From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755119AbbHLMcb (ORCPT ); Wed, 12 Aug 2015 08:32:31 -0400 Received: from terminus.zytor.com ([198.137.202.10]:42501 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752747AbbHLMc1 (ORCPT ); Wed, 12 Aug 2015 08:32:27 -0400 Date: Wed, 12 Aug 2015 05:31:48 -0700 From: tip-bot for Ben Hutchings Message-ID: Cc: hpa@zytor.com, mingo@kernel.org, ben@decadent.org.uk, linux-kernel@vger.kernel.org, acme@kernel.org, peterz@infradead.org, torvalds@linux-foundation.org, alexander.shishkin@linux.intel.com, tglx@linutronix.de Reply-To: acme@kernel.org, linux-kernel@vger.kernel.org, peterz@infradead.org, torvalds@linux-foundation.org, alexander.shishkin@linux.intel.com, tglx@linutronix.de, hpa@zytor.com, mingo@kernel.org, ben@decadent.org.uk In-Reply-To: <1437953468.12842.17.camel@decadent.org.uk> References: <1437953468.12842.17.camel@decadent.org.uk> To: linux-tip-commits@vger.kernel.org Subject: [tip:perf/core] perf: Fix double-free of the AUX buffer Git-Commit-ID: ee9397a6fb9bc4e52677f5e33eed4abee0f515e6 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: ee9397a6fb9bc4e52677f5e33eed4abee0f515e6 Gitweb: http://git.kernel.org/tip/ee9397a6fb9bc4e52677f5e33eed4abee0f515e6 Author: Ben Hutchings AuthorDate: Mon, 27 Jul 2015 00:31:08 +0100 Committer: Ingo Molnar CommitDate: Wed, 12 Aug 2015 11:37:21 +0200 perf: Fix double-free of the AUX buffer If rb->aux_refcount is decremented to zero before rb->refcount, __rb_free_aux() may be called twice resulting in a double free of rb->aux_pages. Fix this by adding a check to __rb_free_aux(). Signed-off-by: Ben Hutchings Signed-off-by: Peter Zijlstra (Intel) Cc: Alexander Shishkin Cc: Arnaldo Carvalho de Melo Cc: Linus Torvalds Cc: Peter Zijlstra Cc: Thomas Gleixner Cc: stable@vger.kernel.org Fixes: 57ffc5ca679f ("perf: Fix AUX buffer refcounting") Link: http://lkml.kernel.org/r/1437953468.12842.17.camel@decadent.org.uk Signed-off-by: Ingo Molnar --- kernel/events/ring_buffer.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index b2be01b..c8aa3f7 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -559,11 +559,13 @@ static void __rb_free_aux(struct ring_buffer *rb) rb->aux_priv = NULL; } - for (pg = 0; pg < rb->aux_nr_pages; pg++) - rb_free_aux_page(rb, pg); + if (rb->aux_nr_pages) { + for (pg = 0; pg < rb->aux_nr_pages; pg++) + rb_free_aux_page(rb, pg); - kfree(rb->aux_pages); - rb->aux_nr_pages = 0; + kfree(rb->aux_pages); + rb->aux_nr_pages = 0; + } } void rb_free_aux(struct ring_buffer *rb)