Commit 2aeb1883 authored by Jiri Olsa's avatar Jiri Olsa Committed by Ingo Molnar

perf/core: Fix locking for children siblings group read

We're missing ctx lock when iterating children siblings
within the perf_read path for group reading. Following
race and crash can happen:

User space doing read syscall on event group leader:

T1:
  perf_read
    lock event->ctx->mutex
    perf_read_group
      lock leader->child_mutex
      __perf_read_group_add(child)
        list_for_each_entry(sub, &leader->sibling_list, group_entry)

---->   sub might be invalid at this point, because it could
        get removed via perf_event_exit_task_context in T2

Child exiting and cleaning up its events:

T2:
  perf_event_exit_task_context
    lock ctx->mutex
    list_for_each_entry_safe(child_event, next, &child_ctx->event_list,...
      perf_event_exit_event(child)
        lock ctx->lock
        perf_group_detach(child)
        unlock ctx->lock

---->   child is removed from sibling_list without any sync
        with T1 path above

        ...
        free_event(child)

Before the child is removed from the leader's child_list,
(and thus is omitted from perf_read_group processing), we
need to ensure that perf_read_group touches child's
siblings under its ctx->lock.

Peter further notes:

| One additional note; this bug got exposed by commit:
|
|   ba5213ae ("perf/core: Correct event creation with PERF_FORMAT_GROUP")
|
| which made it possible to actually trigger this code-path.
Tested-by: default avatarAndi Kleen <ak@linux.intel.com>
Signed-off-by: default avatarJiri Olsa <jolsa@kernel.org>
Acked-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Thomas Gleixner <tglx@linutronix.de>
Fixes: ba5213ae ("perf/core: Correct event creation with PERF_FORMAT_GROUP")
Link: http://lkml.kernel.org/r/20170720141455.2106-1-jolsa@kernel.orgSigned-off-by: default avatarIngo Molnar <mingo@kernel.org>
parent 3bda69c1
...@@ -4372,7 +4372,9 @@ EXPORT_SYMBOL_GPL(perf_event_read_value); ...@@ -4372,7 +4372,9 @@ EXPORT_SYMBOL_GPL(perf_event_read_value);
static int __perf_read_group_add(struct perf_event *leader, static int __perf_read_group_add(struct perf_event *leader,
u64 read_format, u64 *values) u64 read_format, u64 *values)
{ {
struct perf_event_context *ctx = leader->ctx;
struct perf_event *sub; struct perf_event *sub;
unsigned long flags;
int n = 1; /* skip @nr */ int n = 1; /* skip @nr */
int ret; int ret;
...@@ -4402,12 +4404,15 @@ static int __perf_read_group_add(struct perf_event *leader, ...@@ -4402,12 +4404,15 @@ static int __perf_read_group_add(struct perf_event *leader,
if (read_format & PERF_FORMAT_ID) if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(leader); values[n++] = primary_event_id(leader);
raw_spin_lock_irqsave(&ctx->lock, flags);
list_for_each_entry(sub, &leader->sibling_list, group_entry) { list_for_each_entry(sub, &leader->sibling_list, group_entry) {
values[n++] += perf_event_count(sub); values[n++] += perf_event_count(sub);
if (read_format & PERF_FORMAT_ID) if (read_format & PERF_FORMAT_ID)
values[n++] = primary_event_id(sub); values[n++] = primary_event_id(sub);
} }
raw_spin_unlock_irqrestore(&ctx->lock, flags);
return 0; return 0;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment