public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: Sasha Levin <sasha.levin@oracle.com>
To: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@kernel.org>,
	acme@ghostprotocols.net, LKML <linux-kernel@vger.kernel.org>,
	Thomas Gleixner <tglx@linutronix.de>,
	Dave Jones <davej@redhat.com>
Subject: Re: perf: use after free in perf_remove_from_context
Date: Thu, 29 May 2014 12:44:23 -0400	[thread overview]
Message-ID: <538763E7.6030902@oracle.com> (raw)
In-Reply-To: <20140529150705.GJ19143@laptop.programming.kicks-ass.net>

On 05/29/2014 11:07 AM, Peter Zijlstra wrote:
> On Thu, May 29, 2014 at 10:47:09AM -0400, Sasha Levin wrote:
>> It doesn't work out well because we later lock a mutex in sync_child_event().
>>
> 
> Urgh, right you are. I'll go stare at it more. It shouldn't have
> mattered, because the mutex we take just before should ensure existence,
> but.. you know.. :-)
> 

So the only caller to sync_child_event() is that loop. According to what you said
it should be safe to remove that mutex lock, but doing that triggers a list
corruption:

[ 1204.341887] WARNING: CPU: 20 PID: 12839 at lib/list_debug.c:62 __list_del_entry+0xa1/0xe0()
[ 1204.347597] list_del corruption. next->prev should be ffff8806ca68b108, but was ffff88051a67c398
[...]

I don't see how that would happen :/


Thanks,
Sasha

  reply	other threads:[~2014-05-29 16:45 UTC|newest]

Thread overview: 46+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2014-05-12 15:42 perf: use after free in perf_remove_from_context Sasha Levin
2014-05-14 16:29 ` Peter Zijlstra
2014-05-14 16:32   ` Sasha Levin
2014-05-14 16:35     ` Peter Zijlstra
2014-05-14 16:38       ` Sasha Levin
2014-05-14 16:52         ` Peter Zijlstra
2014-05-14 17:09           ` Sasha Levin
2014-05-14 17:20             ` Dave Jones
2014-05-14 18:37               ` Peter Zijlstra
2014-05-28 23:52       ` Sasha Levin
2014-05-29  2:31         ` Sasha Levin
2014-05-29  7:59           ` Peter Zijlstra
2014-05-29  7:57         ` Peter Zijlstra
2014-05-29 14:47           ` Sasha Levin
2014-05-29 15:07             ` Peter Zijlstra
2014-05-29 16:44               ` Sasha Levin [this message]
2014-05-29 16:50                 ` Peter Zijlstra
2014-05-29 16:52                   ` Sasha Levin
2014-05-29 17:00                   ` Peter Zijlstra
2014-05-29 22:37                     ` Sasha Levin
2014-06-05 14:38                     ` [tip:perf/core] perf: Fix use after free in perf_remove_from_context() tip-bot for Peter Zijlstra
2014-05-15 18:11 ` eventpoll __list_del_entry corruption (was: perf: use after free in perf_remove_from_context) Peter Zijlstra
2014-05-15 18:16   ` eventpoll __list_del_entry corruption Sasha Levin
2014-06-16  9:44     ` Eric Wong
2014-05-21  8:25   ` BUG at /usr/src/linux-2.6/mm/filemap.c:202 (was: perf: use after free in perf_remove_from_context) Peter Zijlstra
2014-05-21 13:02     ` BUG at /usr/src/linux-2.6/mm/filemap.c:202 Sasha Levin
2014-06-03 15:07   ` eventpoll __list_del_entry corruption Jason Baron
2014-06-03 15:11     ` Peter Zijlstra
2014-05-16 15:34 ` BUG_ON drivers/char/random.c:986 (Was: perf: use after free in perf_remove_from_context) Peter Zijlstra
2014-05-16 16:06   ` H. Peter Anvin
2014-05-16 16:21     ` Peter Zijlstra
2014-05-17  0:46       ` Hannes Frederic Sowa
2014-05-17  2:18         ` Theodore Ts'o
2014-05-17 16:24           ` Sasha Levin
2014-05-17 17:00             ` Peter Zijlstra
2014-07-15  4:36           ` BUG_ON drivers/char/random.c:986 Dave Jones
2014-07-15 20:29             ` Hannes Frederic Sowa
2014-07-16  8:33               ` Theodore Ts'o
2014-07-16 19:18                 ` [PATCH] random: check for increase of entropy_count because of signed conversion Hannes Frederic Sowa
2014-07-18 21:25                   ` Theodore Ts'o
2014-07-18 21:43                     ` Hannes Frederic Sowa
2014-07-18 21:50                     ` Theodore Ts'o
2014-07-18 22:07                       ` Theodore Ts'o
2014-07-18 23:35                         ` Hannes Frederic Sowa
2014-07-19  5:42                           ` Theodore Ts'o
2014-07-19  6:20                             ` Hannes Frederic Sowa

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=538763E7.6030902@oracle.com \
    --to=sasha.levin@oracle.com \
    --cc=acme@ghostprotocols.net \
    --cc=davej@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=peterz@infradead.org \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox