From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753513AbcAVMhT (ORCPT ); Fri, 22 Jan 2016 07:37:19 -0500 Received: from aserp1040.oracle.com ([141.146.126.69]:49480 "EHLO aserp1040.oracle.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753169AbcAVMhP (ORCPT ); Fri, 22 Jan 2016 07:37:15 -0500 Subject: Re: Warnings/memory corruption in perf intel events To: Peter Zijlstra References: <55C7AE28.30706@oracle.com> <20150810112507.GW16853@twins.programming.kicks-ass.net> Cc: Ingo Molnar , Arnaldo Carvalho de Melo , Thomas Gleixner , "H. Peter Anvin" , LKML , "x86@kernel.org" , Stephane Eranian From: Sasha Levin Message-ID: <56A2224C.9000208@oracle.com> Date: Fri, 22 Jan 2016 07:36:28 -0500 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.4.0 MIME-Version: 1.0 In-Reply-To: <20150810112507.GW16853@twins.programming.kicks-ass.net> Content-Type: text/plain; charset=windows-1252 Content-Transfer-Encoding: 7bit X-Source-IP: userv0022.oracle.com [156.151.31.74] Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 08/10/2015 07:25 AM, Peter Zijlstra wrote: > On Sun, Aug 09, 2015 at 03:46:48PM -0400, Sasha Levin wrote: >> > Hi all, >> > >> > While fuzzing with trinity inside a KVM tools guest running -next I've stumbled on the following: > >> > [424256.911563] ================================================================== >> > [424256.913989] BUG: KASan: use after free in intel_get_event_constraints+0xdb0/0xf90 at addr ffff8801741a70e9 >> > [424256.917044] Read of size 1 by task trinity-c162/20397 >> > [424256.918696] ============================================================================= >> > [424256.921309] BUG kmalloc-2048 (Tainted: G W ): kasan: bad access detected > > Quite the puzzle that, and I'm not entirely sure I see how. The WARNs > preceding this aren't giving me much confidence either, I've yet to find > a way for them to happen. > > That said, the only dynamically allocated memory here is managed on CPU > hotplug. And we appear to consistently return NOTIFY_BAD if an > allocation there fails, which should preclude the CPU hotplug from > completing and therefore preclude events from forming on that CPU. > > We do however appear to fail to NULL all our pointers, and even miss one > kfree() in the error paths there (the constraint_list allocation fail, > fails to free the shared_regs one). > > Rework that code such that we kfree() all and always NULL our pointers > after free. I suspect that that patch didn't help, I'm seeing traces like this: [ 1362.573349] WARNING: CPU: 3 PID: 13908 at arch/x86/kernel/cpu/perf_event.c:1345 x86_pmu_del+0x3e1/0x7f0() [ 1362.574566] Modules linked in: [ 1362.575017] CPU: 3 PID: 13908 Comm: syz-executor Not tainted 4.4.0-next-20160121-sasha-00020-g5e5e971-dirty #2811 [ 1362.576318] 1ffff10038db1e65 00000000a4877b67 ffff8801c6d8f3a8 ffffffff8344c8c1 [ 1362.577342] 0000000041b58ab3 ffffffff8f9763f5 ffffffff8344c7f6 ffff8800c33e0bc8 [ 1362.578371] ffff8800c33e0bd0 00000000a4877b67 00000000a4877b67 0000000000000003 [ 1362.579217] Call Trace: [ 1362.579536] [] dump_stack+0xcb/0x14a [ 1362.580093] [] ? _atomic_dec_and_lock+0x106/0x106 [ 1362.580769] [] warn_slowpath_common+0xe1/0x160 [ 1362.581410] [] ? x86_pmu_del+0x3e1/0x7f0 [ 1362.599438] [] warn_slowpath_null+0x29/0x30 [ 1362.600063] [] x86_pmu_del+0x3e1/0x7f0 [ 1362.600657] [] event_sched_out+0x5ab/0x1480 [ 1362.601275] [] ? perf_pmu_enable+0x1c0/0x1c0 [ 1362.602016] [] ? __perf_remove_from_context+0x137/0x380 [ 1362.602854] [] __perf_remove_from_context+0x145/0x380 [ 1362.603675] [] ? __perf_event_disable+0x8a0/0x8a0 [ 1362.604463] [] ? free_ctx+0x70/0x70 [ 1362.605104] [] remote_function+0x14b/0x200 [ 1362.605848] [] generic_exec_single+0x308/0x5d0 [ 1362.606632] [] ? cpumask_next+0xd0/0xd0 [ 1362.607359] [] ? check_preemption_disabled+0x39/0x270 [ 1362.608147] [] ? __perf_event_disable+0x8a0/0x8a0 [ 1362.608816] [] smp_call_function_single+0x122/0x4c0 [ 1362.624201] [] task_function_call+0x156/0x1a0 [ 1362.627453] [] event_function_call+0x1a7/0x310 [ 1362.630435] [] perf_remove_from_context+0x10c/0x1b0 [ 1362.633337] [] put_event+0x318/0x510 [ 1362.637005] [] perf_release+0x3c/0x60 [ 1362.649756] [] __fput+0x255/0x870 [ 1362.650347] [] ____fput+0x15/0x20 [ 1362.651060] [] task_work_run+0x136/0x240 [ 1362.651716] [] do_exit+0x86b/0x1850 [ 1362.652369] [] ? mm_update_next_owner+0x6f0/0x6f0 [ 1362.653167] [] ? __dequeue_signal+0x32f/0x730 [ 1362.653924] [] do_group_exit+0xec/0x390 [ 1362.654609] [] get_signal+0x5aa/0x1cb0 [ 1362.655276] [] do_signal+0x8d/0x20d0 [ 1362.660705] [] exit_to_usermode_loop+0x1bb/0x270 [ 1362.661510] [] syscall_return_slowpath+0x3fd/0x590 [ 1362.662358] [] int_ret_from_sys_call+0x25/0x9f Thanks, Sasha