Messages in this thread Patch in this message |  | | Date | Sat, 13 Apr 2013 21:40:53 +0300 | | Subject | Re: sw_perf_event_destroy() oops while fuzzing | | From | Tommi Rantala <> |
| |
2013/4/12 Tommi Rantala <tt.rantala@gmail.com>: > 2013/4/12 Peter Zijlstra <a.p.zijlstra@chello.nl>: >> perf_swevent_init() only sets event->destroy() (to >> sw_perf_event_destroy) _after_ it increments the static key thing and >> enqueues (and allocates) the hash list stuff. >> >> Obviously something is funny, but I'm not seeing it. > > Might this help... ? (untested)
I can reproduce the bug on my machine with:
#include <unistd.h> #include <sys/syscall.h> #include <linux/perf_event.h>
int main(void) { struct perf_event_attr attr = { .type = PERF_TYPE_SOFTWARE, .size = sizeof(struct perf_event_attr), .config = 0x00000000ffffffff, };
syscall(__NR_perf_event_open, &attr, getpid(), -1, -1, 0); return 0; }
The patch below fixes the oops. I'll send it properly.
> diff --git a/kernel/events/core.c b/kernel/events/core.c > index 59412d0..fff6420 100644 > --- a/kernel/events/core.c > +++ b/kernel/events/core.c > @@ -5330,7 +5330,7 @@ static void sw_perf_event_destroy(struct > perf_event *event) > > static int perf_swevent_init(struct perf_event *event) > { > - int event_id = event->attr.config; > + u64 event_id = event->attr.config; > > if (event->attr.type != PERF_TYPE_SOFTWARE) > return -ENOENT;
|  |