[PATCH v2] perf/core: Close owner-list publication race with remove-on-exec

[Daehyeon Ko]

perf_event_open() makes a user event visible in the target context before
adding owner_entry to the opener's perf_event_list. For a remote task, it
also releases exec_update_lock before adding the list node.

A concurrent target exec can therefore process a remove_on_exec event in
this interval. perf_remove_from_owner() sees the published non-NULL owner
and calls list_del_init() on the zero-allocated owner_entry, triggering a
list corruption diagnostic. With BUG_ON_DATA_CORRUPTION, this panics the
kernel.

If the diagnostic is non-fatal, the open path subsequently links the
ownerless event. Closing its file descriptor then frees an event that
remains on the owner list, leading to a use-after-free on the next list
insertion.

Keep the target exec_update_lock held until owner_entry is linked. The
documented lock order permits exec_update_lock to nest outside
perf_event_mutex, and target exec can no longer observe the partially
published event.

An unprivileged remote-task reproducer triggered the NULL-link panic on an
unmodified hardened kernel. With corruption reporting made non-fatal, it
reached a KASAN use-after-free in the next owner-list insertion. With this
change, the patched hardened kernel completed 1,229,779 remote opens during
60 seconds of concurrent exec without a list diagnostic, oops, or panic.

Fixes: 2e498d0a74e5 ("perf: Add support for event removal on exec")
Suggested-by: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Daehyeon Ko <4ncienth@xxxxxxxxx>
---
Changes in v2:
- Keep exec_update_lock held through the existing owner-list insertion
  instead of repairing the race after partial publication, as suggested by
  Peter Zijlstra.
- Rebase onto current mainline commit 58161ead29e5.

 kernel/events/core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 7846d70be57f6..2fdd8d71dcd55 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -14246,15 +14246,15 @@ SYSCALL_DEFINE5(perf_event_open,
 
 	mutex_unlock(&ctx->mutex);
 
+	mutex_lock(&current->perf_event_mutex);
+	list_add_tail(&event->owner_entry, &current->perf_event_list);
+	mutex_unlock(&current->perf_event_mutex);
+
 	if (task) {
 		up_read(&task->signal->exec_update_lock);
 		put_task_struct(task);
 	}
 
-	mutex_lock(&current->perf_event_mutex);
-	list_add_tail(&event->owner_entry, &current->perf_event_list);
-	mutex_unlock(&current->perf_event_mutex);
-
 	/*
 	 * File reference in group guarantees that group_leader has been
 	 * kept alive until we place the new event on the sibling_list.

base-commit: 58161ead29e50d70a317ea26b472e0c7508e69da
-- 
2.55.0