[PATCH] perf/core: Fix cgroup event list management

[PATCH] perf/core: Fix cgroup event list management

[Namhyung Kim]

The active cgroup events are managed in the per-cpu cgrp_cpuctx_list.
This list is accessed from current cpu and not protected by any locks.
But from the commit ef54c1a476ae ("perf: Rework
perf_event_exit_event()"), this assumption does not hold true anymore.

In the perf_remove_from_context(), it can remove an event from the
context without an IPI when the context is not active.  I think it
assumes task event context, but it's possible for cpu event context
only with cgroup events can be inactive at the moment - and it might
become active soon.

If the event is enabled when it's about to be closed, it might call
perf_cgroup_event_disable() and list_del() with the cgrp_cpuctx_list
on a different cpu.

This resulted in a crash due to an invalid list pointer access during
the cgroup list traversal on the cpu which the event belongs to.

The following program can crash my box easily..

  #include <stdio.h>
  #include <fcntl.h>
  #include <unistd.h>
  #include <linux/perf_event.h>
  #include <sys/stat.h>
  #include <sys/syscall.h>

  //#define CGROUP_ROOT  "/dev/cgroup/devices"
  #define CGROUP_ROOT  "/sys/fs/cgroup"

  int perf_event_open(struct perf_event_attr *attr, int pid, int cpu,
                      int grp, unsigned long flags)
  {
    return syscall(SYS_perf_event_open, attr, pid, cpu, grp, flags);
  }

  int get_cgroup_fd(const char *grp)
  {
    char buf[128];

    snprintf(buf, sizeof(buf), "%s/%s", CGROUP_ROOT, grp);

    /* ignore failures */
    mkdir(buf, 0755);

    return open(buf, O_RDONLY);
  }

  int main(int argc, char *argv[])
  {
    struct perf_event_attr hw = {
      .type = PERF_TYPE_HARDWARE,
      .config = PERF_COUNT_HW_CPU_CYCLES,
    };
    struct perf_event_attr sw = {
      .type = PERF_TYPE_SOFTWARE,
      .config = PERF_COUNT_SW_CPU_CLOCK,
    };
    int cpus = sysconf(_SC_NPROCESSORS_ONLN);
    int fd[4][cpus];
    int cgrpA, cgrpB;

    cgrpA = get_cgroup_fd("A");
    cgrpB = get_cgroup_fd("B");
    if (cgrpA < 0 || cgrpB < 0) {
      printf("failed to get cgroup fd\n");
      return 1;
    }

    while (1) {
      int i;

      for (i = 0; i < cpus; i++) {
        fd[0][i] = perf_event_open(&hw, cgrpA, i, -1, PERF_FLAG_PID_CGROUP);
        fd[1][i] = perf_event_open(&sw, cgrpA, i, -1, PERF_FLAG_PID_CGROUP);
        fd[2][i] = perf_event_open(&hw, cgrpB, i, -1, PERF_FLAG_PID_CGROUP);
        fd[3][i] = perf_event_open(&sw, cgrpB, i, -1, PERF_FLAG_PID_CGROUP);
      }

      for (i = 0; i < cpus; i++) {
        close(fd[3][i]);
        close(fd[2][i]);
        close(fd[1][i]);
        close(fd[0][i]);
      }
    }
    return 0;
  }

Let's use IPI to prevent such crashes.

Similarly, I think perf_install_in_context() should use IPI for the
first cgroup event at least.

Cc: Marco Elver <elver@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
 kernel/events/core.c | 7 +++++--
 1 file changed, 5 insertions(+), 2 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 30d94f68c5bd..8ebb41ab2089 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -2388,7 +2388,7 @@ static void perf_remove_from_context(struct perf_event *event, unsigned long fla
 	 * event_function_call() user.
 	 */
 	raw_spin_lock_irq(&ctx->lock);
-	if (!ctx->is_active) {
+	if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
 		__perf_remove_from_context(event, __get_cpu_context(ctx),
 					   ctx, (void *)flags);
 		raw_spin_unlock_irq(&ctx->lock);
@@ -2857,11 +2857,14 @@ perf_install_in_context(struct perf_event_context *ctx,
 	 * perf_event_attr::disabled events will not run and can be initialized
 	 * without IPI. Except when this is the first event for the context, in
 	 * that case we need the magic of the IPI to set ctx->is_active.
+	 * Similarly, the first cgroup event for the context also needs the IPI
+	 * to manipulate the cgrp_cpuctx_list.
 	 *
 	 * The IOC_ENABLE that is sure to follow the creation of a disabled
 	 * event will issue the IPI and reprogram the hardware.
 	 */
-	if (__perf_effective_state(event) == PERF_EVENT_STATE_OFF && ctx->nr_events) {
+	if (__perf_effective_state(event) == PERF_EVENT_STATE_OFF &&
+	    ctx->nr_events && (ctx->nr_cgroups || !is_cgroup_event(event))) {
 		raw_spin_lock_irq(&ctx->lock);
 		if (ctx->task == TASK_TOMBSTONE) {
 			raw_spin_unlock_irq(&ctx->lock);
-- 
2.34.1.173.g76aa8bc2d0-goog

Re: [PATCH] perf/core: Fix cgroup event list management

[kernel test robot]

[-- Attachment #1: Type: text/plain, Size: 3876 bytes --]

Hi Namhyung,

I love your patch! Yet something to improve:

[auto build test ERROR on tip/perf/core]
[also build test ERROR on tip/master linux/master linus/master v5.16-rc4]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Namhyung-Kim/perf-core-Fix-cgroup-event-list-management/20211211-080810
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git a9f4a6e92b3b319296fb078da2615f618f6cd80c
config: csky-randconfig-r012-20211210 (https://download.01.org/0day-ci/archive/20211211/202112111040.jKqB3uu1-lkp(a)intel.com/config)
compiler: csky-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/226bdbf0501464bc088d582c02d0495a61a68b7c
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Namhyung-Kim/perf-core-Fix-cgroup-event-list-management/20211211-080810
        git checkout 226bdbf0501464bc088d582c02d0495a61a68b7c
        # save the config file to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=csky SHELL=/bin/bash kernel/events/

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   kernel/events/core.c: In function 'perf_remove_from_context':
>> kernel/events/core.c:2391:63: error: 'struct perf_event_context' has no member named 'nr_cgroups'
    2391 |         if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
         |                                                               ^~
   kernel/events/core.c: In function 'perf_install_in_context':
   kernel/events/core.c:2867:35: error: 'struct perf_event_context' has no member named 'nr_cgroups'
    2867 |             ctx->nr_events && (ctx->nr_cgroups || !is_cgroup_event(event))) {
         |                                   ^~


vim +2391 kernel/events/core.c

  2368	
  2369	/*
  2370	 * Remove the event from a task's (or a CPU's) list of events.
  2371	 *
  2372	 * If event->ctx is a cloned context, callers must make sure that
  2373	 * every task struct that event->ctx->task could possibly point to
  2374	 * remains valid.  This is OK when called from perf_release since
  2375	 * that only calls us on the top-level context, which can't be a clone.
  2376	 * When called from perf_event_exit_task, it's OK because the
  2377	 * context has been detached from its task.
  2378	 */
  2379	static void perf_remove_from_context(struct perf_event *event, unsigned long flags)
  2380	{
  2381		struct perf_event_context *ctx = event->ctx;
  2382	
  2383		lockdep_assert_held(&ctx->mutex);
  2384	
  2385		/*
  2386		 * Because of perf_event_exit_task(), perf_remove_from_context() ought
  2387		 * to work in the face of TASK_TOMBSTONE, unlike every other
  2388		 * event_function_call() user.
  2389		 */
  2390		raw_spin_lock_irq(&ctx->lock);
> 2391		if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
  2392			__perf_remove_from_context(event, __get_cpu_context(ctx),
  2393						   ctx, (void *)flags);
  2394			raw_spin_unlock_irq(&ctx->lock);
  2395			return;
  2396		}
  2397		raw_spin_unlock_irq(&ctx->lock);
  2398	
  2399		event_function_call(event, __perf_remove_from_context, (void *)flags);
  2400	}
  2401	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

Re: [PATCH] perf/core: Fix cgroup event list management

[kernel test robot]

Hi Namhyung,

I love your patch! Yet something to improve:

[auto build test ERROR on tip/perf/core]
[also build test ERROR on tip/master linux/master linus/master v5.16-rc4]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Namhyung-Kim/perf-core-Fix-cgroup-event-list-management/20211211-080810
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git a9f4a6e92b3b319296fb078da2615f618f6cd80c
config: csky-randconfig-r012-20211210 (https://download.01.org/0day-ci/archive/20211211/202112111040.jKqB3uu1-lkp@intel.com/config)
compiler: csky-linux-gcc (GCC) 11.2.0
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/226bdbf0501464bc088d582c02d0495a61a68b7c
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Namhyung-Kim/perf-core-Fix-cgroup-event-list-management/20211211-080810
        git checkout 226bdbf0501464bc088d582c02d0495a61a68b7c
        # save the config file to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-11.2.0 make.cross O=build_dir ARCH=csky SHELL=/bin/bash kernel/events/

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

   kernel/events/core.c: In function 'perf_remove_from_context':
>> kernel/events/core.c:2391:63: error: 'struct perf_event_context' has no member named 'nr_cgroups'
    2391 |         if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
         |                                                               ^~
   kernel/events/core.c: In function 'perf_install_in_context':
   kernel/events/core.c:2867:35: error: 'struct perf_event_context' has no member named 'nr_cgroups'
    2867 |             ctx->nr_events && (ctx->nr_cgroups || !is_cgroup_event(event))) {
         |                                   ^~


vim +2391 kernel/events/core.c

  2368	
  2369	/*
  2370	 * Remove the event from a task's (or a CPU's) list of events.
  2371	 *
  2372	 * If event->ctx is a cloned context, callers must make sure that
  2373	 * every task struct that event->ctx->task could possibly point to
  2374	 * remains valid.  This is OK when called from perf_release since
  2375	 * that only calls us on the top-level context, which can't be a clone.
  2376	 * When called from perf_event_exit_task, it's OK because the
  2377	 * context has been detached from its task.
  2378	 */
  2379	static void perf_remove_from_context(struct perf_event *event, unsigned long flags)
  2380	{
  2381		struct perf_event_context *ctx = event->ctx;
  2382	
  2383		lockdep_assert_held(&ctx->mutex);
  2384	
  2385		/*
  2386		 * Because of perf_event_exit_task(), perf_remove_from_context() ought
  2387		 * to work in the face of TASK_TOMBSTONE, unlike every other
  2388		 * event_function_call() user.
  2389		 */
  2390		raw_spin_lock_irq(&ctx->lock);
> 2391		if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
  2392			__perf_remove_from_context(event, __get_cpu_context(ctx),
  2393						   ctx, (void *)flags);
  2394			raw_spin_unlock_irq(&ctx->lock);
  2395			return;
  2396		}
  2397		raw_spin_unlock_irq(&ctx->lock);
  2398	
  2399		event_function_call(event, __perf_remove_from_context, (void *)flags);
  2400	}
  2401	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

Re: [PATCH] perf/core: Fix cgroup event list management

[kernel test robot]

Hi Namhyung,

I love your patch! Yet something to improve:

[auto build test ERROR on tip/perf/core]
[also build test ERROR on tip/master linux/master linus/master v5.16-rc4]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Namhyung-Kim/perf-core-Fix-cgroup-event-list-management/20211211-080810
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git a9f4a6e92b3b319296fb078da2615f618f6cd80c
config: hexagon-randconfig-r045-20211210 (https://download.01.org/0day-ci/archive/20211211/202112111047.pgCIWSVK-lkp@intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 097a1cb1d5ebb3a0ec4bcaed8ba3ff6a8e33c00a)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/226bdbf0501464bc088d582c02d0495a61a68b7c
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Namhyung-Kim/perf-core-Fix-cgroup-event-list-management/20211211-080810
        git checkout 226bdbf0501464bc088d582c02d0495a61a68b7c
        # save the config file to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=hexagon SHELL=/bin/bash kernel/events/

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

>> kernel/events/core.c:2391:58: error: no member named 'nr_cgroups' in 'struct perf_event_context'
           if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
                                                              ~~~  ^
   kernel/events/core.c:2867:30: error: no member named 'nr_cgroups' in 'struct perf_event_context'
               ctx->nr_events && (ctx->nr_cgroups || !is_cgroup_event(event))) {
                                  ~~~  ^
   2 errors generated.


vim +2391 kernel/events/core.c

  2368	
  2369	/*
  2370	 * Remove the event from a task's (or a CPU's) list of events.
  2371	 *
  2372	 * If event->ctx is a cloned context, callers must make sure that
  2373	 * every task struct that event->ctx->task could possibly point to
  2374	 * remains valid.  This is OK when called from perf_release since
  2375	 * that only calls us on the top-level context, which can't be a clone.
  2376	 * When called from perf_event_exit_task, it's OK because the
  2377	 * context has been detached from its task.
  2378	 */
  2379	static void perf_remove_from_context(struct perf_event *event, unsigned long flags)
  2380	{
  2381		struct perf_event_context *ctx = event->ctx;
  2382	
  2383		lockdep_assert_held(&ctx->mutex);
  2384	
  2385		/*
  2386		 * Because of perf_event_exit_task(), perf_remove_from_context() ought
  2387		 * to work in the face of TASK_TOMBSTONE, unlike every other
  2388		 * event_function_call() user.
  2389		 */
  2390		raw_spin_lock_irq(&ctx->lock);
> 2391		if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
  2392			__perf_remove_from_context(event, __get_cpu_context(ctx),
  2393						   ctx, (void *)flags);
  2394			raw_spin_unlock_irq(&ctx->lock);
  2395			return;
  2396		}
  2397		raw_spin_unlock_irq(&ctx->lock);
  2398	
  2399		event_function_call(event, __perf_remove_from_context, (void *)flags);
  2400	}
  2401	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org

Re: [PATCH] perf/core: Fix cgroup event list management

[kernel test robot]

[-- Attachment #1: Type: text/plain, Size: 3815 bytes --]

Hi Namhyung,

I love your patch! Yet something to improve:

[auto build test ERROR on tip/perf/core]
[also build test ERROR on tip/master linux/master linus/master v5.16-rc4]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url:    https://github.com/0day-ci/linux/commits/Namhyung-Kim/perf-core-Fix-cgroup-event-list-management/20211211-080810
base:   https://git.kernel.org/pub/scm/linux/kernel/git/tip/tip.git a9f4a6e92b3b319296fb078da2615f618f6cd80c
config: hexagon-randconfig-r045-20211210 (https://download.01.org/0day-ci/archive/20211211/202112111047.pgCIWSVK-lkp(a)intel.com/config)
compiler: clang version 14.0.0 (https://github.com/llvm/llvm-project 097a1cb1d5ebb3a0ec4bcaed8ba3ff6a8e33c00a)
reproduce (this is a W=1 build):
        wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
        chmod +x ~/bin/make.cross
        # https://github.com/0day-ci/linux/commit/226bdbf0501464bc088d582c02d0495a61a68b7c
        git remote add linux-review https://github.com/0day-ci/linux
        git fetch --no-tags linux-review Namhyung-Kim/perf-core-Fix-cgroup-event-list-management/20211211-080810
        git checkout 226bdbf0501464bc088d582c02d0495a61a68b7c
        # save the config file to linux build tree
        mkdir build_dir
        COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross W=1 O=build_dir ARCH=hexagon SHELL=/bin/bash kernel/events/

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>

All errors (new ones prefixed by >>):

>> kernel/events/core.c:2391:58: error: no member named 'nr_cgroups' in 'struct perf_event_context'
           if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
                                                              ~~~  ^
   kernel/events/core.c:2867:30: error: no member named 'nr_cgroups' in 'struct perf_event_context'
               ctx->nr_events && (ctx->nr_cgroups || !is_cgroup_event(event))) {
                                  ~~~  ^
   2 errors generated.


vim +2391 kernel/events/core.c

  2368	
  2369	/*
  2370	 * Remove the event from a task's (or a CPU's) list of events.
  2371	 *
  2372	 * If event->ctx is a cloned context, callers must make sure that
  2373	 * every task struct that event->ctx->task could possibly point to
  2374	 * remains valid.  This is OK when called from perf_release since
  2375	 * that only calls us on the top-level context, which can't be a clone.
  2376	 * When called from perf_event_exit_task, it's OK because the
  2377	 * context has been detached from its task.
  2378	 */
  2379	static void perf_remove_from_context(struct perf_event *event, unsigned long flags)
  2380	{
  2381		struct perf_event_context *ctx = event->ctx;
  2382	
  2383		lockdep_assert_held(&ctx->mutex);
  2384	
  2385		/*
  2386		 * Because of perf_event_exit_task(), perf_remove_from_context() ought
  2387		 * to work in the face of TASK_TOMBSTONE, unlike every other
  2388		 * event_function_call() user.
  2389		 */
  2390		raw_spin_lock_irq(&ctx->lock);
> 2391		if (!ctx->is_active && (!is_cgroup_event(event) || ctx->nr_cgroups > 1)) {
  2392			__perf_remove_from_context(event, __get_cpu_context(ctx),
  2393						   ctx, (void *)flags);
  2394			raw_spin_unlock_irq(&ctx->lock);
  2395			return;
  2396		}
  2397		raw_spin_unlock_irq(&ctx->lock);
  2398	
  2399		event_function_call(event, __perf_remove_from_context, (void *)flags);
  2400	}
  2401	

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org