lkml.org 
[lkml]   [2015]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
SubjectRe: perf: fuzzer triggers NULL pointer derefreence in x86_schedule_events
On Wed, May 20, 2015 at 05:26:07PM +0200, Peter Zijlstra wrote:
> Except of course that ->event_init() likes to do an allocation :/
>
> Needs to be fixed differently.

So this puts the lock in the x86 code, it seems to build and run.

But my brain is fried after staring at this pmu scheduling code all day,
so maybe its wrong again.

Stephane, can you have a look?

---
diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c
index 87848eb..344bb90 100644
--- a/arch/x86/kernel/cpu/perf_event.c
+++ b/arch/x86/kernel/cpu/perf_event.c
@@ -1823,6 +1823,9 @@ static int validate_group(struct perf_event *event)
fake_cpuc = allocate_fake_cpuc();
if (IS_ERR(fake_cpuc))
return PTR_ERR(fake_cpuc);
+
+
+ raw_spin_lock_irq(&leader->ctx->lock);
/*
* the event is not yet connected with its
* siblings therefore we must first collect
@@ -1843,6 +1846,8 @@ static int validate_group(struct perf_event *event)
ret = x86_pmu.schedule_events(fake_cpuc, n, NULL);

out:
+ raw_spin_unlock_irq(&leader->ctx->lock);
+
free_fake_cpuc(fake_cpuc);
return ret;
}

\
 
 \ /
  Last update: 2015-05-20 18:41    [W:0.035 / U:1.628 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site