• Peter Zijlstra's avatar
    perf/core: Fix perf_event_open() vs. execve() race · 79c9ce57
    Peter Zijlstra authored
    Jann reported that the ptrace_may_access() check in
    find_lively_task_by_vpid() is racy against exec().
    
    Specifically:
    
      perf_event_open()		execve()
    
      ptrace_may_access()
    				commit_creds()
      ...				if (get_dumpable() != SUID_DUMP_USER)
    				  perf_event_exit_task();
      perf_install_in_context()
    
    would result in installing a counter across the creds boundary.
    
    Fix this by wrapping lots of perf_event_open() in cred_guard_mutex.
    This should be fine as perf_event_exit_task() is already called with
    cred_guard_mutex held, so all perf locks already nest inside it.
    Reported-by: default avatarJann Horn <jannh@google.com>
    Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
    Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Stephane Eranian <eranian@google.com>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Vince Weaver <vincent.weaver@maine.edu>
    Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
    79c9ce57
core.c 225 KB