Commit 066b3aa8 authored by David Rientjes's avatar David Rientjes Committed by Robert Richter

oprofile: fix race condition in event_buffer free

Looking at the 2.6.31-rc9 code, it appears there is a race condition
in the event_buffer cleanup code path (shutdown). This could lead to
kernel panic as some CPUs may be operating on the event buffer AFTER
it has been freed. The attached patch solves the problem and makes
sure CPUs check if the buffer is not NULL before they access it as
some may have been spinning on the mutex while the buffer was being
freed.

The race may happen if the buffer is freed during pending reads. But
it is not clear why there are races in add_event_entry() since all
workqueues or handlers are canceled or flushed before the event buffer
is freed.
Signed-off-by: default avatarDavid Rientjes <rientjes@google.com>
Signed-off-by: default avatarStephane Eranian <eranian@google.com>
Signed-off-by: default avatarRobert Richter <robert.richter@amd.com>
parent 374576a8
...@@ -41,6 +41,12 @@ static atomic_t buffer_ready = ATOMIC_INIT(0); ...@@ -41,6 +41,12 @@ static atomic_t buffer_ready = ATOMIC_INIT(0);
*/ */
void add_event_entry(unsigned long value) void add_event_entry(unsigned long value)
{ {
/*
* catch potential error
*/
if (!event_buffer)
return;
if (buffer_pos == buffer_size) { if (buffer_pos == buffer_size) {
atomic_inc(&oprofile_stats.event_lost_overflow); atomic_inc(&oprofile_stats.event_lost_overflow);
return; return;
...@@ -92,9 +98,10 @@ int alloc_event_buffer(void) ...@@ -92,9 +98,10 @@ int alloc_event_buffer(void)
void free_event_buffer(void) void free_event_buffer(void)
{ {
mutex_lock(&buffer_mutex);
vfree(event_buffer); vfree(event_buffer);
event_buffer = NULL; event_buffer = NULL;
mutex_unlock(&buffer_mutex);
} }
...@@ -167,6 +174,11 @@ static ssize_t event_buffer_read(struct file *file, char __user *buf, ...@@ -167,6 +174,11 @@ static ssize_t event_buffer_read(struct file *file, char __user *buf,
mutex_lock(&buffer_mutex); mutex_lock(&buffer_mutex);
if (!event_buffer) {
retval = -EINTR;
goto out;
}
atomic_set(&buffer_ready, 0); atomic_set(&buffer_ready, 0);
retval = -EFAULT; retval = -EFAULT;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment