable assets:
> > disk image: https://storage.googleapis.com/syzbot-assets/f8435d5c2c21/disk-88619e77.raw.xz
> > vmlinux: https://storage.googleapis.com/syzbot-assets/551d8a013e81/vmlinux-88619e77.xz
> > kernel image: https://storage.googleapis.com/syzbot-assets/7d3f5c29064d/bzImage-88619e77.xz
> >
> > IMPORTANT: if you fix the issue, please add the following tag to the commit:
> > Reported-by: syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com
> 
> Should perf task work hold a reference to the event to prevent this?

Probably should cancel the task work?

#syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 88619e77b33d


diff --git a/kernel/events/core.c b/kernel/events/core.c
index 5ddc88592ff8..1457725fa8a9 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -4970,10 +4970,12 @@ static bool exclusive_event_installable(struct perf_event *event,
 
 static void perf_addr_filters_splice(struct perf_event *event,
 				       struct list_head *head);
+static void perf_pending_task(struct callback_head *head);
 
 static void _free_event(struct perf_event *event)
 {
 	irq_work_sync(&event->pending_irq);
+	task_work_cancel(current, perf_pending_task);
 
 	unaccount_event(event);