Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ccd41c86 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Ingo Molnar
Browse files

perf: Fix racy group access 



While looking at some fuzzer output I noticed that we do not hold any
locks on leader->ctx and therefore the sibling_list iteration is
unsafe.

Acquire the relevant ctx->mutex before calling into the pmu specific
code.

Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Cc: Vince Weaver <vincent.weaver@maine.edu>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Sasha Levin <sasha.levin@oracle.com>
Link: http://lkml.kernel.org/r/20150225151639.GL5029@twins.programming.kicks-ass.net


Signed-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 9332d250

kernel/events/core.c

+11 −0
Original line number Original line Diff line number Diff line
@@ -7036,12 +7036,23 @@ EXPORT_SYMBOL_GPL(perf_pmu_unregister); 




static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)

static int perf_try_init_event(struct pmu *pmu, struct perf_event *event)

{

{

	struct perf_event_context *ctx = NULL;

	int ret;

	int ret;





	if (!try_module_get(pmu->module))

	if (!try_module_get(pmu->module))

		return -ENODEV;

		return -ENODEV;



	if (event->group_leader != event) {

		ctx = perf_event_ctx_lock(event->group_leader);

		BUG_ON(!ctx);

	}



	event->pmu = pmu;

	event->pmu = pmu;

	ret = pmu->event_init(event);

	ret = pmu->event_init(event);



	if (ctx)

		perf_event_ctx_unlock(event->group_leader, ctx);



	if (ret)

	if (ret)

		module_put(pmu->module);

		module_put(pmu->module);