perf_pin_task_context() can return NULL but perf_event_init_context() assumes it won't

Found by

perf_fuzzer

Severity

Crash

First Seen

3.15-rc4

Most recently Seen

3.15-rc4

Reproducible

Yes

Found On

core2

Linux-kernel

Re: [perf] more perf_fuzzer memory corruption -- 5 May 2014

Fixed in

Linux 3.15-rc7 ffb4ef21ac4308c2e738e6f83b6741bbc9b4fa3b perf: Fix perf_event_init_context()

Kernel Splat

  1. *** perf_fuzzer 0.28 *** by Vince Weaver
    
            Linux version 3.15.0-rc4+ x86_64
            Processor: Intel 6/23/10
    
            Seeding random number generator with 1399309111
            /proc/sys/kernel/perf_event_max_sample_rate currently: 3250/s
            /proc/sys/kernel/perf_event_paranoid currently: 1
            Logging perf_event_open() failures: no
            Running fsync after every syscall: no
            To reproduce, try: ./perf_fuzzer -t OCIRMQWPFpAi -s 50000 -r 1399309111
    
    Pid=9777, sleeping 1s
    ==================================================
    Fuzzing the following syscalls:
            mmap perf_event_open close read write ioctl fork prctl poll 
    *NOT* Fuzzing the following syscalls:
            
    Also attempting the following:
            busy-instruction-loop accessing-perf-proc-and-sys-files trashing-the-mmap-page 
    *NOT* attempting the following:
            signal-handler-on-overflow 
    ==================================================
    [ 4918.921921] BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
    [ 4918.925692] IP: [] mutex_lock+0x19/0x37
    [ 4918.925692] PGD c5e62067 PUD cae00067 PMD 0 
    [ 4918.925692] Oops: 0002 [#1] SMP 
    [ 4918.925692] Modules linked in: cpufreq_userspace cpufreq_stats cpufreq_powersave cpufreq_conservative f71882fg mcs7830 usbnet ohci_pci evdev ohci_hcd acpi_cpufreq coretemp psmouse serio_raw pcspkr video wmi i2c_nforce2 button processor thermal_sys sg ehci_pci ehci_hcd sd_mod usbcore usb_common
    [ 4918.925692] CPU: 0 PID: 9777 Comm: perf_fuzzer Not tainted 3.15.0-rc4+ #42
    [ 4918.925692] Hardware name: AOpen   DE7000/nMCP7ALPx-DE R1.06 Oct.19.2012, BIOS 080015  10/19/2012
    [ 4918.925692] task: ffff8800c628e800 ti: ffff8800c6610000 task.ti: ffff8800c6610000
    [ 4918.925692] RIP: 0010:[]  [] mutex_lock+0x19/0x37
    [ 4918.925692] RSP: 0018:ffff8800c6611d30  EFLAGS: 00010286
    [ 4918.925692] RAX: 0000000000000000 RBX: 0000000000000010 RCX: ffff8800c9b89080
    [ 4918.925692] RDX: 0000000080000000 RSI: 0000000000000286 RDI: 0000000000000010
    [ 4918.925692] RBP: ffff8800c6611d50 R08: 0000000000000001 R09: ffff8800c5b41f00
    [ 4918.925692] R10: ffff8800cb217400 R11: ffff8800caf03400 R12: ffff8800c628e800
    [ 4918.925692] R13: ffff8800c628e800 R14: 0000000000000001 R15: 0000000000000038
    [ 4918.925692] FS:  00007f8700f46700(0000) GS:ffff88011fc00000(0000) knlGS:0000000000000000
    [ 4918.925692] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
    [ 4918.925692] CR2: 0000000000000010 CR3: 00000000c974d000 CR4: 00000000000407f0
    [ 4918.925692] DR0: 0000000000a80000 DR1: 0000000000000000 DR2: 0000000000000000
    [ 4918.925692] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
    [ 4918.925692] Stack:
    [ 4918.925692]  ffff880119c62010 ffff8800c628e800 ffff8800c628e800 0000000000000000
    [ 4918.925692]  ffff8800c6611dc0 ffffffff810d10b7 ffff8800c5b41f48 0000000000000010
    [ 4918.925692]  ffff880119c62010 0000000000000286 0000000000000286 0000000119c62010
    [ 4918.925692] Call Trace:
    [ 4918.925692]  [] perf_event_init_context+0x7c/0x1c8
    [ 4918.925692]  [] perf_event_init_task+0x69/0x6d
    [ 4918.925692]  [] copy_process+0x5cc/0x163b
    [ 4918.925692]  [] ? __d_free+0x53/0x58
    [ 4918.925692]  [] ? dentry_kill+0x1b8/0x1d5
    [ 4918.925692]  [] ? mntput+0x2a/0x2c
    [ 4918.925692]  [] ? __fput+0x17e/0x18d
    [ 4918.925692]  [] do_fork+0x74/0x1dc
    [ 4918.925692]  [] ? ____fput+0xe/0x10
    [ 4918.925692]  [] ? task_work_run+0x8d/0xa0
    [ 4918.925692]  [] SyS_clone+0x16/0x18
    [ 4918.925692]  [] stub_clone+0x69/0x90
    [ 4918.925692]  [] ? system_call_fastpath+0x1a/0x1f
    [ 4918.925692] Code: 48 8b 04 25 00 b9 00 00 b2 01 48 89 47 18 89 d0 c9 c3 55 48 89 e5 53 48 83 ec 18 66 66 66 66 90 48 89 fb e8 d7 f6 ff ff 48 89 df  ff 0f 79 05 e8 7a 05 00 00 65 48 8b 04 25 00 b9 00 00 48 89 
    [ 4918.925692] RIP  [] mutex_lock+0x19/0x37
    [ 4918.925692]  RSP 
    [ 4918.925692] CR2: 0000000000000010
    [ 4919.771050] ---[ end trace 9a98d4ca40642975 ]---
    Killed
    
    

Back to perf_fuzzer bugs found