diff options
author | Peter Zijlstra <peterz@infradead.org> | 2016-01-25 14:09:54 +0100 |
---|---|---|
committer | Ingo Molnar <mingo@kernel.org> | 2016-01-28 20:06:36 +0100 |
commit | 6a3351b612b72c558910c88a43e2ef6d7d68bc97 (patch) | |
tree | 0429ba6efb8a4c654ac4c267395653430818829f /arch/x86 | |
parent | 78cd2c748f459739ff864dd9308c0f6caf7f6e41 (diff) | |
download | op-kernel-dev-6a3351b612b72c558910c88a43e2ef6d7d68bc97.zip op-kernel-dev-6a3351b612b72c558910c88a43e2ef6d7d68bc97.tar.gz |
perf: Fix race in perf_event_exit_task_context()
There is a race between perf_event_exit_task_context() and
orphans_remove_work() which results in a use-after-free.
We mark ctx->task with TASK_TOMBSTONE to indicate a context is
'dead', under ctx->lock. After which point event_function_call()
on any event of that context will NOP
A concurrent orphans_remove_work() will only hold ctx->mutex for
the list iteration and not serialize against this. Therefore its
possible that orphans_remove_work()'s perf_remove_from_context()
call will fail, but we'll continue to free the event, with the
result of free'd memory still being on lists and everything.
Once perf_event_exit_task_context() gets around to acquiring
ctx->mutex it too will iterate the event list, encounter the
already free'd event and proceed to free it _again_. This fails
with the WARN in free_event().
Plug the race by having perf_event_exit_task_context() hold
ctx::mutex over the whole tear-down, thereby 'naturally'
serializing against all other sites, including the orphan work.
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: Thomas Gleixner <tglx@linutronix.de>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: alexander.shishkin@linux.intel.com
Cc: dsahern@gmail.com
Cc: namhyung@kernel.org
Link: http://lkml.kernel.org/r/20160125130954.GY6357@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
Diffstat (limited to 'arch/x86')
0 files changed, 0 insertions, 0 deletions