Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 0939c17c authored by Chris Wright's avatar Chris Wright Committed by Linus Torvalds
Browse files

x86: fix oprofile double free 



Chuck reports that the recent fix from Andi to oprofile
6c977aad introduces a double free.  Each
cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free
cpu 0's pointers for_each_possible_cpu.  Rather than copy the pointers, do
a deep copy instead.

[acme@redhat.com: allocate_msrs() was using for_each_online_cpu()]
Signed-off-by: default avatarChris Wright <chrisw@sous-sol.org>
Cc: Andi Kleen <ak@suse.de>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Dave Jones <davej@redhat.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: default avatarAndrew Morton <akpm@linux-foundation.org>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent 24faa9ee

arch/i386/oprofile/nmi_int.c

+9 −3
Original line number Diff line number Diff line
@@ -154,7 +154,7 @@ static int allocate_msrs(void) 
	size_t counters_size = sizeof(struct op_msr) * model->num_counters;



	int i;

	for_each_online_cpu(i) {

	for_each_possible_cpu(i) {

		cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL);

		if (!cpu_msrs[i].counters) {

			success = 0;
@@ -211,8 +211,14 @@ static int nmi_setup(void) 
	/* Assume saved/restored counters are the same on all CPUs */

	model->fill_in_addresses(&cpu_msrs[0]);

	for_each_possible_cpu (cpu) {

		if (cpu != 0)

			cpu_msrs[cpu] = cpu_msrs[0];

		if (cpu != 0) {

			memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters,

				sizeof(struct op_msr) * model->num_counters);



			memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls,

				sizeof(struct op_msr) * model->num_controls);

		}



	}

	on_each_cpu(nmi_save_registers, NULL, 0, 1);

	on_each_cpu(nmi_cpu_setup, NULL, 0, 1);