lkml.org 
[lkml]   [2022]   [Nov]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: [syzbot] KASAN: use-after-free Read in task_work_run (2)
    On Wed, Nov 23, 2022 at 10:49AM +0100, Dmitry Vyukov wrote:
    > On Wed, 26 Oct 2022 at 20:29, syzbot
    > <syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com> wrote:
    > >
    > > syzbot has found a reproducer for the following issue on:
    > >
    > > HEAD commit: 88619e77b33d net: stmmac: rk3588: Allow multiple gmac cont..
    > > git tree: bpf
    > > console output: https://syzkaller.appspot.com/x/log.txt?x=1646d6f2880000
    > > kernel config: https://syzkaller.appspot.com/x/.config?x=a66c6c673fb555e8
    > > dashboard link: https://syzkaller.appspot.com/bug?extid=9228d6098455bb209ec8
    > > compiler: gcc (Debian 10.2.1-6) 10.2.1 20210110, GNU ld (GNU Binutils for Debian) 2.35.2
    > > syz repro: https://syzkaller.appspot.com/x/repro.syz?x=12bc425e880000
    > > C reproducer: https://syzkaller.appspot.com/x/repro.c?x=1126516e880000
    > >
    > > Downloadable assets:
    > > disk image: https://storage.googleapis.com/syzbot-assets/f8435d5c2c21/disk-88619e77.raw.xz
    > > vmlinux: https://storage.googleapis.com/syzbot-assets/551d8a013e81/vmlinux-88619e77.xz
    > > kernel image: https://storage.googleapis.com/syzbot-assets/7d3f5c29064d/bzImage-88619e77.xz
    > >
    > > IMPORTANT: if you fix the issue, please add the following tag to the commit:
    > > Reported-by: syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com
    >
    > Should perf task work hold a reference to the event to prevent this?

    Probably should cancel the task work?

    #syz test https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git 88619e77b33d


    diff --git a/kernel/events/core.c b/kernel/events/core.c
    index 5ddc88592ff8..1457725fa8a9 100644
    --- a/kernel/events/core.c
    +++ b/kernel/events/core.c
    @@ -4970,10 +4970,12 @@ static bool exclusive_event_installable(struct perf_event *event,

    static void perf_addr_filters_splice(struct perf_event *event,
    struct list_head *head);
    +static void perf_pending_task(struct callback_head *head);

    static void _free_event(struct perf_event *event)
    {
    irq_work_sync(&event->pending_irq);
    + task_work_cancel(current, perf_pending_task);

    unaccount_event(event);

    \
     
     \ /
      Last update: 2022-11-23 12:04    [W:2.591 / U:0.092 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site