[PATCH] perf/core: Protect put_ctx() wakeup with RCU

[PATCH] perf/core: Protect put_ctx() wakeup with RCU

[Weiming Shi]

put_ctx() drops a context reference before checking ctx->task in its
non-final branch. perf_event_open() can break an inherited context
relationship in find_get_context() while a concurrent close() drops the
context's final reference, allowing free_ctx() to run before the
post-decrement read. A reproducer triggers this on an unmodified KASAN
kernel:

  BUG: KASAN: slab-use-after-free in put_ctx+0x213/0x220
  Read of size 8 at addr ffff88801ef4b480 by task poc/5714
  CPU: 2 UID: 65534 PID: 5714 Comm: poc
  Call Trace:
   ...
   put_ctx (kernel/events/core.c:1394)
   find_get_context (kernel/events/core.c:5135)
   __do_sys_perf_event_open (kernel/events/core.c:14083)
   do_syscall_64 (arch/x86/entry/syscall_64.c:84)
   ...
   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)

Hold an RCU read-side lock across the decrement and wakeup decision so
free_ctx() cannot reclaim the context until the access completes.

Fixes: 59f3aa4a3ee2 ("perf: Simplify perf_event_free_task() wait")
Reported-by: <co+8a0b9fcf1e087762@bugs.sh>
Assisted-by: LLM
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
 kernel/events/core.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index fe33fe1..2fec17a 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -1383,6 +1383,7 @@ static void free_ctx(struct rcu_head *head)
 
 static void put_ctx(struct perf_event_context *ctx)
 {
+	rcu_read_lock();
 	if (refcount_dec_and_test(&ctx->refcount)) {
 		if (ctx->parent_ctx)
 			put_ctx(ctx->parent_ctx);
@@ -1394,6 +1395,7 @@ static void put_ctx(struct perf_event_context *ctx)
 		if (ctx->task == TASK_TOMBSTONE)
 			wake_up_var(&ctx->refcount);
 	}
+	rcu_read_unlock();
 }
 
 /*