TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
Files
054441182b51beca00f0c639b0119a1995143772
kernel_xiaomi_sm8250/kernel
History
Prateek Sood 5ce7528c4d tracing: Fix race in perf_trace_buf initialization 
commit 6b1340cc00edeadd52ebd8a45171f38c8de2a387 upstream.

A race condition exists while initialiazing perf_trace_buf from
perf_trace_init() and perf_kprobe_init().

      CPU0                                        CPU1
perf_trace_init()
  mutex_lock(&event_mutex)
    perf_trace_event_init()
      perf_trace_event_reg()
        total_ref_count == 0
	buf = alloc_percpu()
        perf_trace_buf[i] = buf
        tp_event->class->reg() //fails       perf_kprobe_init()
	goto fail                              perf_trace_event_init()
                                                 perf_trace_event_reg()
        fail:
	  total_ref_count == 0

                                                   total_ref_count == 0
                                                   buf = alloc_percpu()
                                                   perf_trace_buf[i] = buf
                                                   tp_event->class->reg()
                                                   total_ref_count++

          free_percpu(perf_trace_buf[i])
          perf_trace_buf[i] = NULL

Any subsequent call to perf_trace_event_reg() will observe total_ref_count > 0,
causing the perf_trace_buf to be always NULL. This can result in perf_trace_buf
getting accessed from perf_trace_buf_alloc() without being initialized. Acquiring
event_mutex in perf_kprobe_init() before calling perf_trace_event_init() should
fix this race.

The race caused the following bug:

 Unable to handle kernel paging request at virtual address 0000003106f2003c
 Mem abort info:
   ESR = 0x96000045
   Exception class = DABT (current EL), IL = 32 bits
   SET = 0, FnV = 0
   EA = 0, S1PTW = 0
 Data abort info:
   ISV = 0, ISS = 0x00000045
   CM = 0, WnR = 1
 user pgtable: 4k pages, 39-bit VAs, pgdp = ffffffc034b9b000
 [0000003106f2003c] pgd=0000000000000000, pud=0000000000000000
 Internal error: Oops: 96000045 [#1] PREEMPT SMP
 Process syz-executor (pid: 18393, stack limit = 0xffffffc093190000)
 pstate: 80400005 (Nzcv daif +PAN -UAO)
 pc : __memset+0x20/0x1ac
 lr : memset+0x3c/0x50
 sp : ffffffc09319fc50

  __memset+0x20/0x1ac
  perf_trace_buf_alloc+0x140/0x1a0
  perf_trace_sys_enter+0x158/0x310
  syscall_trace_enter+0x348/0x7c0
  el0_svc_common+0x11c/0x368
  el0_svc_handler+0x12c/0x198
  el0_svc+0x8/0xc

Ramdumps showed the following:
  total_ref_count = 3
  perf_trace_buf = (
      0x0 -> NULL,
      0x0 -> NULL,
      0x0 -> NULL,
      0x0 -> NULL)

Link: http://lkml.kernel.org/r/1571120245-4186-1-git-send-email-prsood@codeaurora.org

Cc: stable@vger.kernel.org
Fixes: e12f03d703 ("perf/core: Implement the 'perf_kprobe' PMU")
Acked-by: Song Liu <songliubraving@fb.com>
Signed-off-by: Prateek Sood <prsood@codeaurora.org>
Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-10-29 09:20:03 +01:00
..
bpf
bpf: fix use after free in prog symbol exposure
2019-10-07 18:57:19 +02:00
cgroup
cgroup: Fix css_task_iter_advance_css_set() cset skip condition
2019-08-09 17:52:35 +02:00
configs
…
debug
kdb: Don't back trace on a cpu that didn't round up
2019-02-12 19:47:19 +01:00
dma
dma-direct: do not include SME mask in the DMA supported check
2019-01-13 09:51:05 +01:00
events
perf/aux: Fix AUX output stopping
2019-10-29 09:20:03 +01:00
gcov
…
irq
genirq: Prevent NULL pointer dereference in resend_irqs()
2019-09-19 09:09:34 +02:00
livepatch
livepatch: Nullify obj->mod in klp_module_coming()'s error path
2019-10-07 18:57:10 +02:00
locking
Revert "locking/pvqspinlock: Don't wait if vCPU is preempted"
2019-10-11 18:21:06 +02:00
power
x86/power: Fix 'nosmt' vs hibernation triple fault during resume
2019-06-11 12:20:52 +02:00
printk
printk: Do not lose last line in kmsg buffer dump
2019-10-05 13:10:01 +02:00
rcu
rcuperf: Fix cleanup path for invalid perf_type strings
2019-05-31 06:46:30 -07:00
sched
sched/core: Fix migration to invalid CPU in __set_cpus_allowed_ptr()
2019-10-11 18:21:22 +02:00
time
tick: broadcast-hrtimer: Fix a race in bc_set_next
2019-10-11 18:21:28 +02:00
trace
tracing: Fix race in perf_trace_buf initialization
2019-10-29 09:20:03 +01:00
.gitignore
…
acct.c
acct_on(): don't mess with freeze protection
2019-05-31 06:46:05 -07:00
async.c
…
audit_fsnotify.c
…
audit_tree.c
Merge tag 'fsnotify_for_v4.19-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs
2018-08-17 09:41:28 -07:00
audit_watch.c
audit: fix use-after-free in audit_add_watch
2018-07-18 11:43:36 -04:00
audit.c
audit: use ktime_get_coarse_real_ts64() for timestamps
2018-07-17 14:45:08 -04:00
audit.h
…
auditfilter.c
audit: fix a memory leak bug
2019-05-31 06:46:17 -07:00
auditsc.c
Merge tag 'audit-pr-20180814' of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit
2018-08-15 10:46:54 -07:00
backtracetest.c
…
bounds.c
kbuild: fix kernel/bounds.c 'W=1' warning
2018-11-13 11:08:47 -08:00
capability.c
…
compat.c
…
configs.c
…
context_tracking.c
…
cpu_pm.c
…
cpu.c
cpu/hotplug: Fix out-of-bounds read when setting fail state
2019-07-21 09:03:11 +02:00
crash_core.c
kernel/crash_core.c: print timestamp using time64_t
2018-08-22 10:52:47 -07:00
crash_dump.c
…
cred.c
access: avoid the RCU grace period for the temporary subjective credentials
2019-07-31 07:27:11 +02:00
delayacct.c
…
dma.c
…
elfcore.c
kernel/elfcore.c: include proper prototypes
2019-10-11 18:21:23 +02:00
exec_domain.c
…
exit.c
cgroup: Call cgroup_release() before __exit_signal()
2019-08-09 17:52:34 +02:00
extable.c
…
fail_function.c
…
fork.c
kernel/sysctl.c: do not override max_threads provided by userspace
2019-10-17 13:45:19 -07:00
freezer.c
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
futex_compat.c
…
futex.c
locking/futex: Allow low-level atomic operations to return -EAGAIN
2019-05-10 17:54:11 +02:00
groups.c
…
hung_task.c
kernel: hung_task.c: disable on suspend
2019-04-20 09:16:02 +02:00
iomem.c
…
irq_work.c
irq_work: Do not raise an IPI when queueing work on the local CPU
2019-05-31 06:46:19 -07:00
jump_label.c
jump_label: move 'asm goto' support test to Kconfig
2019-06-04 08:02:34 +02:00
kallsyms.c
kallsyms: Don't let kallsyms_lookup_size_offset() fail on retrieving the first symbol
2019-09-21 07:17:02 +02:00
kcmp.c
…
Kconfig.freezer
…
Kconfig.hz
…
Kconfig.locks
…
Kconfig.preempt
kconfig: include kernel/Kconfig.preempt from init/Kconfig
2018-08-02 08:06:54 +09:00
kcov.c
kernel/kcov.c: mark write_comp_data() as notrace
2019-02-12 19:47:20 +01:00
kexec_core.c
kexec: bail out upon SIGKILL when allocating memory.
2019-10-07 18:57:28 +02:00
kexec_file.c
…
kexec_internal.h
…
kexec.c
kexec: add call to LSM hook in original kexec_load syscall
2018-07-16 12:31:57 -07:00
kmod.c
…
kprobes.c
kprobes: Prohibit probing on BUG() and WARN() address
2019-10-05 13:09:54 +02:00
ksysfs.c
…
kthread.c
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
latencytop.c
…
Makefile
x86/uaccess, kcov: Disable stack protector
2019-06-19 08:18:01 +02:00
memremap.c
mm, devm_memremap_pages: add MEMORY_DEVICE_PRIVATE support
2019-01-13 09:51:04 +01:00
module_signing.c
…
module-internal.h
…
module.c
modules: fix compile error if don't have strict module rwx
2019-09-19 09:09:40 +02:00
notifier.c
…
nsproxy.c
…
padata.c
padata: use smp_mb in padata_reorder to avoid orphaned padata jobs
2019-07-26 09:14:25 +02:00
panic.c
panic: ensure preemption is disabled during panic()
2019-10-17 13:44:46 -07:00
params.c
…
pid_namespace.c
signal/pid_namespace: Fix reboot_pid_ns to use send_sig not force_sig
2019-07-26 09:14:01 +02:00
pid.c
Fix failure path in alloc_pid()
2019-01-13 09:51:06 +01:00
profile.c
…
ptrace.c
ptrace: Fix ->ptracer_cred handling for PTRACE_TRACEME
2019-07-10 09:53:41 +02:00
range.c
…
reboot.c
PM / reboot: Eliminate race between reboot and suspend
2018-08-06 12:35:20 +02:00
relay.c
relay: check return of create_buf_file() properly
2019-03-13 14:02:35 -07:00
resource.c
resource: fix locking in find_next_iomem_res()
2019-09-16 08:22:20 +02:00
rseq.c
…
seccomp.c
…
signal.c
kernel/signal.c: trace_signal_deliver when signal_group_exit
2019-06-09 09:17:20 +02:00
smp.c
cpu/hotplug: Fix "SMT disabled by BIOS" detection for KVM
2019-02-12 19:47:25 +01:00
smpboot.c
…
smpboot.h
…
softirq.c
nohz: Fix missing tick reprogram when interrupting an inline softirq
2018-08-03 15:52:10 +02:00
stacktrace.c
…
stop_machine.c
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2018-08-13 11:25:07 -07:00
sys_ni.c
…
sys.c
kernel/sys.c: prctl: fix false positive in validate_prctl_map()
2019-06-15 11:54:01 +02:00
sysctl_binary.c
…
sysctl.c
sysctl: return -EINVAL if val violates minmax
2019-06-15 11:53:59 +02:00
task_work.c
…
taskstats.c
…
test_kprobes.c
…
torture.c
…
tracepoint.c
tracepoint: Fix tracepoint array element size mismatch
2018-10-17 15:35:29 -04:00
tsacct.c
…
ucount.c
…
uid16.c
…
uid16.h
…
umh.c
…
up.c
…
user_namespace.c
userns: also map extents in the reverse map to kernel IDs
2018-11-13 11:09:00 -08:00
user-return-notifier.c
…
user.c
userns: use irqsave variant of refcount_dec_and_lock()
2018-08-22 10:52:47 -07:00
utsname_sysctl.c
sys: don't hold uts_sem while accessing userspace memory
2018-08-11 02:05:53 -05:00
utsname.c
…
watchdog_hld.c
watchdog: Mark watchdog touch functions as notrace
2018-08-30 12:56:40 +02:00
watchdog.c
watchdog: Respect watchdog cpumask on CPU hotplug
2019-04-03 06:26:29 +02:00
workqueue_internal.h
…
workqueue.c
workqueue: Try to catch flush_work() without INIT_WORK().
2019-05-02 09:58:56 +02:00