lkml.org 
[lkml]   [2019]   [Mar]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH] perf: fix use after free of perf_trace_buf
On Tue, 19 Mar 2019 17:51:00 +0530
Prateek Sood <prsood@codeaurora.org> wrote:

> SyS_perf_event_open()
> free_event()
> _free_event()
> tp_perf_event_destroy()
> perf_trace_destroy()
> perf_trace_event_unreg() //free perf_trace_buf
>
> trace_cpu_frequency()
> perf_trace_cpu()
> perf_trace_buf_alloc() //access perf_trace_buf
>
> CPU0 CPU1
> perf_trace_event_unreg() perf_trace_cpu()
> head = (event_call->perf_events)
>

But here there's a:

tracepoint_synchronize_unregister();

Which is suppose to prevent this. Are you saying that the
tracepoint_synchronize_unregister() is broken?

-- Steve


> free_percpu(tp_event->perf_events)
> tp_event->perf_events = NULL
> --total_ref_count
> free_percpu(perf_trace_buf[i])
> perf_trace_buf[i] = NULL
>
> raw_data = perf_trace_buf[rctx]
> memset(raw_data)
>
> A potential race exists between access of perf_trace_buf from
> perf_trace_buf_alloc() and perf_trace_event_unreg(). This can
> result in perf_trace_buf[rctx] being NULL during access from memset()
> in perf_trace_buf_alloc().
>

\
 
 \ /
  Last update: 2019-03-19 14:32    [W:0.183 / U:0.128 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site