Revision 2aeb1883547626d82c597cce2c99f0b9c62e2425 authored by Jiri Olsa on 20 July 2017, 14:14:55 UTC, committed by Ingo Molnar on 21 July 2017, 07:54:23 UTC
We're missing ctx lock when iterating children siblings within the perf_read path for group reading. Following race and crash can happen: User space doing read syscall on event group leader: T1: perf_read lock event->ctx->mutex perf_read_group lock leader->child_mutex __perf_read_group_add(child) list_for_each_entry(sub, &leader->sibling_list, group_entry) ----> sub might be invalid at this point, because it could get removed via perf_event_exit_task_context in T2 Child exiting and cleaning up its events: T2: perf_event_exit_task_context lock ctx->mutex list_for_each_entry_safe(child_event, next, &child_ctx->event_list,... perf_event_exit_event(child) lock ctx->lock perf_group_detach(child) unlock ctx->lock ----> child is removed from sibling_list without any sync with T1 path above ... free_event(child) Before the child is removed from the leader's child_list, (and thus is omitted from perf_read_group processing), we need to ensure that perf_read_group touches child's siblings under its ctx->lock. Peter further notes: | One additional note; this bug got exposed by commit: | | ba5213ae6b88 ("perf/core: Correct event creation with PERF_FORMAT_GROUP") | | which made it possible to actually trigger this code-path. Tested-by: Andi Kleen <ak@linux.intel.com> Signed-off-by: Jiri Olsa <jolsa@kernel.org> Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <a.p.zijlstra@chello.nl> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Thomas Gleixner <tglx@linutronix.de> Fixes: ba5213ae6b88 ("perf/core: Correct event creation with PERF_FORMAT_GROUP") Link: http://lkml.kernel.org/r/20170720141455.2106-1-jolsa@kernel.org Signed-off-by: Ingo Molnar <mingo@kernel.org>
1 parent 3bda69c
File | Mode | Size |
---|---|---|
ext | ||
Kconfig | -rw-r--r-- | 697 bytes |
Makefile | -rw-r--r-- | 385 bytes |
array.c | -rw-r--r-- | 1.2 KB |
hda_bus_type.c | -rw-r--r-- | 2.1 KB |
hdac_bus.c | -rw-r--r-- | 5.4 KB |
hdac_controller.c | -rw-r--r-- | 15.3 KB |
hdac_device.c | -rw-r--r-- | 26.9 KB |
hdac_i915.c | -rw-r--r-- | 11.8 KB |
hdac_regmap.c | -rw-r--r-- | 13.1 KB |
hdac_stream.c | -rw-r--r-- | 19.3 KB |
hdac_sysfs.c | -rw-r--r-- | 9.9 KB |
hdmi_chmap.c | -rw-r--r-- | 24.2 KB |
local.h | -rw-r--r-- | 791 bytes |
trace.c | -rw-r--r-- | 107 bytes |
trace.h | -rw-r--r-- | 2.1 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...