• Marco Elver's avatar
    perf: Ignore sigtrap for tracepoints destined for other tasks · 73743c3b
    Marco Elver authored
    syzbot reported that the warning in perf_sigtrap() fires, saying that
    the event's task does not match current:
    
     | WARNING: CPU: 0 PID: 9090 at kernel/events/core.c:6446 perf_pending_event+0x40d/0x4b0 kernel/events/core.c:6513
     | Modules linked in:
     | CPU: 0 PID: 9090 Comm: syz-executor.1 Not tainted 5.15.0-syzkaller #0
     | Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
     | RIP: 0010:perf_sigtrap kernel/events/core.c:6446 [inline]
     | RIP: 0010:perf_pending_event_disable kernel/events/core.c:6470 [inline]
     | RIP: 0010:perf_pending_event+0x40d/0x4b0 kernel/events/core.c:6513
     | ...
     | Call Trace:
     |  <IRQ>
     |  irq_work_single+0x106/0x220 kernel/irq_work.c:211
     |  irq_work_run_list+0x6a/0x90 kernel/irq_work.c:242
     |  irq_work_run+0x4f/0xd0 kernel/irq_work.c:251
     |  __sysvec_irq_work+0x95/0x3d0 arch/x86/kernel/irq_work.c:22
     |  sysvec_irq_work+0x8e/0xc0 arch/x86/kernel/irq_work.c:17
     |  </IRQ>
     |  <TASK>
     |  asm_sysvec_irq_work+0x12/0x20 arch/x86/include/asm/idtentry.h:664
     | RIP: 0010:__raw_spin_unlock_irqrestore include/linux/spinlock_api_smp.h:152 [inline]
     | RIP: 0010:_raw_spin_unlock_irqrestore+0x38/0x70 kernel/locking/spinlock.c:194
     | ...
     |  coredump_task_exit kernel/exit.c:371 [inline]
     |  do_exit+0x1865/0x25c0 kernel/exit.c:771
     |  do_group_exit+0xe7/0x290 kernel/exit.c:929
     |  get_signal+0x3b0/0x1ce0 kernel/signal.c:2820
     |  arch_do_signal_or_restart+0x2a9/0x1c40 arch/x86/kernel/signal.c:868
     |  handle_signal_work kernel/entry/common.c:148 [inline]
     |  exit_to_user_mode_loop kernel/entry/common.c:172 [inline]
     |  exit_to_user_mode_prepare+0x17d/0x290 kernel/entry/common.c:207
     |  __syscall_exit_to_user_mode_work kernel/entry/common.c:289 [inline]
     |  syscall_exit_to_user_mode+0x19/0x60 kernel/entry/common.c:300
     |  do_syscall_64+0x42/0xb0 arch/x86/entry/common.c:86
     |  entry_SYSCALL_64_after_hwframe+0x44/0xae
    
    On x86 this shouldn't happen, which has arch_irq_work_raise().
    
    The test program sets up a perf event with sigtrap set to fire on the
    'sched_wakeup' tracepoint, which fired in ttwu_do_wakeup().
    
    This happened because the 'sched_wakeup' tracepoint also takes a task
    argument passed on to perf_tp_event(), which is used to deliver the
    event to that other task.
    
    Since we cannot deliver synchronous signals to other tasks, skip an event if
    perf_tp_event() is targeted at another task and perf_event_attr::sigtrap is
    set, which will avoid ever entering perf_sigtrap() for such events.
    
    Fixes: 97ba62b2 ("perf: Add support for SIGTRAP on perf events")
    Reported-by: syzbot+663359e32ce6f1a305ad@syzkaller.appspotmail.com
    Signed-off-by: default avatarMarco Elver <elver@google.com>
    Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
    Link: https://lkml.kernel.org/r/YYpoCOBmC/kJWfmI@elver.google.com
    73743c3b
core.c 321 KB