[PATCH] perf: Hold exec lock until owner-list publication

[Felix Hoffmann <f3lix.dev@gmx.de>]

perf_event_open() installs a remove-on-exec event in the target context
while holding the target task's exec_update_lock. It then drops that lock
before linking the event into the opener's perf_event_list.

A concurrent target exec can therefore find the installed event and call
perf_remove_from_owner() before owner_entry has been initialized as a list
node. The resulting list_del() on the zeroed node triggers list corruption
and can panic the kernel.

Keep exec_update_lock held until the event has been published in its
owner's list. This closes the visibility gap while retaining the existing
lock ordering.

Fixes: 2e498d0a74e5 ("perf: Add support for event removal on exec")
Cc: stable@vger.kernel.org
Signed-off-by: Felix Hoffmann <f3lix.dev@gmx.de>
---
Tested on x86-64 with KASAN enabled:

  - on the unmodified current kernel, the unprivileged reproducer triggered
    list_del() corruption in perf_remove_from_owner() and panicked at round
    4,400 as UID 1000
  - with this change, the identical reproducer completed 10,000 rounds and
    8,395,975 successful perf_event_open() calls without a BUG, warning,
    KASAN report or panic
  - kernel/events/core.o builds with W=1 and the KASAN-enabled x86-64 kernel
    builds successfully

The reproducer and complete console logs are available privately on request.
 kernel/events/core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index f5f2261f1fe6f..f4f292f7b47e2 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -14414,15 +14414,15 @@ SYSCALL_DEFINE5(perf_event_open,
 
 	mutex_unlock(&ctx->mutex);
 
+	mutex_lock(&current->perf_event_mutex);
+	list_add_tail(&event->owner_entry, &current->perf_event_list);
+	mutex_unlock(&current->perf_event_mutex);
+
 	if (task) {
 		up_read(&task->signal->exec_update_lock);
 		put_task_struct(task);
 	}
 
-	mutex_lock(&current->perf_event_mutex);
-	list_add_tail(&event->owner_entry, &current->perf_event_list);
-	mutex_unlock(&current->perf_event_mutex);
-
 	/*
 	 * File reference in group guarantees that group_leader has been
 	 * kept alive until we place the new event on the sibling_list.
-- 
2.43.0