[PATCH 1/2] perf/core: Avoid NULL dereference in mux interval store

[PATCH 1/2] perf/core: Avoid NULL dereference in mux interval store

[Dapeng Mi]

perf_pmu_register() currently exposes the PMU device and its attributes
before the per-CPU perf_cpu_pmu_context (cpc) has been allocated and
initialized. That allows a race where user space writes
perf_event_mux_interval_ms before cpc is ready, and
perf_event_mux_interval_ms_store() dereferences it unconditionally.

Fix this by allocating and initializing the per-CPU PMU context before
making the PMU attribute visible, and add a NULL check in
perf_event_mux_interval_ms_store() to avoid dereferencing a missing cpc.

Reported-by: Hanxiang Xu <xuhx@hust.edu.cn>
Closes: https://lore.kernel.org/all/de936c3.1476b.1a162c34cec.Coremail.xuhx@hust.edu.cn/
Fixes: 62b856397927 ("perf: Add sysfs entry to adjust multiplexing interval per PMU")
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
---
 kernel/events/core.c | 15 +++++++++------
 1 file changed, 9 insertions(+), 6 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7cdd02dba4f1..e088c31534bc 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -12831,6 +12831,9 @@ perf_event_mux_interval_ms_store(struct device *dev,
 	if (timer == pmu->hrtimer_interval_ms)
 		return count;
 
+	if (!pmu->cpu_pmu_context)
+		return -ENODEV;
+
 	mutex_lock(&mux_interval_mutex);
 	pmu->hrtimer_interval_ms = timer;
 
@@ -13062,12 +13065,6 @@ int perf_pmu_register(struct pmu *_pmu, const char *name, int type)
 	pmu->type = pmu_type.id;
 	atomic_set(&pmu->exclusive_cnt, 0);
 
-	if (pmu_bus_running && !pmu->dev) {
-		int ret = pmu_dev_alloc(pmu);
-		if (ret)
-			return ret;
-	}
-
 	pmu->cpu_pmu_context = alloc_percpu(struct perf_cpu_pmu_context *);
 	if (!pmu->cpu_pmu_context)
 		return -ENOMEM;
@@ -13086,6 +13083,12 @@ int perf_pmu_register(struct pmu *_pmu, const char *name, int type)
 		__perf_mux_hrtimer_init(cpc, cpu);
 	}
 
+	if (pmu_bus_running && !pmu->dev) {
+		int ret = pmu_dev_alloc(pmu);
+		if (ret)
+			return ret;
+	}
+
 	if (!pmu->start_txn) {
 		if (pmu->pmu_enable) {
 			/*
-- 
2.34.1

[PATCH 2/2] perf/core: Cancel PMU mux hrtimer before freeing per-CPU context

[Dapeng Mi]

perf_pmu_free() can free the PMU's per-CPU perf_cpu_pmu_context while
the multiplexing hrtimer is still armed. Once the timer expires, it
dereferences the freed cpc and can crash the kernel.

Cancel the multiplexing hrtimer before freeing the PMU context by adding
a perf_mux_cancel_hrtimer() helper and invoking it from the PMU free
path.

Reported-by: Hanxiang Xu <xuhx@hust.edu.cn>
Closes: https://lore.kernel.org/all/ca4f133.14714.1a162b8654c.Coremail.xuhx@hust.edu.cn/
Fixes: 8f4c4963d283 ("perf/core: Simplify the perf_pmu_register() error path")
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
---
 kernel/events/core.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index e088c31534bc..54eb962ab6ff 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1316,6 +1316,12 @@ static void __perf_mux_hrtimer_init(struct perf_cpu_pmu_context *cpc, int cpu)
 		      HRTIMER_MODE_ABS_PINNED_HARD);
 }
 
+static void perf_mux_cancel_hrtimer(struct perf_cpu_pmu_context *cpc)
+{
+	cpc->hrtimer_active = 0;
+	hrtimer_cancel(&cpc->hrtimer);
+}
+
 static int perf_mux_hrtimer_restart(struct perf_cpu_pmu_context *cpc)
 {
 	struct hrtimer *timer = &cpc->hrtimer;
@@ -13024,6 +13030,7 @@ static void perf_pmu_free(struct pmu *pmu)
 			cpc = *per_cpu_ptr(pmu->cpu_pmu_context, cpu);
 			if (!cpc)
 				continue;
+			perf_mux_cancel_hrtimer(cpc);
 			if (cpc->epc.embedded) {
 				/* refcount managed */
 				put_pmu_ctx(&cpc->epc);
-- 
2.34.1

Re: [PATCH 2/2] perf/core: Cancel PMU mux hrtimer before freeing per-CPU context

[sashiko-bot]

> perf_pmu_free() can free the PMU's per-CPU perf_cpu_pmu_context while
> the multiplexing hrtimer is still armed. Once the timer expires, it
> dereferences the freed cpc and can crash the kernel.
> 
> Cancel the multiplexing hrtimer before freeing the PMU context by adding
> a perf_mux_cancel_hrtimer() helper and invoking it from the PMU free
> path.
> 
> Reported-by: Hanxiang Xu <xuhx@hust.edu.cn>
> Closes: https://lore.kernel.org/all/ca4f133.14714.1a162b8654c.Coremail.xuhx@hust.edu.cn/
> Fixes: 8f4c4963d283 ("perf/core: Simplify the perf_pmu_register() error path")
> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102005905.2017784-1-dapeng1.mi@linux.intel.com?part=2

Re: [PATCH 1/2] perf/core: Avoid NULL dereference in mux interval store

[sashiko-bot]

> perf_pmu_register() currently exposes the PMU device and its attributes
> before the per-CPU perf_cpu_pmu_context (cpc) has been allocated and
> initialized. That allows a race where user space writes
> perf_event_mux_interval_ms before cpc is ready, and
> perf_event_mux_interval_ms_store() dereferences it unconditionally.
> 
> Fix this by allocating and initializing the per-CPU PMU context before
> making the PMU attribute visible, and add a NULL check in
> perf_event_mux_interval_ms_store() to avoid dereferencing a missing cpc.
> 
> Reported-by: Hanxiang Xu <xuhx@hust.edu.cn>
> Closes: https://lore.kernel.org/all/de936c3.1476b.1a162c34cec.Coremail.xuhx@hust.edu.cn/
> Fixes: 62b856397927 ("perf: Add sysfs entry to adjust multiplexing interval per PMU")
> Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261102005905.2017784-1-dapeng1.mi@linux.intel.com?part=1