Messages in this thread | | | Date | Tue, 19 Mar 2019 09:31:22 -0400 | From | Steven Rostedt <> | Subject | Re: [PATCH] perf: fix use after free of perf_trace_buf |
| |
On Tue, 19 Mar 2019 17:51:00 +0530 Prateek Sood <prsood@codeaurora.org> wrote:
> SyS_perf_event_open() > free_event() > _free_event() > tp_perf_event_destroy() > perf_trace_destroy() > perf_trace_event_unreg() //free perf_trace_buf > > trace_cpu_frequency() > perf_trace_cpu() > perf_trace_buf_alloc() //access perf_trace_buf > > CPU0 CPU1 > perf_trace_event_unreg() perf_trace_cpu() > head = (event_call->perf_events) >
But here there's a:
tracepoint_synchronize_unregister();
Which is suppose to prevent this. Are you saying that the tracepoint_synchronize_unregister() is broken?
-- Steve
> free_percpu(tp_event->perf_events) > tp_event->perf_events = NULL > --total_ref_count > free_percpu(perf_trace_buf[i]) > perf_trace_buf[i] = NULL > > raw_data = perf_trace_buf[rctx] > memset(raw_data) > > A potential race exists between access of perf_trace_buf from > perf_trace_buf_alloc() and perf_trace_event_unreg(). This can > result in perf_trace_buf[rctx] being NULL during access from memset() > in perf_trace_buf_alloc(). >
| |