Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753928AbbETQJV (ORCPT ); Wed, 20 May 2015 12:09:21 -0400 Received: from bombadil.infradead.org ([198.137.202.9]:41214 "EHLO bombadil.infradead.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753393AbbETQJS (ORCPT ); Wed, 20 May 2015 12:09:18 -0400 Date: Wed, 20 May 2015 18:09:11 +0200 From: Peter Zijlstra To: Vince Weaver Cc: Stephane Eranian , LKML , Arnaldo Carvalho de Melo , Jiri Olsa , Ingo Molnar , Paul Mackerras Subject: Re: perf: fuzzer triggers NULL pointer derefreence in x86_schedule_events Message-ID: <20150520160911.GM18673@twins.programming.kicks-ass.net> References: <20150501125955.GF5029@twins.programming.kicks-ass.net> <20150507124300.GK23123@twins.programming.kicks-ass.net> <20150520130312.GL3644@twins.programming.kicks-ass.net> <20150520134922.GH18673@twins.programming.kicks-ass.net> <20150520152607.GK18673@twins.programming.kicks-ass.net> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20150520152607.GK18673@twins.programming.kicks-ass.net> User-Agent: Mutt/1.5.21 (2012-12-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1338 Lines: 41 On Wed, May 20, 2015 at 05:26:07PM +0200, Peter Zijlstra wrote: > Except of course that ->event_init() likes to do an allocation :/ > > Needs to be fixed differently. So this puts the lock in the x86 code, it seems to build and run. But my brain is fried after staring at this pmu scheduling code all day, so maybe its wrong again. Stephane, can you have a look? --- diff --git a/arch/x86/kernel/cpu/perf_event.c b/arch/x86/kernel/cpu/perf_event.c index 87848eb..344bb90 100644 --- a/arch/x86/kernel/cpu/perf_event.c +++ b/arch/x86/kernel/cpu/perf_event.c @@ -1823,6 +1823,9 @@ static int validate_group(struct perf_event *event) fake_cpuc = allocate_fake_cpuc(); if (IS_ERR(fake_cpuc)) return PTR_ERR(fake_cpuc); + + + raw_spin_lock_irq(&leader->ctx->lock); /* * the event is not yet connected with its * siblings therefore we must first collect @@ -1843,6 +1846,8 @@ static int validate_group(struct perf_event *event) ret = x86_pmu.schedule_events(fake_cpuc, n, NULL); out: + raw_spin_unlock_irq(&leader->ctx->lock); + free_fake_cpuc(fake_cpuc); return ret; } -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/