mirrors/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2025-11-04 02:30:34 +02:00
Code Issues Projects Releases Packages Wiki Activity Actions

perf: Fix put_event() ctx lock

Browse source 
So what I suspect; but I'm in zombie mode today it seems; is that while
I initially thought that it was impossible for ctx to change when
refcount dropped to 0, I now suspect its possible.

Note that until perf_remove_from_context() the event is still active and
visible on the lists. So a concurrent sys_perf_event_open() from another
task into this task can race.

Reported-by: Vince Weaver <vincent.weaver@maine.edu>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Stephane Eranian <eranian@gmail.com>
Cc: mark.rutland@arm.com
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/20150129134434.GB26304@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
This commit is contained in:
Peter Zijlstra 2015-01-29 14:44:34 +01:00 committed by Ingo Molnar
parent 8f95b435b6
commit a83fe28e2e
1 changed files with 12 additions and 5 deletions
repo.diff.show_diff_stats Download patch file Download diff file Expand all files Collapse all files

17
kernel/events/core.c
View file

@ -947,7 +947,8 @@ static void put_ctx(struct perf_event_context *ctx)
* perf_event::mmap_mutex * perf_event::mmap_mutex
* mmap_sem * mmap_sem
*/ */
static struct perf_event_context *perf_event_ctx_lock(struct perf_event *event) static struct perf_event_context *
perf_event_ctx_lock_nested(struct perf_event *event, int nesting)
{ {
struct perf_event_context *ctx; struct perf_event_context *ctx;
@ -960,7 +961,7 @@ static struct perf_event_context *perf_event_ctx_lock(struct perf_event *event)
} }
rcu_read_unlock(); rcu_read_unlock();
mutex_lock(&ctx->mutex); mutex_lock_nested(&ctx->mutex, nesting);
if (event->ctx != ctx) { if (event->ctx != ctx) {
mutex_unlock(&ctx->mutex); mutex_unlock(&ctx->mutex);
put_ctx(ctx); put_ctx(ctx);
@ -970,6 +971,12 @@ static struct perf_event_context *perf_event_ctx_lock(struct perf_event *event)
return ctx; return ctx;
} }
static inline struct perf_event_context *
perf_event_ctx_lock(struct perf_event *event)
{
return perf_event_ctx_lock_nested(event, 0);
}
static void perf_event_ctx_unlock(struct perf_event *event, static void perf_event_ctx_unlock(struct perf_event *event,
struct perf_event_context *ctx) struct perf_event_context *ctx)
{ {
@ -3572,7 +3579,7 @@ static void perf_remove_from_owner(struct perf_event *event)
*/ */
static void put_event(struct perf_event *event) static void put_event(struct perf_event *event)
{ {
struct perf_event_context *ctx = event->ctx; struct perf_event_context *ctx;
if (!atomic_long_dec_and_test(&event->refcount)) if (!atomic_long_dec_and_test(&event->refcount))
return; return;
@ -3580,7 +3587,6 @@ static void put_event(struct perf_event *event)
if (!is_kernel_event(event)) if (!is_kernel_event(event))
perf_remove_from_owner(event); perf_remove_from_owner(event);
WARN_ON_ONCE(ctx->parent_ctx);
/* /*
* There are two ways this annotation is useful: * There are two ways this annotation is useful:
* *
@ -3593,7 +3599,8 @@ static void put_event(struct perf_event *event)
* the last filedesc died, so there is no possibility * the last filedesc died, so there is no possibility
* to trigger the AB-BA case. * to trigger the AB-BA case.
*/ */
mutex_lock_nested(&ctx->mutex, SINGLE_DEPTH_NESTING); ctx = perf_event_ctx_lock_nested(event, SINGLE_DEPTH_NESTING);
WARN_ON_ONCE(ctx->parent_ctx);
perf_remove_from_context(event, true); perf_remove_from_context(event, true);
mutex_unlock(&ctx->mutex); mutex_unlock(&ctx->mutex);