lkml.org 
[lkml]   [2014]   [May]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: perf: use after free in perf_remove_from_context
On Wed, May 28, 2014 at 10:31:38PM -0400, Sasha Levin wrote:
> I've just had this:
>
>
> [ 591.111854] general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
> [ 591.121057] Dumping ftrace buffer:
> [ 591.121057] (ftrace buffer empty)
> [ 591.121057] Modules linked in:
> [ 591.121057] CPU: 14 PID: 10272 Comm: trinity-c230 Tainted: G W 3.15.0-rc7-next-20140528-sasha-00019-gd193e91-dirty #545
> [ 591.121057] task: ffff8802df0d3000 ti: ffff8802df0fe000 task.ti: ffff8802df0fe000
> [ 591.129130] RIP: perf_event_exit_task (kernel/events/core.c:7492 kernel/events/core.c:7524)
> [ 591.129130] RSP: 0000:ffff8802df0ffe28 EFLAGS: 00010246
> [ 591.129130] RAX: 0000000000000000 RBX: ffff8802df0d3000 RCX: 0000000000000001
> [ 591.129130] RDX: 0000000000000000 RSI: ffffffff97088100 RDI: 0000000000000282
> [ 591.129130] RBP: ffff8802df0ffe98 R08: 0000000000000000 R09: 0000000000000000
> [ 591.129130] R10: 0000000000000001 R11: 0000000000000000 R12: 6b6b6b6b6b6b6b6b
> [ 591.129130] R13: 6b6b6b6b6b6b6b6b R14: ffff8806c9bfd550 R15: 0000000000000001
> [ 591.129130] FS: 00007f4b26866700(0000) GS:ffff88036ae00000(0000) knlGS:0000000000000000
> [ 591.129130] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
> [ 591.129130] CR2: 0000000001a3a9f8 CR3: 000000001702c000 CR4: 00000000000006a0
> [ 591.129130] Stack:
> [ 591.129130] ffff8802df0ffe48 ffff8802df09cce0 ffff8802fdf99488 ffff8802fdf99290
> [ 591.129130] ffff8806c9bfd5a8 ffff8806c9bfd670 ffff8802df0ffe88 6b6b6b6b6b6b6b6b
> [ 591.129130] ffff8802df0ffe98 0000000000000001 0000000000000001 ffff8802df0d3000
> [ 591.129130] Call Trace:
> [ 591.129130] do_exit (kernel/exit.c:766)
> [ 591.129130] ? __this_cpu_preempt_check (lib/smp_processor_id.c:63)
> [ 591.129130] ? trace_hardirqs_on_caller (kernel/locking/lockdep.c:2557 kernel/locking/lockdep.c:2599)
> [ 591.129130] ? trace_hardirqs_on (kernel/locking/lockdep.c:2607)
> [ 591.129130] do_group_exit (kernel/exit.c:884)
> [ 591.129130] SyS_exit_group (kernel/exit.c:895)
> [ 591.129130] tracesys (arch/x86/kernel/entry_64.S:542)
> [ 591.129130] Code: a0 02 00 00 49 89 95 a8 02 00 00 4c 8b 45 a0 4c 89 c7 e8 11 c2 2c 03 48 8b 45 a8 48 89 c7 e8 15 7c ff ff 4c 89 ef e8 bd 7b ff ff <49> 8b 45 00 48 89 45 c8 4c 8b 6d c8 e8 cc 19 f6 ff 85 c0 74 0e
> All code
> ========
> 0: a0 02 00 00 49 89 95 movabs 0x2a8958949000002,%al
> 7: a8 02
> 9: 00 00 add %al,(%rax)
> b: 4c 8b 45 a0 mov -0x60(%rbp),%r8
> f: 4c 89 c7 mov %r8,%rdi
> 12: e8 11 c2 2c 03 callq 0x32cc228
> 17: 48 8b 45 a8 mov -0x58(%rbp),%rax
> 1b: 48 89 c7 mov %rax,%rdi
> 1e: e8 15 7c ff ff callq 0xffffffffffff7c38
> 23: 4c 89 ef mov %r13,%rdi
> 26: e8 bd 7b ff ff callq 0xffffffffffff7be8
> 2b:* 49 8b 45 00 mov 0x0(%r13),%rax <-- trapping instruction
> 2f: 48 89 45 c8 mov %rax,-0x38(%rbp)
> 33: 4c 8b 6d c8 mov -0x38(%rbp),%r13
> 37: e8 cc 19 f6 ff callq 0xfffffffffff61a08
> 3c: 85 c0 test %eax,%eax
> 3e: 74 0e je 0x4e
> ...
>
> Code starting with the faulting instruction
> ===========================================
> 0: 49 8b 45 00 mov 0x0(%r13),%rax
> 4: 48 89 45 c8 mov %rax,-0x38(%rbp)
> 8: 4c 8b 6d c8 mov -0x38(%rbp),%r13
> c: e8 cc 19 f6 ff callq 0xfffffffffff619dd
> 11: 85 c0 test %eax,%eax
> 13: 74 0e je 0x23
> ...
> [ 591.129130] RIP perf_event_exit_task (kernel/events/core.c:7492 kernel/events/core.c:7524)
> [ 591.129130] RSP <ffff8802df0ffe28>
>
>
> Seems similar enough.

Shiny, you got the code bits scripted ;-)

Yeah, looks about the same, one of the list elements (I checked, its not
the list head itself, or at least it wasn't when I managed to hit) was
freed while still on the list.
[unhandled content-type:application/pgp-signature]
\
 
 \ /
  Last update: 2014-05-29 10:41    [W:0.123 / U:0.740 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site