Re: perf: fuzzer triggers NULL pointer derefreence in x86_schedule_events

[Peter Zijlstra]

On Wed, May 20, 2015 at 03:03:12PM +0200, Peter Zijlstra wrote:

> Now, I've not quite figured out how that can intersect with scheduling,
> typically we only call put_event_constraints() when we're done with the
> event.

Ah, yes, I think I've found it.

We can do actual scheduling during perf_try_init_event(), and if the
event we're adding is part of an already existing event group, the group
itself might schedule and we get nested scheduling state.

This goes boom because while the cpuc we validate on is fake, the
event->hw.constraint state is 'global' and gets trampled on.

The really safe solution would be something like the below.

---
 kernel/events/core.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1a3bf48..a4f93fb 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7391,13 +7391,16 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
 		ctx = perf_event_ctx_lock_nested(event->group_leader,
 						 SINGLE_DEPTH_NESTING);
 		BUG_ON(!ctx);
+		raw_spin_lock_irq(&ctx->lock);
 	}
 
 	event->pmu = pmu;
 	ret = pmu->event_init(event);
 
-	if (ctx)
+	if (ctx) {
+		raw_spin_unlock_irq(&ctx->lock);
 		perf_event_ctx_unlock(event->group_leader, ctx);
+	}
 
 	if (ret)
 		module_put(pmu->module);
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/