Messages in this thread Patch in this message | | | Subject | Re: perf NULL pointer dereference on -rc5 | From | Peter Zijlstra <> | Date | Tue, 13 Dec 2011 20:48:55 +0100 |
| |
On Tue, 2011-12-13 at 15:26 +0000, Will Deacon wrote: > > Commit 10c6db11 ("perf: Fix loss of notification with multi-event") seems to > dereference a NULL event->rb in the wakeup handler during Vince Weaver's perf > tests (specifically corner_cases/overflow_requires_mmap). > > This diff seems to fix the problem, but I'm not sure if it just hides something else:
No that is about right.. not so very good of us to have missed that.
Can I add your SoB to this?
--- Subject: perf: Fix ring_buffer_wakeup() From: Will Deacon <will.deacon@arm.com> Date: Tue Dec 13 20:40:45 CET 2011
Commit 10c6db11 ("perf: Fix loss of notification with multi-event") seems to unconditionally dereference event->rb in the wakeup handler, this is wrong, there might not be a buffer attached.
Signed-off-by: Peter Zijlstra <a.p.zijlstra@chello.nl> Link: http://lkml.kernel.org/r/20111213152651.GP20297@mudshark.cambridge.arm.com --- kernel/events/core.c | 3 +++ 1 file changed, 3 insertions(+)
--- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -3360,9 +3360,12 @@ static void ring_buffer_wakeup(struct pe rcu_read_lock(); rb = rcu_dereference(event->rb); + if (!rb) + goto unlock; list_for_each_entry_rcu(event, &rb->event_list, rb_entry) { wake_up_all(&event->waitq); } +unlock: rcu_read_unlock(); }
| |