Re: [PATCH] perf/core: Protect put_ctx() wakeup with RCU

[sashiko-bot@kernel.org]

> put_ctx() drops a context reference before checking ctx->task in its
> non-final branch. perf_event_open() can break an inherited context
> relationship in find_get_context() while a concurrent close() drops the
> context's final reference, allowing free_ctx() to run before the
> post-decrement read. A reproducer triggers this on an unmodified KASAN
> kernel:
> 
>   BUG: KASAN: slab-use-after-free in put_ctx+0x213/0x220
>   Read of size 8 at addr ffff88801ef4b480 by task poc/5714
>   CPU: 2 UID: 65534 PID: 5714 Comm: poc
>   Call Trace:
>    ...
>    put_ctx (kernel/events/core.c:1394)
>    find_get_context (kernel/events/core.c:5135)
>    __do_sys_perf_event_open (kernel/events/core.c:14083)
>    do_syscall_64 (arch/x86/entry/syscall_64.c:84)
>    ...
>    entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
> 
> Hold an RCU read-side lock across the decrement and wakeup decision so
> free_ctx() cannot reclaim the context until the access completes.
> 
> Fixes: 59f3aa4a3ee2 ("perf: Simplify perf_event_free_task() wait")
> Reported-by: <co+8a0b9fcf1e087762@bugs.sh>
> Assisted-by: LLM
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261006034224.3014697-1-bestswngs@gmail.com?part=1