Commit b4b4ce07 authored by Breno Leitao's avatar Breno Leitao Committed by Tengda Wu
Browse files

perf/core: Add RCU read lock protection to perf_iterate_ctx() 

stable inclusion
from stable-v6.6.81
commit f390c2eea571945f357a2d3b9fcb1c015767132e
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IBWVT2
CVE: CVE-2025-21889

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=f390c2eea571945f357a2d3b9fcb1c015767132e



--------------------------------

commit 0fe8813baf4b2e865d3b2c735ce1a15b86002c74 upstream.

The perf_iterate_ctx() function performs RCU list traversal but
currently lacks RCU read lock protection. This causes lockdep warnings
when running perf probe with unshare(1) under CONFIG_PROVE_RCU_LIST=y:

	WARNING: suspicious RCU usage
	kernel/events/core.c:8168 RCU-list traversed in non-reader section!!

	 Call Trace:
	  lockdep_rcu_suspicious
	  ? perf_event_addr_filters_apply
	  perf_iterate_ctx
	  perf_event_exec
	  begin_new_exec
	  ? load_elf_phdrs
	  load_elf_binary
	  ? lock_acquire
	  ? find_held_lock
	  ? bprm_execve
	  bprm_execve
	  do_execveat_common.isra.0
	  __x64_sys_execve
	  do_syscall_64
	  entry_SYSCALL_64_after_hwframe

This protection was previously present but was removed in commit
bd275681 ("perf: Rewrite core context handling"). Add back the
necessary rcu_read_lock()/rcu_read_unlock() pair around
perf_iterate_ctx() call in perf_event_exec().

[ mingo: Use scoped_guard() as suggested by Peter ]

Fixes: bd275681 ("perf: Rewrite core context handling")
Signed-off-by: default avatarBreno Leitao <leitao@debian.org>
Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/r/20250117-fix_perf_rcu-v1-1-13cb9210fc6a@debian.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarTengda Wu <wutengda2@huawei.com>
parent f030d539

kernel/events/core.c

+2 −1
Original line number Diff line number Diff line
@@ -8124,6 +8124,7 @@ void perf_event_exec(void) 


	perf_event_enable_on_exec(ctx);

	perf_event_remove_on_exec(ctx);

	scoped_guard(rcu)

		perf_iterate_ctx(ctx, perf_event_addr_filters_exec, NULL, true);



	perf_unpin_context(ctx);