Messages in this thread Patch in this message | | | Date | Wed, 20 May 2015 15:49:22 +0200 | From | Peter Zijlstra <> | Subject | Re: perf: fuzzer triggers NULL pointer derefreence in x86_schedule_events |
| |
On Wed, May 20, 2015 at 03:03:12PM +0200, Peter Zijlstra wrote:
> Now, I've not quite figured out how that can intersect with scheduling, > typically we only call put_event_constraints() when we're done with the > event.
Ah, yes, I think I've found it.
We can do actual scheduling during perf_try_init_event(), and if the event we're adding is part of an already existing event group, the group itself might schedule and we get nested scheduling state.
This goes boom because while the cpuc we validate on is fake, the event->hw.constraint state is 'global' and gets trampled on.
The really safe solution would be something like the below.
--- kernel/events/core.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c index 1a3bf48..a4f93fb 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -7391,13 +7391,16 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) ctx = perf_event_ctx_lock_nested(event->group_leader, SINGLE_DEPTH_NESTING); BUG_ON(!ctx); + raw_spin_lock_irq(&ctx->lock); } event->pmu = pmu; ret = pmu->event_init(event); - if (ctx) + if (ctx) { + raw_spin_unlock_irq(&ctx->lock); perf_event_ctx_unlock(event->group_leader, ctx); + } if (ret) module_put(pmu->module);
| |