| Message ID | 20240722210648.80892-2-lucas.demarchi@intel.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Fix i915 pmu on bind/unbind | expand |
On Mon, Jul 22, 2024 at 2:07 PM Lucas De Marchi <lucas.demarchi@intel.com> wrote: > > If a pmu is unregistered while there's an active event, perf will still > access the pmu via event->pmu, even after the event is destroyed. This > makes it difficult for drivers like i915 that take a reference on the > device when the event is created and put it when it's destroyed. > Currently the following use-after-free happens just after destroying the > event: > > BUG: KASAN: use-after-free in exclusive_event_destroy+0xd8/0xf0 > Read of size 4 at addr ffff88816e2bb63c by task perf/7748 > > Whenever and event is created, get a pmu reference to use in event->pmu > and just before calling module_put(), drop the reference.. > > Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com> > --- > include/linux/perf_event.h | 3 +++ > kernel/events/core.c | 32 ++++++++++++++++++++++++++++---- > 2 files changed, 31 insertions(+), 4 deletions(-) > > diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h > index a5304ae8c654..7048a505e93c 100644 > --- a/include/linux/perf_event.h > +++ b/include/linux/perf_event.h > @@ -540,6 +540,9 @@ struct pmu { > * Check period value for PERF_EVENT_IOC_PERIOD ioctl. > */ > int (*check_period) (struct perf_event *event, u64 value); /* optional */ > + > + struct pmu *(*get) (struct pmu *pmu); /* optional: get a reference */ > + void (*put) (struct pmu *pmu); /* optional: put a reference */ > }; > > enum perf_addr_filter_action_t { > diff --git a/kernel/events/core.c b/kernel/events/core.c > index 1b6f5dc7ed32..cc7541b644b0 100644 > --- a/kernel/events/core.c > +++ b/kernel/events/core.c > @@ -5208,6 +5208,8 @@ static void perf_addr_filters_splice(struct perf_event *event, > > static void _free_event(struct perf_event *event) > { > + struct module *module; > + > irq_work_sync(&event->pending_irq); > > unaccount_event(event); > @@ -5259,7 +5261,13 @@ static void _free_event(struct perf_event *event) > put_ctx(event->ctx); > > exclusive_event_destroy(event); > - module_put(event->pmu->module); > + > + module = event->pmu->module; > + event->pmu->put(event->pmu); > + /* can't touch pmu anymore */ > + event->pmu = NULL; > + > + module_put(module); > > call_rcu(&event->rcu_head, free_event_rcu); > } > @@ -11331,6 +11339,11 @@ static int perf_pmu_nop_int(struct pmu *pmu) > return 0; > } > > +static struct pmu *perf_pmu_nop_pmu(struct pmu *pmu) > +{ > + return pmu; > +} > + > static int perf_event_nop_int(struct perf_event *event, u64 value) > { > return 0; > @@ -11617,6 +11630,12 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type) > if (!pmu->event_idx) > pmu->event_idx = perf_event_idx_default; > > + if (!pmu->get) > + pmu->get = perf_pmu_nop_pmu; > + > + if (!pmu->put) > + pmu->put = perf_pmu_nop_void; > + > list_add_rcu(&pmu->entry, &pmus); > atomic_set(&pmu->exclusive_cnt, 0); > ret = 0; > @@ -11695,7 +11714,8 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) > BUG_ON(!ctx); > } > > - event->pmu = pmu; > + event->pmu = pmu->get(pmu); > + > ret = pmu->event_init(event); > > if (ctx) > @@ -11714,8 +11734,12 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) > event->destroy(event); > } > > - if (ret) > - module_put(pmu->module); > + if (ret) { > + struct module *module = pmu->module; > + > + pmu->put(pmu); I think this is a great fix, a nit here, wouldn't it be good to do: event->pmu = NULL; Thanks, Ian > + module_put(module); > + } > > return ret; > } > -- > 2.43.0 > >
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h index a5304ae8c654..7048a505e93c 100644 --- a/include/linux/perf_event.h +++ b/include/linux/perf_event.h @@ -540,6 +540,9 @@ struct pmu { * Check period value for PERF_EVENT_IOC_PERIOD ioctl. */ int (*check_period) (struct perf_event *event, u64 value); /* optional */ + + struct pmu *(*get) (struct pmu *pmu); /* optional: get a reference */ + void (*put) (struct pmu *pmu); /* optional: put a reference */ }; enum perf_addr_filter_action_t { diff --git a/kernel/events/core.c b/kernel/events/core.c index 1b6f5dc7ed32..cc7541b644b0 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -5208,6 +5208,8 @@ static void perf_addr_filters_splice(struct perf_event *event, static void _free_event(struct perf_event *event) { + struct module *module; + irq_work_sync(&event->pending_irq); unaccount_event(event); @@ -5259,7 +5261,13 @@ static void _free_event(struct perf_event *event) put_ctx(event->ctx); exclusive_event_destroy(event); - module_put(event->pmu->module); + + module = event->pmu->module; + event->pmu->put(event->pmu); + /* can't touch pmu anymore */ + event->pmu = NULL; + + module_put(module); call_rcu(&event->rcu_head, free_event_rcu); } @@ -11331,6 +11339,11 @@ static int perf_pmu_nop_int(struct pmu *pmu) return 0; } +static struct pmu *perf_pmu_nop_pmu(struct pmu *pmu) +{ + return pmu; +} + static int perf_event_nop_int(struct perf_event *event, u64 value) { return 0; @@ -11617,6 +11630,12 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type) if (!pmu->event_idx) pmu->event_idx = perf_event_idx_default; + if (!pmu->get) + pmu->get = perf_pmu_nop_pmu; + + if (!pmu->put) + pmu->put = perf_pmu_nop_void; + list_add_rcu(&pmu->entry, &pmus); atomic_set(&pmu->exclusive_cnt, 0); ret = 0; @@ -11695,7 +11714,8 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) BUG_ON(!ctx); } - event->pmu = pmu; + event->pmu = pmu->get(pmu); + ret = pmu->event_init(event); if (ctx) @@ -11714,8 +11734,12 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event) event->destroy(event); } - if (ret) - module_put(pmu->module); + if (ret) { + struct module *module = pmu->module; + + pmu->put(pmu); + module_put(module); + } return ret; }
If a pmu is unregistered while there's an active event, perf will still access the pmu via event->pmu, even after the event is destroyed. This makes it difficult for drivers like i915 that take a reference on the device when the event is created and put it when it's destroyed. Currently the following use-after-free happens just after destroying the event: BUG: KASAN: use-after-free in exclusive_event_destroy+0xd8/0xf0 Read of size 4 at addr ffff88816e2bb63c by task perf/7748 Whenever and event is created, get a pmu reference to use in event->pmu and just before calling module_put(), drop the reference.. Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com> --- include/linux/perf_event.h | 3 +++ kernel/events/core.c | 32 ++++++++++++++++++++++++++++---- 2 files changed, 31 insertions(+), 4 deletions(-)