Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3ae46829 authored by qctecmdr Service's avatar qctecmdr Service Committed by Gerrit - the friendly Code Review server
Browse files

Merge "perf: don't leave group_entry on sibling list (use-after-free)"

parents 86c65513 90f23506

kernel/events/core.c

+7 −0
Original line number Original line Diff line number Diff line
@@ -1807,10 +1807,17 @@ static void perf_group_detach(struct perf_event *event) 
	 * If this was a group event with sibling events then

	 * If this was a group event with sibling events then

	 * upgrade the siblings to singleton events by adding them

	 * upgrade the siblings to singleton events by adding them

	 * to whatever list we are on.

	 * to whatever list we are on.

	 * If this isn't on a list, make sure we still remove the sibling's

	 * group_entry from this sibling_list; otherwise, when that sibling

	 * is later deallocated, it will try to remove itself from this

	 * sibling_list, which may well have been deallocated already,

	 * resulting in a use-after-free.

	 */

	 */

	list_for_each_entry_safe(sibling, tmp, &event->sibling_list, group_entry) {

	list_for_each_entry_safe(sibling, tmp, &event->sibling_list, group_entry) {

		if (list)

		if (list)

			list_move_tail(&sibling->group_entry, list);

			list_move_tail(&sibling->group_entry, list);

		else

			list_del_init(&sibling->group_entry);

		sibling->group_leader = sibling;

		sibling->group_leader = sibling;





		/* Inherit group flags from the previous leader */

		/* Inherit group flags from the previous leader */