Re: [syzbot] KASAN: use-after-free Read in put_pmu_ctx

Stanislav Fomichev
2022-12-20T17:10:56Z

[-- Attachment #1: Type: text/plain, Size: 1343 bytes --]

On Tue, Dec 20, 2022 at 12:22 AM Peter Zijlstra <peterz@infradead.org> wrote:
>
> On Mon, Dec 19, 2022 at 11:33:29AM -0800, sdf@google.com wrote:
> > On 12/19, Peter Zijlstra wrote:
> > > On Mon, Dec 19, 2022 at 12:04:43AM -0800, syzbot wrote:
>
> > > > HEAD commit: 13e3c7793e2f Merge tag 'for-netdev' of
> > > https://git.kernel...
> > > > git tree: bpf
> > > > console+strace: https://syzkaller.appspot.com/x/log.txt?x=177df7e0480000
> > > > kernel config:
> > > https://syzkaller.appspot.com/x/.config?x=b0e91ad4b5f69c47
> > > > dashboard link:
> > > https://syzkaller.appspot.com/bug?extid=b8e8c01c8ade4fe6e48f
>
> ^ so syzbot knows what tree and config were used to trigger the report,
> then why:

I haven't used it before and wasn't sure whether it would take the
last commit from the branch of the one where it failed. Adding them
shouldn't hurt, right?

> > Let's maybe try it this way:
> >
> > #syz test: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
> > 13e3c7793e2f
>
> do you have to repeat that again in order for it to test something?

Yeah, I was trying to understand why it doesn't like my patch. It
seems I can retry with the patch attached which hopefully should fix
the possible formatting issue; let's see.

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git
13e3c7793e2f

[-- Attachment #2: pmu.patch --]
[-- Type: text/x-patch, Size: 433 bytes --]

diff --git a/kernel/events/core.c b/kernel/events/core.c
index e47914ac8732..bbff551783e1 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -12689,7 +12689,8 @@ SYSCALL_DEFINE5(perf_event_open,
return event_fd;

err_context:
- /* event->pmu_ctx freed by free_event() */
+ put_pmu_ctx(event->pmu_ctx);
+ event->pmu_ctx = NULL; /* _free_event() */
err_locked:
mutex_unlock(&ctx->mutex);
perf_unpin_context(ctx);