Commit c5ed5145 authored by Peter Zijlstra's avatar Peter Zijlstra Committed by Ingo Molnar

perf: Fix contexted inheritance

Linus reported that the RCU lockdep annotation bits triggered for this
rcu_dereference() because we're not holding rcu_read_lock().

Going over the code I cannot convince myself its correct:

 - holding a ref on the parent_ctx, doesn't avoid it being uncloned
   concurrently (as the comment says), so we can race with a free.

 - holding parent_ctx->mutex doesn't avoid the above free from taking
   place either, it would at best avoid parent_ctx from being freed.

I.e. the warning is correct. To fix the bug, serialize against the
unclone_ctx() call by extending the reach of the parent_ctx->lock.
Reported-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: default avatarPeter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
LKML-Reference: <new-submission>
Signed-off-by: default avatarIngo Molnar <mingo@elte.hu>
parent ad7f4e3f
...@@ -6494,7 +6494,6 @@ int perf_event_init_context(struct task_struct *child, int ctxn) ...@@ -6494,7 +6494,6 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
raw_spin_lock_irqsave(&parent_ctx->lock, flags); raw_spin_lock_irqsave(&parent_ctx->lock, flags);
parent_ctx->rotate_disable = 0; parent_ctx->rotate_disable = 0;
raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
child_ctx = child->perf_event_ctxp[ctxn]; child_ctx = child->perf_event_ctxp[ctxn];
...@@ -6502,12 +6501,11 @@ int perf_event_init_context(struct task_struct *child, int ctxn) ...@@ -6502,12 +6501,11 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
/* /*
* Mark the child context as a clone of the parent * Mark the child context as a clone of the parent
* context, or of whatever the parent is a clone of. * context, or of whatever the parent is a clone of.
* Note that if the parent is a clone, it could get *
* uncloned at any point, but that doesn't matter * Note that if the parent is a clone, the holding of
* because the list of events and the generation * parent_ctx->lock avoids it from being uncloned.
* count can't have changed since we took the mutex.
*/ */
cloned_ctx = rcu_dereference(parent_ctx->parent_ctx); cloned_ctx = parent_ctx->parent_ctx;
if (cloned_ctx) { if (cloned_ctx) {
child_ctx->parent_ctx = cloned_ctx; child_ctx->parent_ctx = cloned_ctx;
child_ctx->parent_gen = parent_ctx->parent_gen; child_ctx->parent_gen = parent_ctx->parent_gen;
...@@ -6518,6 +6516,7 @@ int perf_event_init_context(struct task_struct *child, int ctxn) ...@@ -6518,6 +6516,7 @@ int perf_event_init_context(struct task_struct *child, int ctxn)
get_ctx(child_ctx->parent_ctx); get_ctx(child_ctx->parent_ctx);
} }
raw_spin_unlock_irqrestore(&parent_ctx->lock, flags);
mutex_unlock(&parent_ctx->mutex); mutex_unlock(&parent_ctx->mutex);
perf_unpin_context(parent_ctx); perf_unpin_context(parent_ctx);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment