Received-SPF: pass (google.com: domain of linux-kernel+bounces-180856-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Date: Thu, 16 May 2024 11:41:37 +0200
From: Peter Zijlstra <peterz@infradead.org>
To: Frederic Weisbecker <frederic@kernel.org>
Cc: LKML <linux-kernel@vger.kernel.org>, Ingo Molnar <mingo@redhat.com>,
	Arnaldo Carvalho de Melo <acme@kernel.org>,
	Namhyung Kim <namhyung@kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	Jiri Olsa <jolsa@kernel.org>, Ian Rogers <irogers@google.com>,
	Adrian Hunter <adrian.hunter@intel.com>,
	Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Subject: Re: [PATCH 4/4] perf: Fix event leak upon exec and file release
Message-ID: <20240516094137.GI22557@noisy.programming.kicks-ass.net>
References: <20240515144311.16038-1-frederic@kernel.org>
 <20240515144311.16038-5-frederic@kernel.org>
Precedence: bulk
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20240515144311.16038-5-frederic@kernel.org>

On Wed, May 15, 2024 at 04:43:11PM +0200, Frederic Weisbecker wrote:
> The perf pending task work is never waited upon the matching event
> release. In the case of a child event, released via free_event()
> directly, this can potentially result in a leaked event, such as in the
> following scenario that doesn't even require a weak IRQ work
> implementation to trigger:
> 
> schedule()
>    prepare_task_switch()
> =======> <NMI>
>       perf_event_overflow()
>          event->pending_sigtrap = ...
>          irq_work_queue(&event->pending_irq)
> <======= </NMI>
>       perf_event_task_sched_out()
>           event_sched_out()
>               event->pending_sigtrap = 0;
>               atomic_long_inc_not_zero(&event->refcount)
>               task_work_add(&event->pending_task)
>    finish_lock_switch()
> =======> <IRQ>
>    perf_pending_irq()
>       //do nothing, rely on pending task work
> <======= </IRQ>
> 
> begin_new_exec()
>    perf_event_exit_task()
>       perf_event_exit_event()
>          // If is child event
>          free_event()
>             WARN(atomic_long_cmpxchg(&event->refcount, 1, 0) != 1)
>             // event is leaked
> 
> Similar scenarios can also happen with perf_event_remove_on_exec() or
> simply against concurrent perf_event_release().
> 
> Fix this with synchonizing against the possibly remaining pending task
> work while freeing the event, just like is done with remaining pending
> IRQ work. This means that the pending task callback neither need nor
> should hold a reference to the event, preventing it from ever beeing
> freed.
> 
> Fixes: 517e6a301f34 ("perf: Fix perf_pending_task() UaF")
> Signed-off-by: Frederic Weisbecker <frederic@kernel.org>

Yeah, I suppose this'll do. Thanks!