]> git.baikalelectronics.ru Git - kernel.git/commit
perf/core: Fix perf_event_open() vs. execve() race
authorPeter Zijlstra <peterz@infradead.org>
Tue, 26 Apr 2016 09:36:53 +0000 (11:36 +0200)
committerIngo Molnar <mingo@kernel.org>
Thu, 28 Apr 2016 08:32:41 +0000 (10:32 +0200)
commit23d1ee129f6ce771cbd628b0a35280c939762753
treecdbdbbf5fb4887df3623feeb1b7d4f29e4b49d31
parent061f22642c4a75dd78c4c95a3a718cd478ddbeec
perf/core: Fix perf_event_open() vs. execve() race

Jann reported that the ptrace_may_access() check in
find_lively_task_by_vpid() is racy against exec().

Specifically:

  perf_event_open() execve()

  ptrace_may_access()
commit_creds()
  ... if (get_dumpable() != SUID_DUMP_USER)
  perf_event_exit_task();
  perf_install_in_context()

would result in installing a counter across the creds boundary.

Fix this by wrapping lots of perf_event_open() in cred_guard_mutex.
This should be fine as perf_event_exit_task() is already called with
cred_guard_mutex held, so all perf locks already nest inside it.

Reported-by: Jann Horn <jannh@google.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Ingo Molnar <mingo@kernel.org>
kernel/events/core.c