Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 27c94982 authored by Will McVicker's avatar Will McVicker Committed by Hridaya Prajapati
Browse files

Revert "perf: protect group_leader from races that cause ctx double-free" 

This reverts commit 9e4a31bc. This patch
was re-worked upstream to fix CVE-2016-6787. Refer to the upstream
discussion for details: https://lore.kernel.org/lkml/20170105231429.GA83592@beast/



The official upstream fix in this tree is commit
321027c1.

Signed-off-by: default avatarWill McVicker <willmcvicker@google.com>
Bug: 30955111
Bug: 31095224
Bug: 148872640
Change-Id: Ib990505d0e364398d67b16e3b204b86dfdb8734d
parent cd799ca6

include/linux/perf_event.h

+0 −6
Original line number Diff line number Diff line
@@ -598,12 +598,6 @@ struct perf_event { 
	int				group_caps;



	struct perf_event		*group_leader;



	/*

	 * Protect the pmu, attributes and context of a group leader.

	 * Note: does not protect the pointer to the group_leader.

	 */

	struct mutex			group_leader_mutex;

	struct pmu			*pmu;

	void				*pmu_private;

kernel/events/core.c

+0 −15
Original line number Diff line number Diff line
@@ -10370,7 +10370,6 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu, 
	if (!group_leader)

		group_leader = event;



	mutex_init(&event->group_leader_mutex);

	mutex_init(&event->child_mutex);

	INIT_LIST_HEAD(&event->child_list);
@@ -10946,16 +10945,6 @@ SYSCALL_DEFINE5(perf_event_open, 
			group_leader = NULL;

	}



	/*

	 * Take the group_leader's group_leader_mutex before observing

	 * anything in the group leader that leads to changes in ctx,

	 * many of which may be changing on another thread.

	 * In particular, we want to take this lock before deciding

	 * whether we need to move_group.

	 */

	if (group_leader)

		mutex_lock(&group_leader->group_leader_mutex);



	if (pid != -1 && !(flags & PERF_FLAG_PID_CGROUP)) {

		task = find_lively_task_by_vpid(pid);

		if (IS_ERR(task)) {
@@ -11271,8 +11260,6 @@ SYSCALL_DEFINE5(perf_event_open, 
	if (move_group)

		perf_event_ctx_unlock(group_leader, gctx);

	mutex_unlock(&ctx->mutex);

	if (group_leader)

		mutex_unlock(&group_leader->group_leader_mutex);



	if (task) {

		mutex_unlock(&task->signal->cred_guard_mutex);
@@ -11326,8 +11313,6 @@ SYSCALL_DEFINE5(perf_event_open, 
	if (task)

		put_task_struct(task);

err_group_fd:

	if (group_leader)

		mutex_unlock(&group_leader->group_leader_mutex);

	fdput(group);

err_fd:

	put_unused_fd(event_fd);