mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity
linux-stable/lib
History
James Clark 4f64a6c9f6 perf: Fix perf_event_pmu_context serialization 
Syzkaller triggered a WARN in put_pmu_ctx().

  WARNING: CPU: 1 PID: 2245 at kernel/events/core.c:4925 put_pmu_ctx+0x1f0/0x278

This is because there is no locking around the access of "if
(!epc->ctx)" in find_get_pmu_context() and when it is set to NULL in
put_pmu_ctx().

The decrement of the reference count in put_pmu_ctx() also happens
outside of the spinlock, leading to the possibility of this order of
events, and the context being cleared in put_pmu_ctx(), after its
refcount is non zero:

 CPU0                                   CPU1
 find_get_pmu_context()
   if (!epc->ctx) == false
                                        put_pmu_ctx()
                                        atomic_dec_and_test(&epc->refcount) == true
                                        epc->refcount == 0
     atomic_inc(&epc->refcount);
     epc->refcount == 1
                                        list_del_init(&epc->pmu_ctx_entry);
	                                      epc->ctx = NULL;

Another issue is that WARN_ON for no active PMU events in put_pmu_ctx()
is outside of the lock. If the perf_event_pmu_context is an embedded
one, even after clearing it, it won't be deleted and can be re-used. So
the warning can trigger. For this reason it also needs to be moved
inside the lock.

The above warning is very quick to trigger on Arm by running these two
commands at the same time:

  while true; do perf record -- ls; done
  while true; do perf record -- ls; done

[peterz: atomic_dec_and_raw_lock*()]
Fixes: bd27568117 ("perf: Rewrite core context handling")
Reported-by: syzbot+697196bc0265049822bd@syzkaller.appspotmail.com
Signed-off-by: James Clark <james.clark@arm.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Reviewed-by: Ravi Bangoria <ravi.bangoria@amd.com>
Link: https://lore.kernel.org/r/20230127143141.1782804-2-james.clark@arm.com
 		2023-01-31 20:37:18 +01:00
..
842
…
crypto crypto: lib/aesgcm - Provide minimal library implementation 2022-11-11 18:14:59 +08:00
dim
…
fonts lib/fonts: fix undefined behavior in bit shift for get_default_font 2022-11-18 13:55:09 -08:00
kunit kunit: alloc_string_stream_fragment error handling bug fix 2022-12-26 16:01:36 -07:00
livepatch
…
lz4
…
lzo
…
math math64: favor kernel-doc from header files 2022-11-21 14:30:53 -07:00
mpi
…
pldmfw
…
raid6 for-6.2/block-2022-12-08 2022-12-13 10:43:59 -08:00
reed_solomon treewide: use get_random_u32_below() instead of deprecated function 2022-11-18 02:15:15 +01:00
test_fortify
…
vdso lib/vdso: use "grep -E" instead of "egrep" 2022-11-23 19:50:15 +01:00
xz
…
zlib_deflate
…
zlib_dfltcc
…
zlib_inflate
…
zstd zstd: import usptream v1.5.2 2022-10-24 12:12:32 -07:00
.gitignore
…
Kconfig iommufd for 6.2 2022-12-14 09:15:43 -08:00
Kconfig.debug hardening fixes for v6.2-rc6 2023-01-27 16:09:12 -08:00
Kconfig.kasan MM patches for 6.2-rc1. 2022-12-13 19:29:45 -08:00
Kconfig.kcsan lib: Kconfig: fix spellos 2023-01-24 19:21:26 -05:00
Kconfig.kfence
…
Kconfig.kgdb parisc: Convert PDC console to an early console 2022-10-11 12:01:24 +02:00
Kconfig.kmsan kmsan: make sure PREEMPT_RT is off 2022-11-08 15:57:24 -08:00
Kconfig.ubsan
…
Makefile hardening updates for v6.2-rc1 2022-12-14 12:20:00 -08:00
argv_split.c
…
ashldi3.c
…
ashrdi3.c
…
asn1_decoder.c
…
asn1_encoder.c
…
assoc_array.c
…
atomic64.c
…
atomic64_test.c
…
audit.c
…
base64.c
…
bcd.c
…
bch.c
…
bitfield_kunit.c
…
bitmap.c
…
bitrev.c
…
bootconfig-data.S
…
bootconfig.c
…
bsearch.c
…
btree.c
…
bucket_locks.c
…
bug.c
…
build_OID_registry
…
buildid.c
…
bust_spinlocks.c
…
check_signature.c
…
checksum.c
…
clz_ctz.c
…
clz_tab.c
…
cmdline.c
…
cmdline_kunit.c treewide: use get_random_{u8,u16}() when possible, part 1 2022-10-11 17:42:58 -06:00
cmpdi2.c
…
compat_audit.c
…
cpu_rmap.c
…
cpumask.c
…
cpumask_kunit.c
…
crc-ccitt.c
…
crc-itu-t.c
…
crc-t10dif.c
…
crc4.c
…
crc7.c
…
crc8.c
…
crc16.c
…
crc32.c
…
crc32defs.h
…
crc32test.c
…
crc64-rocksoft.c
…
crc64.c
…
ctype.c
…
debug_info.c
…
debug_locks.c
…
debugobjects.c Non-MM patches for 6.2-rc1. 2022-12-12 17:28:58 -08:00
dec_and_lock.c perf: Fix perf_event_pmu_context serialization 2023-01-31 20:37:18 +01:00
decompress.c
…
decompress_bunzip2.c
…
decompress_inflate.c
…
decompress_unlz4.c
…
decompress_unlzma.c
…
decompress_unlzo.c
…
decompress_unxz.c
…
decompress_unzstd.c
…
devmem_is_allowed.c
…
devres.c
…
digsig.c
…
dump_stack.c
…
dynamic_debug.c
…
dynamic_queue_limits.c
…
earlycpio.c
…
errname.c
…
error-inject.c
…
errseq.c
…
extable.c
…
fault-inject-usercopy.c
…
fault-inject.c fault-injection: make stacktrace filter works as expected 2022-12-15 16:40:44 -08:00
fdt.c
…
fdt_addresses.c
…
fdt_empty_tree.c
…
fdt_ro.c
…
fdt_rw.c
…
fdt_strerror.c
…
fdt_sw.c
…
fdt_wip.c
…
find_bit.c
…
find_bit_benchmark.c treewide: use get_random_u32_below() instead of deprecated function 2022-11-18 02:15:15 +01:00
flex_proportions.c
…
fortify_kunit.c kunit/fortify: Validate __alloc_size attribute results 2022-11-22 21:08:28 -08:00
gen_crc32table.c
…
gen_crc64table.c
…
genalloc.c
…
generic-radix-tree.c
…
glob.c
…
globtest.c
…
hexdump.c
…
hweight.c
…
idr.c
…
inflate.c
…
interval_tree.c interval-tree: Add a utility to iterate over spans in an interval tree 2022-11-29 16:34:15 -04:00
interval_tree_test.c
…
iomap.c
…
iomap_copy.c
…
iommu-helper.c
…
iov_iter.c for-6.2/block-2022-12-08 2022-12-13 10:43:59 -08:00
irq_poll.c
…
irq_regs.c
…
is_signed_type_kunit.c lib: assume char is unsigned 2022-11-19 00:56:15 +01:00
is_single_threaded.c
…
kasprintf.c
…
kfifo.c
…
klist.c
…
kobject.c Driver Core changes for 6.2-rc1 2022-12-16 03:54:54 -08:00
kobject_uevent.c
…
kstrtox.c
…
kstrtox.h
…
libcrc32c.c
…
linear_ranges.c
…
list-test.c
…
list_debug.c
…
list_sort.c
…
llist.c llist: avoid extra memory read in llist_add_batch 2022-11-18 13:55:06 -08:00
locking-selftest-hardirq.h
…
locking-selftest-mutex.h
…
locking-selftest-rlock-hardirq.h
…
locking-selftest-rlock-softirq.h
…
locking-selftest-rlock.h
…
locking-selftest-rsem.h
…
locking-selftest-rtmutex.h
…
locking-selftest-softirq.h
…
locking-selftest-spin-hardirq.h
…
locking-selftest-spin-softirq.h
…
locking-selftest-spin.h
…
locking-selftest-wlock-hardirq.h
…
locking-selftest-wlock-softirq.h
…
locking-selftest-wlock.h
…
locking-selftest-wsem.h
…
locking-selftest.c
…
lockref.c lockref: stop doing cpu_relax in the cmpxchg loop 2023-01-13 14:35:38 -06:00
logic_iomem.c
…
logic_pio.c
…
lru_cache.c lru_cache: remove unused lc_private, lc_set, lc_index_of 2022-11-22 19:38:39 -07:00
lshrdi3.c
…
maple_tree.c maple_tree: fix mas_spanning_rebalance() on insufficient data 2022-12-21 14:31:52 -08:00
memcat_p.c
…
memcpy_kunit.c kunit: memcpy: Split slow memcpy tests into MEMCPY_SLOW_KUNIT_TEST 2023-01-25 12:24:40 -08:00
memory-notifier-error-inject.c
…
memregion.c
…
memweight.c
…
muldi3.c
…
net_utils.c mac_pton: Don't access memory over expected length 2022-11-09 19:28:02 -08:00
netdev-notifier-error-inject.c
…
nlattr.c netlink: prevent potential spectre v1 gadgets 2023-01-20 17:52:32 -08:00
nmi_backtrace.c
…
notifier-error-inject.c lib/notifier-error-inject: fix error when writing -errno to debugfs file 2022-11-30 16:13:16 -08:00
notifier-error-inject.h
…
objagg.c
…
of-reconfig-notifier-error-inject.c
…
oid_registry.c lib/oid_registry.c: remove redundant assignment to variable num 2022-11-18 13:55:06 -08:00
once.c
…
overflow_kunit.c overflow: Introduce overflows_type() and castable_to_type() 2022-11-02 12:39:27 -07:00
packing.c lib: packing: replace bit_reverse() with bitrev8() 2022-12-12 15:06:30 -08:00
parman.c
…
parser.c
…
pci_iomap.c
…
percpu-refcount.c percpu-refcount: Use call_rcu_hurry() for atomic switch 2022-11-30 13:16:40 -08:00
percpu_counter.c percpu_counter: add percpu_counter_sum_all interface 2022-11-30 15:58:40 -08:00
percpu_test.c
…
plist.c
…
pm-notifier-error-inject.c
…
polynomial.c
…
radix-tree.c lib/radix-tree.c: fix uninitialized variable compilation warning 2022-11-30 16:13:17 -08:00
random32.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
ratelimit.c
…
rbtree.c
…
rbtree_test.c
…
ref_tracker.c
…
refcount.c
…
rhashtable.c rhashtable: Allow rhashtable to be used from irq-safe contexts 2022-12-09 10:42:56 +00:00
sbitmap.c for-6.2/block-2022-12-08 2022-12-13 10:43:59 -08:00
scatterlist.c lib/scatterlist: Fix to calculate the last_pg properly 2023-01-16 12:08:31 -04:00
seq_buf.c
…
sg_pool.c
…
sg_split.c
…
show_mem.c
…
siphash.c
…
siphash_kunit.c siphash: Convert selftest to KUnit 2022-11-01 10:04:52 -07:00
slub_kunit.c linux-kselftest-kunit-next-6.2-rc1 2022-12-12 16:42:57 -08:00
smp_processor_id.c
…
sort.c
…
stackdepot.c
…
stackinit_kunit.c
…
stmp_device.c
…
string.c string: Rewrite and add more kern-doc for the str*() functions 2022-10-28 16:07:57 -07:00
string_helpers.c
…
strncpy_from_user.c
…
strnlen_user.c
…
strscpy_kunit.c fortify: Short-circuit known-safe calls to strscpy() 2022-11-01 10:04:52 -07:00
syscall.c
…
test-kstrtox.c
…
test-string_helpers.c treewide: use get_random_u32_below() instead of deprecated function 2022-11-18 02:15:15 +01:00
test_bitmap.c
…
test_bitops.c
…
test_bits.c
…
test_blackhole_dev.c
…
test_bpf.c net: remove skb->vlan_present 2022-11-11 18:18:05 -08:00
test_debug_virtual.c
…
test_dynamic_debug.c
…
test_firmware.c test_firmware: fix memory leak in test_firmware_init() 2022-11-23 19:49:13 +01:00
test_fprobe.c treewide: use get_random_u32_{above,below}() instead of manual loop 2022-11-18 02:15:22 +01:00
test_fpu.c
…
test_free_pages.c
…
test_hash.c
…
test_hexdump.c treewide: use get_random_u32_inclusive() when possible 2022-11-18 02:18:02 +01:00
test_hmm.c hmm-tests: add test for migrate_device_range() 2022-10-12 18:51:50 -07:00
test_hmm_uapi.h hmm-tests: add test for migrate_device_range() 2022-10-12 18:51:50 -07:00
test_ida.c
…
test_kmod.c testing: use the copyleft-next-0.3.1 SPDX tag 2022-11-08 15:44:02 +01:00
test_kprobes.c treewide: use get_random_u32_{above,below}() instead of manual loop 2022-11-18 02:15:22 +01:00
test_linear_ranges.c lib/test_linear_ranges: Use LINEAR_RANGE() 2022-11-16 13:32:32 +00:00
test_list_sort.c treewide: use get_random_u32_below() instead of deprecated function 2022-11-18 02:15:15 +01:00
test_lockup.c
…
test_maple_tree.c test_maple_tree: add test for mas_spanning_rebalance() on insufficient data 2022-12-21 14:31:52 -08:00
test_memcat_p.c
…
test_meminit.c lib/test_meminit: add checks for the allocation functions 2022-10-12 18:51:49 -07:00
test_min_heap.c treewide: use get_random_u32() when possible 2022-10-11 17:42:58 -06:00
test_module.c
…
test_objagg.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
test_parman.c
…
test_printf.c Random number generator updates for Linux 6.2-rc1. 2022-12-12 16:22:22 -08:00
test_ref_tracker.c
…
test_rhashtable.c Networking changes for 6.2. 2022-12-13 15:47:48 -08:00
test_scanf.c
…
test_sort.c
…
test_static_key_base.c
…
test_static_keys.c
…
test_string.c
…
test_sysctl.c testing: use the copyleft-next-0.3.1 SPDX tag 2022-11-08 15:44:02 +01:00
test_ubsan.c
…
test_user_copy.c
…
test_uuid.c
…
test_vmalloc.c treewide: use get_random_u32_inclusive() when possible 2022-11-18 02:18:02 +01:00
test_xarray.c
…
textsearch.c
…
timerqueue.c
…
trace_readwrite.c asm-generic/io: Add _RET_IP_ to MMIO trace for more accurate debug info 2022-11-21 22:02:10 +01:00
ts_bm.c
…
ts_fsm.c
…
ts_kmp.c
…
ubsan.c panic: Consolidate open-coded panic_on_warn checks 2022-12-02 13:04:44 -08:00
ubsan.h
…
ucmpdi2.c
…
ucs2_string.c
…
usercopy.c
…
uuid.c treewide: use get_random_bytes() when possible 2022-10-11 17:42:58 -06:00
vsprintf.c Random number generator updates for Linux 6.2-rc1. 2022-12-12 16:22:22 -08:00
win_minmax.c lib/win_minmax: use /* notation for regular comments 2023-01-11 16:14:21 -08:00
xarray.c
…
xxhash.c
…