[ Sasha's backport helper bot ]
Hi,
Summary of potential issues: ❌ Build failures detected ⚠️ Found follow-up fixes in mainline
The upstream commit SHA1 provided is correct: 517e6a301f34613bff24a8e35b5455884f2d83d8
WARNING: Author mismatch between patch and upstream commit: Backport author: Xiangyu Chenxiangyu.chen@eng.windriver.com Commit author: Peter Zijlstrapeterz@infradead.org
Status in newer kernel trees: 6.14.y | Present (exact SHA1) 6.13.y | Present (exact SHA1) 6.12.y | Present (exact SHA1) 6.6.y | Present (exact SHA1) 6.1.y | Present (exact SHA1) 5.15.y | Present (different SHA1: 8bffa95ac19f)
Found fixes commits: 3a5465418f5f perf: Fix event leak upon exec and file release 2fd5ad3f310d perf: Fix event leak upon exit
Note: The patch differs from the upstream commit: --- 1: 517e6a301f346 ! 1: b2173ec15f3b2 perf: Fix perf_pending_task() UaF @@ Metadata ## Commit message ## perf: Fix perf_pending_task() UaF
+ [ Upstream commit 517e6a301f34613bff24a8e35b5455884f2d83d8 ] + Per syzbot it is possible for perf_pending_task() to run after the event is free()'d. There are two related but distinct cases:
@@ Commit message Reported-by: syzbot+9228d6098455bb209ec8@syzkaller.appspotmail.com Signed-off-by: Peter Zijlstra (Intel) peterz@infradead.org Tested-by: Marco Elver elver@google.com + [ Discard the changes in event_sched_out() due to 5.10 don't have the + commit: 97ba62b27867 ("perf: Add support for SIGTRAP on perf events") + and commit: ca6c21327c6a ("perf: Fix missing SIGTRAPs") ] + Signed-off-by: Xiangyu Chen xiangyu.chen@windriver.com + Signed-off-by: He Zhe zhe.he@windriver.com
## kernel/events/core.c ## -@@ kernel/events/core.c: event_sched_out(struct perf_event *event, - !event->pending_work) { - event->pending_work = 1; - dec = false; -+ WARN_ON_ONCE(!atomic_long_inc_not_zero(&event->refcount)); - task_work_add(current, &event->pending_task, TWA_RESUME); - } - if (dec) @@ kernel/events/core.c: group_sched_out(struct perf_event *group_event, + }
#define DETACH_GROUP 0x01UL - #define DETACH_CHILD 0x02UL +#define DETACH_DEAD 0x04UL
/* @@ kernel/events/core.c: __perf_remove_from_context(struct perf_event *event, event_sched_out(event, cpuctx, ctx); if (flags & DETACH_GROUP) perf_group_detach(event); - if (flags & DETACH_CHILD) - perf_child_detach(event); list_del_event(event, ctx); + if (flags & DETACH_DEAD) + event->state = PERF_EVENT_STATE_DEAD; @@ kernel/events/core.c: int perf_event_release_kernel(struct perf_event *event)
perf_event_ctx_unlock(event, ctx);
-@@ kernel/events/core.c: static void perf_pending_task(struct callback_head *head) +@@ kernel/events/core.c: static void perf_pending_event(struct irq_work *entry) + if (rctx >= 0) perf_swevent_put_recursion_context(rctx); - preempt_enable_notrace(); + + put_event(event); }
- #ifdef CONFIG_GUEST_PERF_EVENTS + /* ---
Results of testing on various branches:
| Branch | Patch Apply | Build Test | |---------------------------|-------------|------------| | stable/linux-5.10.y | Success | Failed |
Build Errors: Build error for stable/linux-5.10.y: kernel/trace/trace_events_synth.c: In function 'synth_event_reg': kernel/trace/trace_events_synth.c:769:9: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement] 769 | int ret = trace_event_reg(call, type, data); | ^~~ In file included from ./include/linux/kernel.h:15, from ./include/linux/list.h:9, from ./include/linux/kobject.h:19, from ./include/linux/of.h:17, from ./include/linux/clk-provider.h:9, from drivers/clk/qcom/clk-rpmh.c:6: drivers/clk/qcom/clk-rpmh.c: In function 'clk_rpmh_bcm_send_cmd': ./include/linux/minmax.h:20:35: warning: comparison of distinct pointer types lacks a cast [-Wcompare-distinct-pointer-types] 20 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ^~ ./include/linux/minmax.h:26:18: note: in expansion of macro '__typecheck' 26 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~ ./include/linux/minmax.h:36:31: note: in expansion of macro '__safe_cmp' 36 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~ ./include/linux/minmax.h:45:25: note: in expansion of macro '__careful_cmp' 45 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~ drivers/clk/qcom/clk-rpmh.c:273:21: note: in expansion of macro 'min' 273 | cmd_state = min(cmd_state, BCM_TCS_CMD_VOTE_MASK); | ^~~ drivers/firmware/efi/mokvar-table.c: In function 'efi_mokvar_table_init': drivers/firmware/efi/mokvar-table.c:107:23: warning: unused variable 'size' [-Wunused-variable] 107 | unsigned long size; | ^~~~ .tmp_vmlinux.kallsyms2.S:196892:57: internal compiler error: Segmentation fault 196892 | .byte 0x0b, 0x74, 0x77, 0x77, 0x5f, 0xb6, 0x73, 0xfc, 0x6e, 0xbd, 0x6d, 0xed | ^~~~ 0x7f74e8f6cd1f ??? ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 0x7f74e8f56d67 __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 0x7f74e8f56e24 __libc_start_main_impl ../csu/libc-start.c:360 Please submit a full bug report, with preprocessed source (by using -freport-bug). Please include the complete backtrace with any bug report. See https://gcc.gnu.org/bugs/ for instructions. make: *** [Makefile:1212: vmlinux] Error 1 make: Target '__all' not remade because of errors.