Merge "perf: protect group_leader from races that cause ctx double-free" (ac235f82) · Commits · e / devices / android_kernel_oneplus_sm8150

include/linux/perf_event.h

+6 −0

Original line number	Diff line number	Diff line
		@@ -579,6 +579,12 @@ struct perf_event {
		int group_caps;

		struct perf_event *group_leader;

		/*
		* Protect the pmu, attributes and context of a group leader.
		* Note: does not protect the pointer to the group_leader.
		*/
		struct mutex group_leader_mutex;
		struct pmu *pmu;
		void *pmu_private;

+15 −0

Original line number	Diff line number	Diff line
		@@ -9833,6 +9833,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
		if (!group_leader)
		group_leader = event;

		mutex_init(&event->group_leader_mutex);
		mutex_init(&event->child_mutex);
		INIT_LIST_HEAD(&event->child_list);

		@@ -10389,6 +10390,16 @@ SYSCALL_DEFINE5(perf_event_open,
		group_leader = NULL;
		}

		/*
		* Take the group_leader's group_leader_mutex before observing
		* anything in the group leader that leads to changes in ctx,
		* many of which may be changing on another thread.
		* In particular, we want to take this lock before deciding
		* whether we need to move_group.
		*/
		if (group_leader)
		mutex_lock(&group_leader->group_leader_mutex);

		if (pid != -1 && !(flags & PERF_FLAG_PID_CGROUP)) {
		task = find_lively_task_by_vpid(pid);
		if (IS_ERR(task)) {
		@@ -10687,6 +10698,8 @@ SYSCALL_DEFINE5(perf_event_open,
		if (move_group)
		perf_event_ctx_unlock(group_leader, gctx);
		mutex_unlock(&ctx->mutex);
		if (group_leader)
		mutex_unlock(&group_leader->group_leader_mutex);

		if (task) {
		mutex_unlock(&task->signal->cred_guard_mutex);
		@@ -10740,6 +10753,8 @@ SYSCALL_DEFINE5(perf_event_open,
		if (task)
		put_task_struct(task);
		err_group_fd:
		if (group_leader)
		mutex_unlock(&group_leader->group_leader_mutex);
		fdput(group);
		err_fd:
		put_unused_fd(event_fd);