Revision 6a3351b612b72c558910c88a43e2ef6d7d68bc97 authored by Peter Zijlstra on 25 January 2016, 13:09:54 UTC, committed by Ingo Molnar on 28 January 2016, 19:06:36 UTC
There is a race between perf_event_exit_task_context() and orphans_remove_work() which results in a use-after-free. We mark ctx->task with TASK_TOMBSTONE to indicate a context is 'dead', under ctx->lock. After which point event_function_call() on any event of that context will NOP A concurrent orphans_remove_work() will only hold ctx->mutex for the list iteration and not serialize against this. Therefore its possible that orphans_remove_work()'s perf_remove_from_context() call will fail, but we'll continue to free the event, with the result of free'd memory still being on lists and everything. Once perf_event_exit_task_context() gets around to acquiring ctx->mutex it too will iterate the event list, encounter the already free'd event and proceed to free it _again_. This fails with the WARN in free_event(). Plug the race by having perf_event_exit_task_context() hold ctx::mutex over the whole tear-down, thereby 'naturally' serializing against all other sites, including the orphan work. Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Cc: alexander.shishkin@linux.intel.com Cc: dsahern@gmail.com Cc: namhyung@kernel.org Link: http://lkml.kernel.org/r/20160125130954.GY6357@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org>
1 parent 78cd2c7
File | Mode | Size |
---|---|---|
partitions | ||
Kconfig | -rw-r--r-- | 3.7 KB |
Kconfig.iosched | -rw-r--r-- | 1.6 KB |
Makefile | -rw-r--r-- | 935 bytes |
badblocks.c | -rw-r--r-- | 14.1 KB |
bio-integrity.c | -rw-r--r-- | 14.2 KB |
bio.c | -rw-r--r-- | 48.5 KB |
blk-cgroup.c | -rw-r--r-- | 35.6 KB |
blk-core.c | -rw-r--r-- | 93.6 KB |
blk-exec.c | -rw-r--r-- | 3.2 KB |
blk-flush.c | -rw-r--r-- | 15.2 KB |
blk-integrity.c | -rw-r--r-- | 12.3 KB |
blk-ioc.c | -rw-r--r-- | 10.2 KB |
blk-iopoll.c | -rw-r--r-- | 5.8 KB |
blk-lib.c | -rw-r--r-- | 7.5 KB |
blk-map.c | -rw-r--r-- | 5.8 KB |
blk-merge.c | -rw-r--r-- | 17.9 KB |
blk-mq-cpu.c | -rw-r--r-- | 1.6 KB |
blk-mq-cpumap.c | -rw-r--r-- | 2.5 KB |
blk-mq-sysfs.c | -rw-r--r-- | 11.2 KB |
blk-mq-tag.c | -rw-r--r-- | 16.7 KB |
blk-mq-tag.h | -rw-r--r-- | 2.6 KB |
blk-mq.c | -rw-r--r-- | 55.5 KB |
blk-mq.h | -rw-r--r-- | 3.2 KB |
blk-settings.c | -rw-r--r-- | 26.9 KB |
blk-softirq.c | -rw-r--r-- | 4.4 KB |
blk-sysfs.c | -rw-r--r-- | 17.4 KB |
blk-tag.c | -rw-r--r-- | 10.0 KB |
blk-throttle.c | -rw-r--r-- | 42.6 KB |
blk-timeout.c | -rw-r--r-- | 5.7 KB |
blk.h | -rw-r--r-- | 9.1 KB |
bounce.c | -rw-r--r-- | 5.8 KB |
bsg-lib.c | -rw-r--r-- | 6.0 KB |
bsg.c | -rw-r--r-- | 22.9 KB |
cfq-iosched.c | -rw-r--r-- | 123.2 KB |
cmdline-parser.c | -rw-r--r-- | 4.9 KB |
compat_ioctl.c | -rw-r--r-- | 20.8 KB |
deadline-iosched.c | -rw-r--r-- | 11.3 KB |
elevator.c | -rw-r--r-- | 23.8 KB |
genhd.c | -rw-r--r-- | 45.0 KB |
ioctl.c | -rw-r--r-- | 16.0 KB |
ioprio.c | -rw-r--r-- | 5.1 KB |
noop-iosched.c | -rw-r--r-- | 2.6 KB |
partition-generic.c | -rw-r--r-- | 14.1 KB |
scsi_ioctl.c | -rw-r--r-- | 19.4 KB |
t10-pi.c | -rw-r--r-- | 4.8 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...