A race condition exists while initialiazing perf_trace_buf from perf_trace_init() and perf_kprobe_init(). CPU0 CPU1 perf_trace_init() mutex_lock(&event_mutex) perf_trace_event_init() perf_trace_event_reg() total_ref_count == 0 buf = alloc_percpu() perf_trace_buf[i] = buf tp_event->class->reg() //fails perf_kprobe_init() goto fail perf_trace_event_init() perf_trace_event_reg() fail: total_ref_count == 0 total_ref_count == 0 buf = alloc_percpu() perf_trace_buf[i] = buf tp_event->class->reg() total_ref_count++ free_percpu(perf_trace_buf[i]) perf_trace_buf[i] = NULL Any subsequent call to perf_trace_event_reg() will observe total_ref_count > 0, causing the perf_trace_buf to be always NULL. This can result in perf_trace_buf getting accessed from perf_trace_buf_alloc() without being initialized. Acquiring event_mutex in perf_kprobe_init() before calling perf_trace_event_init() should fix this race. The race caused the following bug: Unable to handle kernel paging request at virtual address 0000003106f2003c Mem abort info: ESR = 0x96000045 Exception class = DABT (current EL), IL = 32 bits SET = 0, FnV = 0 EA = 0, S1PTW = 0 Data abort info: ISV = 0, ISS = 0x00000045 CM = 0, WnR = 1 user pgtable: 4k pages, 39-bit VAs, pgdp = ffffffc034b9b000 [0000003106f2003c] pgd=0000000000000000, pud=0000000000000000 Internal error: Oops: 96000045 [#1] PREEMPT SMP Process syz-executor (pid: 18393, stack limit = 0xffffffc093190000) pstate: 80400005 (Nzcv daif +PAN -UAO) pc : __memset+0x20/0x1ac lr : memset+0x3c/0x50 sp : ffffffc09319fc50 __memset+0x20/0x1ac perf_trace_buf_alloc+0x140/0x1a0 perf_trace_sys_enter+0x158/0x310 syscall_trace_enter+0x348/0x7c0 el0_svc_common+0x11c/0x368 el0_svc_handler+0x12c/0x198 el0_svc+0x8/0xc Ramdumps showed the following: total_ref_count = 3 perf_trace_buf = ( 0x0 -> NULL, 0x0 -> NULL, 0x0 -> NULL, 0x0 -> NULL) Link: http://lkml.kernel.org/r/1571120245-4186-1-git-send-email-prsood@codeaurora.org
Showing the changes to kernel (1 of 1 file). Show all
Unified · Split
| @@ -272,9 +272,11 @@ int perf_kprobe_init(struct perf_event *p_event, bool is_retprobe) · 271 unmodified lines | |||
| 272 | goto out; | 272 | goto out; |
| 273 | } | 273 | } |
| 274 | 274 | ||
| 275 | mutex_lock(&event_mutex); | ||
| 275 | ret = perf_trace_event_init(tp_event, p_event); | 276 | ret = perf_trace_event_init(tp_event, p_event); |
| 276 | if (ret) | 277 | if (ret) |
| 277 | destroy_local_trace_kprobe(tp_event); | 278 | destroy_local_trace_kprobe(tp_event); |
| 279 | mutex_unlock(&event_mutex); | ||
| 278 | out: | 280 | out: |
| 279 | kfree(func); | 281 | kfree(func); |
| 280 | return ret; | 282 | return ret; |
| @@ -282,8 +284,10 @@ out: · 1 unmodified line | |||
| 282 | 284 | ||
| 283 | void perf_kprobe_destroy(struct perf_event *p_event) | 285 | void perf_kprobe_destroy(struct perf_event *p_event) |
| 284 | { | 286 | { |
| 287 | mutex_lock(&event_mutex); | ||
| 285 | perf_trace_event_close(p_event); | 288 | perf_trace_event_close(p_event); |
| 286 | perf_trace_event_unreg(p_event); | 289 | perf_trace_event_unreg(p_event); |
| 290 | mutex_unlock(&event_mutex); | ||
| 287 | 291 | ||
| 288 | destroy_local_trace_kprobe(p_event->tp_event); | 292 | destroy_local_trace_kprobe(p_event->tp_event); |
| 289 | } | 293 | } |