If a pmu is unregistered while there's an active event, perf will still
access the pmu via event->pmu, even after the event is destroyed. This
makes it difficult for drivers like i915 that take a reference on the
device when the event is created and put it when it's destroyed.
Currently the following use-after-free happens just after destroying the
event:
BUG: KASAN: use-after-free in exclusive_event_destroy+0xd8/0xf0
Read of size 4 at addr ffff88816e2bb63c by task perf/7748
Whenever and event is created, get a pmu reference to use in event->pmu
and just before calling module_put(), drop the reference..
Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
---
include/linux/perf_event.h | 3 +++
kernel/events/core.c | 32 ++++++++++++++++++++++++++++----
2 files changed, 31 insertions(+), 4 deletions(-)
diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
index a5304ae8c654..7048a505e93c 100644
--- a/include/linux/perf_event.h
+++ b/include/linux/perf_event.h
@@ -540,6 +540,9 @@ struct pmu {
* Check period value for PERF_EVENT_IOC_PERIOD ioctl.
*/
int (*check_period) (struct perf_event *event, u64 value); /* optional */
+
+ struct pmu *(*get) (struct pmu *pmu); /* optional: get a reference */
+ void (*put) (struct pmu *pmu); /* optional: put a reference */
};
enum perf_addr_filter_action_t {
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1b6f5dc7ed32..cc7541b644b0 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -5208,6 +5208,8 @@ static void perf_addr_filters_splice(struct perf_event *event,
static void _free_event(struct perf_event *event)
{
+ struct module *module;
+
irq_work_sync(&event->pending_irq);
unaccount_event(event);
@@ -5259,7 +5261,13 @@ static void _free_event(struct perf_event *event)
put_ctx(event->ctx);
exclusive_event_destroy(event);
- module_put(event->pmu->module);
+
+ module = event->pmu->module;
+ event->pmu->put(event->pmu);
+ /* can't touch pmu anymore */
+ event->pmu = NULL;
+
+ module_put(module);
call_rcu(&event->rcu_head, free_event_rcu);
}
@@ -11331,6 +11339,11 @@ static int perf_pmu_nop_int(struct pmu *pmu)
return 0;
}
+static struct pmu *perf_pmu_nop_pmu(struct pmu *pmu)
+{
+ return pmu;
+}
+
static int perf_event_nop_int(struct perf_event *event, u64 value)
{
return 0;
@@ -11617,6 +11630,12 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type)
if (!pmu->event_idx)
pmu->event_idx = perf_event_idx_default;
+ if (!pmu->get)
+ pmu->get = perf_pmu_nop_pmu;
+
+ if (!pmu->put)
+ pmu->put = perf_pmu_nop_void;
+
list_add_rcu(&pmu->entry, &pmus);
atomic_set(&pmu->exclusive_cnt, 0);
ret = 0;
@@ -11695,7 +11714,8 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
BUG_ON(!ctx);
}
- event->pmu = pmu;
+ event->pmu = pmu->get(pmu);
+
ret = pmu->event_init(event);
if (ctx)
@@ -11714,8 +11734,12 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
event->destroy(event);
}
- if (ret)
- module_put(pmu->module);
+ if (ret) {
+ struct module *module = pmu->module;
+
+ pmu->put(pmu);
+ module_put(module);
+ }
return ret;
}
--
2.43.0On Mon, Jul 22, 2024 at 2:07 PM Lucas De Marchi
<lucas.demarchi@intel.com> wrote:
>
> If a pmu is unregistered while there's an active event, perf will still
> access the pmu via event->pmu, even after the event is destroyed. This
> makes it difficult for drivers like i915 that take a reference on the
> device when the event is created and put it when it's destroyed.
> Currently the following use-after-free happens just after destroying the
> event:
>
> BUG: KASAN: use-after-free in exclusive_event_destroy+0xd8/0xf0
> Read of size 4 at addr ffff88816e2bb63c by task perf/7748
>
> Whenever and event is created, get a pmu reference to use in event->pmu
> and just before calling module_put(), drop the reference..
>
> Signed-off-by: Lucas De Marchi <lucas.demarchi@intel.com>
> ---
> include/linux/perf_event.h | 3 +++
> kernel/events/core.c | 32 ++++++++++++++++++++++++++++----
> 2 files changed, 31 insertions(+), 4 deletions(-)
>
> diff --git a/include/linux/perf_event.h b/include/linux/perf_event.h
> index a5304ae8c654..7048a505e93c 100644
> --- a/include/linux/perf_event.h
> +++ b/include/linux/perf_event.h
> @@ -540,6 +540,9 @@ struct pmu {
> * Check period value for PERF_EVENT_IOC_PERIOD ioctl.
> */
> int (*check_period) (struct perf_event *event, u64 value); /* optional */
> +
> + struct pmu *(*get) (struct pmu *pmu); /* optional: get a reference */
> + void (*put) (struct pmu *pmu); /* optional: put a reference */
> };
>
> enum perf_addr_filter_action_t {
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 1b6f5dc7ed32..cc7541b644b0 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -5208,6 +5208,8 @@ static void perf_addr_filters_splice(struct perf_event *event,
>
> static void _free_event(struct perf_event *event)
> {
> + struct module *module;
> +
> irq_work_sync(&event->pending_irq);
>
> unaccount_event(event);
> @@ -5259,7 +5261,13 @@ static void _free_event(struct perf_event *event)
> put_ctx(event->ctx);
>
> exclusive_event_destroy(event);
> - module_put(event->pmu->module);
> +
> + module = event->pmu->module;
> + event->pmu->put(event->pmu);
> + /* can't touch pmu anymore */
> + event->pmu = NULL;
> +
> + module_put(module);
>
> call_rcu(&event->rcu_head, free_event_rcu);
> }
> @@ -11331,6 +11339,11 @@ static int perf_pmu_nop_int(struct pmu *pmu)
> return 0;
> }
>
> +static struct pmu *perf_pmu_nop_pmu(struct pmu *pmu)
> +{
> + return pmu;
> +}
> +
> static int perf_event_nop_int(struct perf_event *event, u64 value)
> {
> return 0;
> @@ -11617,6 +11630,12 @@ int perf_pmu_register(struct pmu *pmu, const char *name, int type)
> if (!pmu->event_idx)
> pmu->event_idx = perf_event_idx_default;
>
> + if (!pmu->get)
> + pmu->get = perf_pmu_nop_pmu;
> +
> + if (!pmu->put)
> + pmu->put = perf_pmu_nop_void;
> +
> list_add_rcu(&pmu->entry, &pmus);
> atomic_set(&pmu->exclusive_cnt, 0);
> ret = 0;
> @@ -11695,7 +11714,8 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
> BUG_ON(!ctx);
> }
>
> - event->pmu = pmu;
> + event->pmu = pmu->get(pmu);
> +
> ret = pmu->event_init(event);
>
> if (ctx)
> @@ -11714,8 +11734,12 @@ static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)
> event->destroy(event);
> }
>
> - if (ret)
> - module_put(pmu->module);
> + if (ret) {
> + struct module *module = pmu->module;
> +
> + pmu->put(pmu);
I think this is a great fix, a nit here, wouldn't it be good to do:
event->pmu = NULL;
Thanks,
Ian
> + module_put(module);
> + }
>
> return ret;
> }
> --
> 2.43.0
>
>
© 2016 - 2025 Red Hat, Inc.