Messages in this thread | | | From | Dmitry Vyukov <> | Date | Tue, 24 Jan 2017 14:29:19 +0100 | Subject | Re: perf: use-after-free in perf_event_for_each |
| |
On Tue, Jan 24, 2017 at 2:17 PM, Peter Zijlstra <peterz@infradead.org> wrote: > On Mon, Jan 23, 2017 at 06:04:42PM +0100, Peter Zijlstra wrote: >> On Mon, Jan 23, 2017 at 02:30:12PM +0100, Dmitry Vyukov wrote: >> > Hello, >> > >> > The following program triggers use-after-free in perf_event_for_each: >> > https://gist.githubusercontent.com/dvyukov/f1c354a8356e42f4d0b3d912e1bec956/raw/31d7ecdf6dc2c7327b80ef8581a39c823bbe405d/gistfile1.txt > > I've been running 60 concurrent instances of that thing for hours now, > and have not been able to reproduce :-/ > > I did enable CONFIG_KASAN but otherwise booted as normal, and the thing > says: > > [ 0.000000] kasan: KernelAddressSanitizer initialized > > Is there anything else I should do?
Should be enough.
> I've ran out of ideas and it would be very helpful if I could prod at > something that fails...
Try to run more parallel processes at the same time. This program will run 32 processes in a tight loop: https://gist.githubusercontent.com/dvyukov/b36aa4398bb016923278fccdd1cc5b45/raw/9607078fd5ac2daf769c13d82561a83e17b06032/gistfile1.txt It triggered the UAF in several minutes for me. I have 4 CPUs in the VM. If you have more, set number of processes to 8*CPU.
Just in case this is my config: $ grep "PERF" .config # CONFIG_CGROUP_PERF is not set CONFIG_CC_OPTIMIZE_FOR_PERFORMANCE=y CONFIG_HAVE_PERF_EVENTS=y CONFIG_PERF_EVENTS=y # CONFIG_DEBUG_PERF_USE_VMALLOC is not set CONFIG_HAVE_PERF_EVENTS_NMI=y CONFIG_HAVE_PERF_REGS=y CONFIG_HAVE_PERF_USER_STACK_DUMP=y CONFIG_PERF_EVENTS_INTEL_UNCORE=y CONFIG_PERF_EVENTS_INTEL_RAPL=y CONFIG_PERF_EVENTS_INTEL_CSTATE=y # CONFIG_PERF_EVENTS_AMD_POWER is not set # CONFIG_CPU_FREQ_DEFAULT_GOV_PERFORMANCE is not set CONFIG_CPU_FREQ_GOV_PERFORMANCE=y # CONFIG_PCIEASPM_PERFORMANCE is not set # CONFIG_RCU_PERF_TEST is not set
And here is how I start qemu:
qemu-system-x86_64 -hda wheezy.img -net user,host=10.0.2.10,hostfwd=tcp::10022-:22 -net nic -nographic -kernel arch/x86/boot/bzImage -append "kvm-intel.nested=1 kvm-intel.enable_unrestricted_guest=1 kvm-intel.ept=1 kvm-intel.flexpriority=1 kvm-intel.vpid=1 kvm-intel.emulate_invalid_guest_state=1 kvm-intel.eptad=1 kvm-intel.enable_shadow_vmcs=1 kvm-intel.pml=1 kvm-intel.enable_apicv=1 console=ttyS0 root=/dev/sda earlyprintk=serial slub_debug=UZ vsyscall=native rodata=n oops=panic panic_on_warn=1 panic=86400" -enable-kvm -pidfile vm_pid -m 2G -smp 4 -cpu host -usb -usbdevice mouse -usbdevice tablet -soundhw all
| |