Peter Zijlstra 54b3f8df1f perf: Fix race in removing an event ... commit 46ce0fe97a upstream. When removing a (sibling) event we do: raw_spin_lock_irq(&ctx->lock); perf_group_detach(event); raw_spin_unlock_irq(&ctx->lock); <hole> perf_remove_from_context(event); raw_spin_lock_irq(&ctx->lock); ... raw_spin_unlock_irq(&ctx->lock); Now, assuming the event is a sibling, it will be 'unreachable' for things like ctx_sched_out() because that iterates the groups->siblings, and we just unhooked the sibling. So, if during <hole> we get ctx_sched_out(), it will miss the event and not call event_sched_out() on it, leaving it programmed on the PMU. The subsequent perf_remove_from_context() call will find the ctx is inactive and only call list_del_event() to remove the event from all other lists. Hereafter we can proceed to free the event; while still programmed! Close this hole by moving perf_group_detach() inside the same ctx->lock region(s) perf_remove_from_context() has. The condition on inherited events only in __perf_event_exit_task() is likely complete crap because non-inherited events are part of groups too and we're tearing down just the same. But leave that for another patch. Most-likely-Fixes: e03a9a55b4 ("perf: Change close() semantics for group events") Reported-by: Vince Weaver <vincent.weaver@maine.edu> Tested-by: Vince Weaver <vincent.weaver@maine.edu> Much-staring-at-traces-by: Vince Weaver <vincent.weaver@maine.edu> Much-staring-at-traces-by: Thomas Gleixner <tglx@linutronix.de> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Peter Zijlstra <peterz@infradead.org> Link: http://lkml.kernel.org/r/20140505093124.GN17778@laptop.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2014-06-11 12:03:21 -07:00
..
callchain.c	perf: Add attribute to filter out callchains	2012-08-10 12:40:57 -03:00
core.c	perf: Fix race in removing an event	2014-06-11 12:03:21 -07:00
hw_breakpoint.c	hw_breakpoint: Use cpu_possible_mask in {reserve,release}_bp_slot()	2013-06-20 17:57:01 +02:00
internal.h	perf: Fix mmap() accounting hole	2013-06-19 12:44:13 +02:00
Makefile	uprobes: Move to kernel/events/	2012-02-22 11:08:00 +01:00
ring_buffer.c	perf: Fix perf ring buffer memory ordering	2013-11-20 12:27:47 -08:00
uprobes.c	uprobes: Fix utask->depth accounting in handle_trampoline()	2013-09-26 17:18:27 -07:00