Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a83fe28e authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Ingo Molnar
Browse files

perf: Fix put_event() ctx lock 



So what I suspect; but I'm in zombie mode today it seems; is that while
I initially thought that it was impossible for ctx to change when
refcount dropped to 0, I now suspect its possible.

Note that until perf_remove_from_context() the event is still active and
visible on the lists. So a concurrent sys_perf_event_open() from another
task into this task can race.

Reported-by: default avatarVince Weaver <vincent.weaver@maine.edu>
Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Cc: Stephane Eranian <eranian@gmail.com>
Cc: mark.rutland@arm.com
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/20150129134434.GB26304@twins.programming.kicks-ass.net


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 8f95b435

kernel/events/core.c

+12 −5
Original line number Diff line number Diff line
@@ -947,7 +947,8 @@ static void put_ctx(struct perf_event_context *ctx) 
 *	    perf_event::mmap_mutex

 *	    mmap_sem

 */

static struct perf_event_context *perf_event_ctx_lock(struct perf_event *event)

static struct perf_event_context *

perf_event_ctx_lock_nested(struct perf_event *event, int nesting)

{

	struct perf_event_context *ctx;
@@ -960,7 +961,7 @@ static struct perf_event_context *perf_event_ctx_lock(struct perf_event *event) 
	}

	rcu_read_unlock();



	mutex_lock(&ctx->mutex);

	mutex_lock_nested(&ctx->mutex, nesting);

	if (event->ctx != ctx) {

		mutex_unlock(&ctx->mutex);

		put_ctx(ctx);
@@ -970,6 +971,12 @@ static struct perf_event_context *perf_event_ctx_lock(struct perf_event *event) 
	return ctx;

}



static inline struct perf_event_context *

perf_event_ctx_lock(struct perf_event *event)

{

	return perf_event_ctx_lock_nested(event, 0);

}



static void perf_event_ctx_unlock(struct perf_event *event,

				  struct perf_event_context *ctx)

{
@@ -3572,7 +3579,7 @@ static void perf_remove_from_owner(struct perf_event *event) 
 */

static void put_event(struct perf_event *event)

{

	struct perf_event_context *ctx = event->ctx;

	struct perf_event_context *ctx;



	if (!atomic_long_dec_and_test(&event->refcount))

		return;
@@ -3580,7 +3587,6 @@ static void put_event(struct perf_event *event) 
	if (!is_kernel_event(event))

		perf_remove_from_owner(event);



	WARN_ON_ONCE(ctx->parent_ctx);

	/*

	 * There are two ways this annotation is useful:

	 *
@@ -3593,7 +3599,8 @@ static void put_event(struct perf_event *event) 
	 *     the last filedesc died, so there is no possibility

	 *     to trigger the AB-BA case.

	 */

	mutex_lock_nested(&ctx->mutex, SINGLE_DEPTH_NESTING);

	ctx = perf_event_ctx_lock_nested(event, SINGLE_DEPTH_NESTING);

	WARN_ON_ONCE(ctx->parent_ctx);

	perf_remove_from_context(event, true);

	mutex_unlock(&ctx->mutex);