mirror_ubuntu-kernels/kernel
Krister Johansen c45e13621f tracing/perf: Fix double put of trace event when init fails
BugLink: https://bugs.launchpad.net/bugs/1987232

commit 7249921d94 upstream.

If in perf_trace_event_init(), the perf_trace_event_open() fails, then it
will call perf_trace_event_unreg() which will not only unregister the perf
trace event, but will also call the put() function of the tp_event.

The problem here is that the trace_event_try_get_ref() is called by the
caller of perf_trace_event_init() and if perf_trace_event_init() returns a
failure, it will then call trace_event_put(). But since the
perf_trace_event_unreg() already called the trace_event_put() function, it
triggers a WARN_ON().

 WARNING: CPU: 1 PID: 30309 at kernel/trace/trace_dynevent.c:46 trace_event_dyn_put_ref+0x15/0x20

If perf_trace_event_reg() does not call the trace_event_try_get_ref() then
the perf_trace_event_unreg() should not be calling trace_event_put(). This
breaks symmetry and causes bugs like these.

Pull out the trace_event_put() from perf_trace_event_unreg() and call it
in the locations that perf_trace_event_unreg() is called. This not only
fixes this bug, but also brings back the proper symmetry of the reg/unreg
vs get/put logic.

Link: https://lore.kernel.org/all/cover.1660347763.git.kjlx@templeofstupid.com/
Link: https://lkml.kernel.org/r/20220816192817.43d5e17f@gandalf.local.home

Cc: stable@vger.kernel.org
Fixes: 1d18538e6a ("tracing: Have dynamic events have a ref counter")
Reported-by: Krister Johansen <kjlx@templeofstupid.com>
Reviewed-by: Krister Johansen <kjlx@templeofstupid.com>
Tested-by: Krister Johansen <kjlx@templeofstupid.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Signed-off-by: Steven Rostedt (Google) <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

(cherry picked from commit 0d7970e8702b7d15293a844cb59ddd352c298f26 linux-5.15.y)
Signed-off-by: Krister Johansen <kjlx@templeofstupid.com>
Acked-by: Stefan Bader <stefan.bader@canonical.com>
Acked-by: Tim Gardner <tim.gardner@canonical.com>
Signed-off-by: Stefan Bader <stefan.bader@canonical.com>
2022-09-16 10:53:55 +02:00
..
bpf bpf: Make sure mac_header was set before using it 2022-09-16 10:53:27 +02:00
cgroup cgroup: Use separate src/dst nodes when preloading css_sets for migration 2022-09-16 10:52:35 +02:00
configs
debug UBUNTU: SAUCE: debug: Lock down kgdb 2022-05-20 21:23:12 -03:00
dma dma-direct: use the correct size for dma_set_encrypted() 2022-08-26 10:54:03 +02:00
entry signal: Replace force_fatal_sig with force_exit_sig when in doubt 2022-01-04 09:48:55 +01:00
events perf/core: Fix data race between perf_event_set_output() and perf_mmap_close() 2022-09-16 10:53:09 +02:00
gcov
irq random: remove unused irq_flags argument from add_interrupt_randomness() 2022-08-10 09:22:49 +02:00
kcsan LKMM updates: 2021-09-02 13:00:15 -07:00
livepatch livepatch: Fix build failure on 32 bits processors 2022-05-20 14:38:48 +02:00
locking locking/rwsem: Allow slowpath writer to ignore handoff bit if not set by first waiter 2022-09-16 10:53:48 +02:00
power PM: suspend: fix return value of __setup handler 2022-05-20 14:37:59 +02:00
printk printk: wake waiters for safe and NMI contexts 2022-08-10 09:24:11 +02:00
rcu rcu: Make TASKS_RUDE_RCU select IRQ_WORK 2022-08-10 09:23:39 +02:00
sched sched/deadline: Fix BUG_ON condition for deboosted tasks 2022-09-16 10:53:27 +02:00
time fix race between exit_itimers() and /proc/pid/timers 2022-09-16 10:52:33 +02:00
trace tracing/perf: Fix double put of trace event when init fails 2022-09-16 10:53:55 +02:00
.gitignore
acct.c kernel/acct.c: use dedicated helper to access rlimit values 2021-09-08 11:50:26 -07:00
async.c Revert "module, async: async_synchronize_full() on module init iff async is used" 2022-03-07 11:44:05 +01:00
audit_fsnotify.c
audit_tree.c audit: move put_tree() to avoid trim_trees refcount underflow and UAF 2021-08-24 18:52:36 -04:00
audit_watch.c
audit.c audit: improve audit queue handling when "audit=1" on cmdline 2022-02-10 15:31:28 +01:00
audit.h audit: log AUDIT_TIME_* records only from rules 2022-05-20 14:37:57 +02:00
auditfilter.c UBUNTU: SAUCE: Audit: Add new record for multiple process LSM attributes 2021-11-02 08:24:52 +01:00
auditsc.c audit: log AUDIT_TIME_* records only from rules 2022-05-20 14:37:57 +02:00
backtracetest.c
bounds.c
capability.c
cfi.c cfi: Fix __cfi_slowpath_diag RCU usage with cpuidle 2022-08-26 10:53:34 +02:00
compat.c arch: remove compat_alloc_user_space 2021-09-08 15:32:35 -07:00
configs.c
context_tracking.c
cpu_pm.c PM: cpu: Make notifier chain use a raw_spinlock_t 2021-08-16 18:55:32 +02:00
cpu.c random: clear fast pool, crng, and batches in cpuhp bring up 2022-08-10 09:23:03 +02:00
crash_core.c kernel/crash_core: suppress unknown crashkernel parameter warning 2022-01-04 09:49:43 +01:00
crash_dump.c
cred.c ucounts: Base set_cred_ucounts changes on the real user 2022-03-07 11:44:17 +01:00
delayacct.c
dma.c
exec_domain.c
exit.c fix race between exit_itimers() and /proc/pid/timers 2022-09-16 10:52:33 +02:00
extable.c
fail_function.c
fork.c sched: Fix yet more sched_fork() races 2022-03-09 15:17:55 +01:00
freezer.c
futex.c futex: Remove unused variable 'vpid' in futex_proxy_trylock_atomic() 2021-09-03 23:00:22 +02:00
gen_kheaders.sh
groups.c
hung_task.c
iomem.c
irq_work.c
jump_label.c
kallsyms.c
kcmp.c
Kconfig.freezer
Kconfig.hz
Kconfig.locks locking/rwlock: Provide RT variant 2021-08-17 17:50:51 +02:00
Kconfig.preempt
kcov.c
kexec_core.c Merge branch 'rework/printk_safe-removal' into for-linus 2021-08-30 16:36:10 +02:00
kexec_elf.c
kexec_file.c ima: force signature verification when CONFIG_KEXEC_SIG is configured 2022-09-16 10:52:52 +02:00
kexec_internal.h
kexec.c kexec: avoid compat_alloc_user_space 2021-09-08 15:32:34 -07:00
kheaders.c
kmod.c
kprobes.c kprobes: Limit max data_size of the kretprobe instances 2022-01-04 09:49:06 +01:00
ksysfs.c
kthread.c UBUNTU: SAUCE: kthread: Do not leave kthread_create() immediately upon SIGKILL. 2021-11-02 08:24:39 +01:00
latencytop.c
Makefile static_call: Don't make __static_call_return0 static 2022-05-20 14:41:28 +02:00
module_signature.c
module_signing.c UBUNTU: SAUCE: (lockdown) KEYS: Make use of platform keyring for module signature verify 2021-11-02 08:24:55 +01:00
module-internal.h
module.c module: fix [e_shstrndx].sh_size=0 OOB access 2022-09-16 10:52:20 +02:00
notifier.c notifier: Remove atomic_notifier_call_chain_robust() 2021-08-16 18:55:32 +02:00
nsproxy.c memcg: enable accounting for new namesapces and struct nsproxy 2021-09-03 09:58:12 -07:00
padata.c padata: Remove repeated verbose license text 2021-08-27 16:30:18 +08:00
panic.c Merge branch 'rework/printk_safe-removal' into for-linus 2021-08-30 16:36:10 +02:00
params.c params: lift param_set_uint_minmax to common code 2021-08-16 14:42:22 +02:00
pid_namespace.c memcg: enable accounting for new namesapces and struct nsproxy 2021-09-03 09:58:12 -07:00
pid.c
profile.c profiling: fix shift-out-of-bounds bugs 2021-09-08 11:50:26 -07:00
ptrace.c ptrace: Reimplement PTRACE_KILL by always sending SIGKILL 2022-08-10 09:23:35 +02:00
range.c
reboot.c
regset.c
relay.c
resource_kunit.c
resource.c kernel/resource: fix kfree() of bootmem memory again 2022-05-20 14:39:18 +02:00
rseq.c rseq: Remove broken uapi field layout on 32-bit little endian 2022-05-20 14:38:05 +02:00
scftorture.c scftorture: Fix distribution of short handler delays 2022-08-10 09:24:06 +02:00
scs.c scs: Release kasan vmalloc poison in scs_free process 2022-01-04 09:48:21 +01:00
seccomp.c seccomp: Invalidate seccomp mode to catch death failures 2022-03-07 11:42:06 +01:00
signal.c signal handling: don't use BUG_ON() for debugging 2022-09-16 10:53:01 +02:00
smp.c smp: Fix offline cpu check in flush_smp_call_function_queue() 2022-05-20 14:42:38 +02:00
smpboot.c
smpboot.h
softirq.c
stackleak.c gcc-plugins/stackleak: Use noinstr in favor of notrace 2022-03-07 11:44:05 +01:00
stacktrace.c stacktrace: move filter_irq_stacks() to kernel/stacktrace.c 2022-05-20 14:41:29 +02:00
static_call_inline.c static_call: Don't make __static_call_return0 static 2022-05-20 14:41:28 +02:00
static_call.c static_call: Don't make __static_call_return0 static 2022-05-20 14:41:28 +02:00
stop_machine.c
sys_ni.c compat: remove some compat entry points 2021-09-08 15:32:35 -07:00
sys.c ucounts: Move RLIMIT_NPROC handling after set_user 2022-03-07 11:44:17 +01:00
sysctl-test.c
sysctl.c sysctl: move some boundary constants from sysctl.c to sysctl_vals 2022-09-16 10:53:10 +02:00
task_work.c UBUNTU: SAUCE: AUFS 2022-02-22 19:10:39 +01:00
taskstats.c
test_kprobes.c
torture.c
tracepoint.c tracepoint: Fix kerneldoc comments 2021-08-16 11:39:51 -04:00
tsacct.c taskstats: Cleanup the use of task->exit_code 2022-01-28 11:03:31 +01:00
ucount.c ucounts: Handle wrapping in is_ucounts_overlimit 2022-03-07 11:44:16 +01:00
uid16.c
uid16.h
umh.c
up.c
user_namespace.c ucounts: Fix systemd LimitNPROC with private users regression 2022-03-09 15:17:51 +01:00
user-return-notifier.c
user.c fs/epoll: use a per-cpu counter for user's watches count 2021-09-08 11:50:27 -07:00
usermode_driver.c
utsname_sysctl.c
utsname.c
watch_queue.c watch_queue: Fix missing locking in add_watch_to_object() 2022-09-16 10:53:39 +02:00
watchdog_hld.c
watchdog.c
workqueue_internal.h workqueue: Assign a color to barrier work items 2021-08-17 07:49:10 -10:00
workqueue.c workqueue: Fix unbind_workers() VS wq_worker_running() race 2022-01-21 15:49:34 +01:00