linux-kernel - Re: [PATCH 1/7] perf: Ensure we do not free event->parent before event

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20130320133531.GA1036@krava.brq.redhat.com>
Date:	Wed, 20 Mar 2013 14:35:31 +0100
From:	Jiri Olsa <jolsa@...hat.com>
To:	Peter Zijlstra <a.p.zijlstra@...llo.nl>
Cc:	Arnaldo Carvalho de Melo <acme@...stprotocols.net>,
	Oleg Nesterov <oleg@...hat.com>, Ingo Molnar <mingo@...e.hu>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Srikar Dronamraju <srikar@...ux.vnet.ibm.com>,
	Steven Rostedt <rostedt@...dmis.org>,
	Anton Arapov <anton@...hat.com>,
	Frank Eigler <fche@...hat.com>,
	Josh Stone <jistone@...hat.com>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	"Suzuki K. Poulose" <suzuki@...ibm.com>,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH 1/7] perf: Ensure we do not free event->parent before
 event

On Mon, Feb 04, 2013 at 08:02:43PM +0100, Oleg Nesterov wrote:
> __perf_event_exit_task() does:
> 
> 	sync_child_event(event)
> 	free_event(event)
> 
> sync_child_event() does put_event(event->parent) which can actually
> free ->parent. This means that event->destroy(event) is called with
> ->parent pointing to nowhere.
> 
> perf_free_event() does put_parent(parent) before free_event(child)
> too.
> 
> Afaics, currently this is fine. But the tracing "subclasses" (like
> trace_uprobe) may want to track the events and their parents, and even
> the fact that parent->destroy() is called before child->destroy() can
> complicate this.
> 
> Move this put_event() from sync_child_event() to its single caller,
> __perf_event_exit_task(). Change perf_free_event() the same way.

looks ok to me, could prevent future headaches ;-)

jirka



> 
> Signed-off-by: Oleg Nesterov <oleg@...hat.com>
> ---
>  kernel/events/core.c |   24 ++++++++++++------------
>  1 files changed, 12 insertions(+), 12 deletions(-)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 301079d..1b2e516 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -6787,12 +6787,6 @@ static void sync_child_event(struct perf_event *child_event,
>  	mutex_lock(&parent_event->child_mutex);
>  	list_del_init(&child_event->child_list);
>  	mutex_unlock(&parent_event->child_mutex);
> -
> -	/*
> -	 * Release the parent event, if this was the last
> -	 * reference to it.
> -	 */
> -	put_event(parent_event);
>  }
>  
>  static void
> @@ -6800,7 +6794,9 @@ __perf_event_exit_task(struct perf_event *child_event,
>  			 struct perf_event_context *child_ctx,
>  			 struct task_struct *child)
>  {
> -	if (child_event->parent) {
> +	struct perf_event *parent_event = child_event->parent;
> +
> +	if (parent_event) {
>  		raw_spin_lock_irq(&child_ctx->lock);
>  		perf_group_detach(child_event);
>  		raw_spin_unlock_irq(&child_ctx->lock);
> @@ -6813,9 +6809,14 @@ __perf_event_exit_task(struct perf_event *child_event,
>  	 * that are still around due to the child reference. These
>  	 * events need to be zapped.
>  	 */
> -	if (child_event->parent) {
> +	if (parent_event) {
>  		sync_child_event(child_event, child);
>  		free_event(child_event);
> +		/*
> +		 * Release the parent event, if this was the last
> +		 * reference to it.
> +		 */
> +		put_event(parent_event);
>  	}
>  }
>  
> @@ -6867,8 +6868,7 @@ static void perf_event_exit_task_context(struct task_struct *child, int ctxn)
>  	 * We can recurse on the same lock type through:
>  	 *
>  	 *   __perf_event_exit_task()
> -	 *     sync_child_event()
> -	 *       put_event()
> +	 *       put_event(parent_event)
>  	 *         mutex_lock(&ctx->mutex)
>  	 *
>  	 * But since its the parent context it won't be the same instance.
> @@ -6937,11 +6937,11 @@ static void perf_free_event(struct perf_event *event,
>  	list_del_init(&event->child_list);
>  	mutex_unlock(&parent->child_mutex);
>  
> -	put_event(parent);
> -
>  	perf_group_detach(event);
>  	list_del_event(event, ctx);
>  	free_event(event);
> +
> +	put_event(parent);
>  }
>  
>  /*
> -- 
> 1.5.5.1
> 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/