lkml.org 
[lkml]   [2014]   [May]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: perf: use after free in perf_remove_from_context
On 05/29/2014 12:50 PM, Peter Zijlstra wrote:
>> >
>> > So the only caller to sync_child_event() is that loop. According to what you said
>> > it should be safe to remove that mutex lock, but doing that triggers a list
>> > corruption:
>> >
>> > [ 1204.341887] WARNING: CPU: 20 PID: 12839 at lib/list_debug.c:62 __list_del_entry+0xa1/0xe0()
>> > [ 1204.347597] list_del corruption. next->prev should be ffff8806ca68b108, but was ffff88051a67c398
>> > [...]
>> >
>> > I don't see how that would happen :/
> No, what I said is that the mutex in perf_event_exit_task() should be
> sufficient to guard the list iteration calling __perf_event_exit_task().
>
> Ading the RCU was a bit of paranoia..

Oh, my bad, I thought you referred to the mutex lock in sync_child_event().


Thanks,
Sasha


\
 
 \ /
  Last update: 2014-05-29 20:21    [W:0.252 / U:0.236 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site