linux-kernel - [tip:perf/core] perf/ring_buffer: Refuse to begin AUX transaction after rb->aux_mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-dcb10a967ce82d5ad20570693091139ae716ff76@git.kernel.org>
Date:	Thu, 31 Mar 2016 02:23:43 -0700
From:	tip-bot for Alexander Shishkin <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	mingo@...nel.org, linux-kernel@...r.kernel.org,
	peterz@...radead.org, vincent.weaver@...ne.edu, eranian@...gle.com,
	hpa@...or.com, jolsa@...hat.com,
	alexander.shishkin@...ux.intel.com, tglx@...utronix.de,
	acme@...radead.org, acme@...hat.com, torvalds@...ux-foundation.org
Subject: [tip:perf/core] perf/ring_buffer: Refuse to begin AUX transaction
 after rb->aux_mmap_count drops

Commit-ID:  dcb10a967ce82d5ad20570693091139ae716ff76
Gitweb:     http://git.kernel.org/tip/dcb10a967ce82d5ad20570693091139ae716ff76
Author:     Alexander Shishkin <alexander.shishkin@...ux.intel.com>
AuthorDate: Fri, 4 Mar 2016 15:42:45 +0200
Committer:  Ingo Molnar <mingo@...nel.org>
CommitDate: Thu, 31 Mar 2016 10:30:41 +0200

perf/ring_buffer: Refuse to begin AUX transaction after rb->aux_mmap_count drops

When ring buffer's AUX area is unmapped and rb->aux_mmap_count drops to
zero, new AUX transactions into this buffer can still be started,
even though the buffer in en route to deallocation.

This patch adds a check to perf_aux_output_begin() for rb->aux_mmap_count
being zero, in which case there is no point starting new transactions,
in other words, the ring buffers that pass a certain point in
perf_mmap_close will not have their events sending new data, which
clears path for freeing those buffers' pages right there and then,
provided that no active transactions are holding the AUX reference.

Signed-off-by: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@...radead.org>
Cc: Arnaldo Carvalho de Melo <acme@...radead.org>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: Jiri Olsa <jolsa@...hat.com>
Cc: Linus Torvalds <torvalds@...ux-foundation.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Stephane Eranian <eranian@...gle.com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Vince Weaver <vincent.weaver@...ne.edu>
Cc: vince@...ter.net
Link: http://lkml.kernel.org/r/1457098969-21595-2-git-send-email-alexander.shishkin@linux.intel.com
Signed-off-by: Ingo Molnar <mingo@...nel.org>
---
 kernel/events/ring_buffer.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c
index c61f0cb..89abf62 100644
--- a/kernel/events/ring_buffer.c
+++ b/kernel/events/ring_buffer.c
@@ -288,6 +288,13 @@ void *perf_aux_output_begin(struct perf_output_handle *handle,
 		goto err;
 
 	/*
+	 * If rb::aux_mmap_count is zero (and rb_has_aux() above went through),
+	 * the aux buffer is in perf_mmap_close(), about to get freed.
+	 */
+	if (!atomic_read(&rb->aux_mmap_count))
+		goto err;
+
+	/*
 	 * Nesting is not supported for AUX area, make sure nested
 	 * writers are caught early
 	 */