Messages in this thread | | | Date | Wed, 20 May 2015 15:03:12 +0200 | From | Peter Zijlstra <> | Subject | Re: perf: fuzzer triggers NULL pointer derefreence in x86_schedule_events |
| |
On Mon, May 18, 2015 at 01:40:31PM -0400, Vince Weaver wrote: > On Thu, 7 May 2015, Peter Zijlstra wrote: > > > On Mon, May 04, 2015 at 12:32:56PM -0700, Stephane Eranian wrote: > > > I think it is more likely related to the bitmask (idxmsk). But then > > > it is always allocated with the constraint even with the HT bug > > > workaround. So most, likely the index is bogus and you touch outside > > > the idxmsk[] array. > > > > [428232.701319] BUG: unable to handle kernel NULL pointer dereference at (null) > > > > But the thing really tried to touch NULL, not some random address that > > faulted. > > > > As always, Vince has found us a good puzzle ;-) > > so the Haswell machine turned up the following oops that looks related. > > Yet again we are ending up with a NULL pointer in the constraint table > somehow. > > This maps to > > static bool __perf_sched_find_counter(struct perf_sched *sched) > > c = sched->events[sched->state.event]->hw.constraint; > > /* Prefer fixed purpose counters */ > ---> if (c->idxmsk64 & (~0ULL << INTEL_PMC_IDX_FIXED)) { > > ffffffff81029ce4: 48 8b 55 88 mov -0x78(%rbp),%rdx > ffffffff81029ce8: 48 8b 04 c2 mov (%rdx,%rax,8),%rax > ffffffff81029cec: ba 20 00 00 00 mov $0x20,%edx > ffffffff81029cf1: 48 8b 98 98 01 00 00 mov 0x198(%rax),%rbx > ffffffff81029cf8: 4c 85 23 test %r12,(%rbx) > > > [306672.100641] BUG: unable to handle kernel NULL pointer dereference at (null) > [306672.109653] IP: [<ffffffff81029cf8>] perf_assign_events+0xa8/0x290
So new in this release is:
static void intel_put_event_constraints(struct cpu_hw_events *cpuc, struct perf_event *event) { ...
/* cleanup dynamic constraint */ if (c && (c->flags & PERF_X86_EVENT_DYNAMIC)) event->hw.constraint = NULL; }
Which is the only place that value is ever cleared...
Now, I've not quite figured out how that can intersect with scheduling, typically we only call put_event_constraints() when we're done with the event.
| |