Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a3578000 authored by Lai Jiangshan's avatar Lai Jiangshan Committed by Ingo Molnar
Browse files

tracing/workqueues: Add refcnt to struct cpu_workqueue_stats 



The stat entries can be freed when the stat file is being read.
The worse is, the ptr can be freed immediately after it's returned
from workqueue_stat_start/next().

Add a refcnt to struct cpu_workqueue_stats to avoid use-after-free.

Signed-off-by: default avatarLai Jiangshan <laijs@cn.fujitsu.com>
Signed-off-by: default avatarLi Zefan <lizf@cn.fujitsu.com>
Acked-by: default avatarFrederic Weisbecker <fweisbec@gmail.com>
Cc: Steven Rostedt <rostedt@goodmis.org>
LKML-Reference: <4A51B16F.6010608@cn.fujitsu.com>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
parent d8ea37d5

kernel/trace/trace_workqueue.c

+26 −6
Original line number Diff line number Diff line
@@ -9,6 +9,7 @@ 
#include <trace/events/workqueue.h>

#include <linux/list.h>

#include <linux/percpu.h>

#include <linux/kref.h>

#include "trace_stat.h"

#include "trace.h"
@@ -16,6 +17,7 @@ 
/* A cpu workqueue thread */

struct cpu_workqueue_stats {

	struct list_head            list;

	struct kref                 kref;

	int		            cpu;

	pid_t			    pid;

/* Can be inserted from interrupt or user context, need to be atomic */
@@ -39,6 +41,11 @@ struct workqueue_global_stats { 
static DEFINE_PER_CPU(struct workqueue_global_stats, all_workqueue_stat);

#define workqueue_cpu_stat(cpu) (&per_cpu(all_workqueue_stat, cpu))



static void cpu_workqueue_stat_free(struct kref *kref)

{

	kfree(container_of(kref, struct cpu_workqueue_stats, kref));

}



/* Insertion of a work */

static void

probe_workqueue_insertion(struct task_struct *wq_thread,
@@ -96,8 +103,8 @@ static void probe_workqueue_creation(struct task_struct *wq_thread, int cpu) 
		return;

	}

	INIT_LIST_HEAD(&cws->list);

	kref_init(&cws->kref);

	cws->cpu = cpu;



	cws->pid = wq_thread->pid;



	spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
@@ -118,7 +125,7 @@ static void probe_workqueue_destruction(struct task_struct *wq_thread) 
							list) {

		if (node->pid == wq_thread->pid) {

			list_del(&node->list);

			kfree(node);

			kref_put(&node->kref, cpu_workqueue_stat_free);

			goto found;

		}

	}
@@ -137,9 +144,11 @@ static struct cpu_workqueue_stats *workqueue_stat_start_cpu(int cpu) 


	spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);



	if (!list_empty(&workqueue_cpu_stat(cpu)->list))

	if (!list_empty(&workqueue_cpu_stat(cpu)->list)) {

		ret = list_entry(workqueue_cpu_stat(cpu)->list.next,

				 struct cpu_workqueue_stats, list);

		kref_get(&ret->kref);

	}



	spin_unlock_irqrestore(&workqueue_cpu_stat(cpu)->lock, flags);
@@ -162,9 +171,9 @@ static void *workqueue_stat_start(struct tracer_stat *trace) 
static void *workqueue_stat_next(void *prev, int idx)

{

	struct cpu_workqueue_stats *prev_cws = prev;

	struct cpu_workqueue_stats *ret;

	int cpu = prev_cws->cpu;

	unsigned long flags;

	void *ret = NULL;



	spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);

	if (list_is_last(&prev_cws->list, &workqueue_cpu_stat(cpu)->list)) {
@@ -175,11 +184,14 @@ static void *workqueue_stat_next(void *prev, int idx) 
				return NULL;

		} while (!(ret = workqueue_stat_start_cpu(cpu)));

		return ret;

	} else {

		ret = list_entry(prev_cws->list.next,

				 struct cpu_workqueue_stats, list);

		kref_get(&ret->kref);

	}

	spin_unlock_irqrestore(&workqueue_cpu_stat(cpu)->lock, flags);



	return list_entry(prev_cws->list.next, struct cpu_workqueue_stats,

			  list);

	return ret;

}



static int workqueue_stat_show(struct seq_file *s, void *p)
@@ -203,6 +215,13 @@ static int workqueue_stat_show(struct seq_file *s, void *p) 
	return 0;

}



static void workqueue_stat_release(void *stat)

{

	struct cpu_workqueue_stats *node = stat;



	kref_put(&node->kref, cpu_workqueue_stat_free);

}



static int workqueue_stat_headers(struct seq_file *s)

{

	seq_printf(s, "# CPU  INSERTED  EXECUTED   NAME\n");
@@ -215,6 +234,7 @@ struct tracer_stat workqueue_stats __read_mostly = { 
	.stat_start = workqueue_stat_start,

	.stat_next = workqueue_stat_next,

	.stat_show = workqueue_stat_show,

	.stat_release = workqueue_stat_release,

	.stat_headers = workqueue_stat_headers

};