iv/linux
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
linux/kernel
History
Peter Zijlstra ebf905fc7a perf: Fix use after free in perf_remove_from_context() 
While that mutex should guard the elements, it doesn't guard against the
use-after-free that's from list_for_each_entry_rcu().
__perf_event_exit_task() can actually free the event.

And because list addition/deletion is guarded by both ctx->mutex and
ctx->lock, holding ctx->mutex is sufficient for reading the list, so we
don't actually need the rcu list iteration.

Fixes: 3a497f48637e ("perf: Simplify perf_event_exit_task_context()")
Reported-by: Sasha Levin <sasha.levin@oracle.com>
Tested-by: Sasha Levin <sasha.levin@oracle.com>
Signed-off-by: Peter Zijlstra <peterz@infradead.org>
Cc: Dave Jones <davej@redhat.com>
Cc: acme@ghostprotocols.net
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Linus Torvalds <torvalds@linux-foundation.org>
Link: http://lkml.kernel.org/r/20140529170024.GA2315@laptop.programming.kicks-ass.net
Signed-off-by: Ingo Molnar <mingo@kernel.org>
2014-06-05 12:29:52 +02:00
..
debug
mm: per-thread vma caching
2014-04-07 16:35:53 -07:00
events
perf: Fix use after free in perf_remove_from_context()
2014-06-05 12:29:52 +02:00
gcov
gcov: reuse kbasename helper
2013-11-13 12:09:34 +09:00
irq
genirq: x86: Ensure that dynamic irq allocation does not conflict
2014-04-28 12:20:00 +02:00
locking
Merge branch 'core-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-04-16 16:35:18 -07:00
power
PM / suspend: Make cpuidle work in the "freeze" state
2014-04-21 23:39:59 +02:00
printk
printk: fix one circular lockdep warning about console_lock
2014-04-03 16:21:08 -07:00
rcu
Merge branch 'sched-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-03-31 11:21:19 -07:00
sched
kprobes, sched: Use NOKPROBE_SYMBOL macro in sched
2014-04-24 10:26:40 +02:00
time
tick-sched: Check tick_nohz_enabled in tick_nohz_switch_to_nohz()
2014-04-15 20:26:58 +02:00
trace
Merge branch 'perf/kprobes' into perf/core
2014-06-05 12:26:50 +02:00
.gitignore
Ignore generated file kernel/x509_certificate_list
2013-12-10 18:21:34 +00:00
acct.c
…
async.c
…
audit_tree.c
inotify: Fix reporting of cookies for inotify events
2014-02-18 11:17:17 +01:00
audit_watch.c
inotify: Fix reporting of cookies for inotify events
2014-02-18 11:17:17 +01:00
audit.c
net: Use netlink_ns_capable to verify the permisions of netlink messages
2014-04-24 13:44:54 -04:00
audit.h
audit: Use struct net not pid_t to remember the network namespce to reply in
2014-03-20 10:10:53 -04:00
auditfilter.c
Merge git://git.infradead.org/users/eparis/audit
2014-04-12 12:38:53 -07:00
auditsc.c
Merge git://git.infradead.org/users/eparis/audit
2014-04-12 12:38:53 -07:00
backtracetest.c
…
bounds.c
mm: do not allocate page->ptl dynamically, if spinlock_t fits to long
2013-12-20 12:25:45 -08:00
capability.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security
2014-04-03 09:26:18 -07:00
cgroup_freezer.c
cgroup: drop const from @buffer of cftype->write_string()
2014-03-19 10:23:54 -04:00
cgroup.c
cgroup: newly created dirs and files should be owned by the creator
2014-04-07 16:44:47 -04:00
compat.c
Merge branch 'x86-x32-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-04-02 12:51:41 -07:00
configs.c
…
context_tracking.c
context_tracking: Wrap static key check into more intuitive function name
2013-12-02 20:43:14 +01:00
cpu_pm.c
…
cpu.c
CPU hotplug: Provide lockless versions of callback registration functions
2014-03-20 13:43:40 +01:00
cpuset.c
Merge branch 'akpm' (incoming from Andrew)
2014-04-03 16:22:16 -07:00
crash_dump.c
…
cred.c
…
delayacct.c
kernel/delayacct.c: remove redundant checking in __delayacct_add_tsk()
2013-11-13 12:09:12 +09:00
dma.c
…
elfcore.c
switch elf_core_write_extra_phdrs() to dump_emit()
2013-11-09 00:16:23 -05:00
exec_domain.c
…
exit.c
wait: WSTOPPED|WCONTINUED doesn't work if a zombie leader is traced by another process
2014-04-07 16:36:06 -07:00
extable.c
asmlinkage: Make main_extable_sort_needed visible
2014-02-13 18:13:22 -08:00
fork.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
freezer.c
libata, freezer: avoid block device removal while system is frozen
2013-12-19 13:50:32 -05:00
futex_compat.c
compat: Get rid of (get|put)_compat_time(val|spec)
2014-02-02 14:09:12 -08:00
futex.c
futex: update documentation for ordering guarantees
2014-04-12 17:57:51 -07:00
groups.c
kernel/groups.c: remove return value of set_groups
2014-04-03 16:21:05 -07:00
hrtimer.c
Merge branch 'perf/urgent' into perf/core, to avoid conflicts
2014-05-07 13:39:22 +02:00
hung_task.c
kernel: audit/fix non-modular users of module_init in core code
2014-04-03 16:21:07 -07:00
irq_work.c
perf/x86: Warn to early_printk() in case irq_work is too slow
2014-02-21 21:49:07 +01:00
itimer.c
…
jump_label.c
static_key: WARN on usage before jump_label_init was called
2013-10-19 19:45:35 -04:00
kallsyms.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
kcmp.c
…
Kconfig.freezer
…
Kconfig.hz
kernel: remove CONFIG_USE_GENERIC_SMP_HELPERS
2013-11-15 09:32:22 +09:00
Kconfig.locks
…
Kconfig.preempt
…
kexec.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
kmod.c
execve: use 'struct filename *' for executable name passing
2014-02-05 12:54:53 -08:00
kprobes.c
kprobes: Show blacklist entries via debugfs
2014-04-24 10:26:41 +02:00
ksysfs.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
kthread.c
kthread: ensure locality of task_struct allocations
2014-04-03 16:20:49 -07:00
latencytop.c
…
Makefile
Merge branch 'x86-asmlinkage-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-03-31 14:13:25 -07:00
module_signing.c
keys: change asymmetric keys to use common hash definitions
2013-10-25 17:15:18 -04:00
module-internal.h
KEYS: Separate the kernel signature checking keyring from module signing
2013-09-25 17:17:01 +01:00
module.c
Fixed one missing place for the new taint flag, and remove a warning
2014-05-01 10:35:01 -07:00
notifier.c
kprobes, notifier: Use NOKPROBE_SYMBOL macro in notifier
2014-04-24 10:26:39 +02:00
nsproxy.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/ebiederm/user-namespace
2013-09-07 14:35:32 -07:00
padata.c
padata: Fix wrong usage of rcu_dereference()
2013-12-05 21:28:42 +08:00
panic.c
kernel/panic.c: display reason at end + pr_emerg
2014-04-07 16:36:08 -07:00
params.c
params: improve standard definitions
2013-12-04 14:09:46 +10:30
pid_namespace.c
pid_namespace: pidns_get() should check task_active_pid_ns() != NULL
2014-04-02 16:20:21 -07:00
pid.c
pidns: fix free_pid() to handle the first fork failure
2013-09-30 14:31:03 -07:00
posix-cpu-timers.c
posix-timers: Convert abuses of BUG_ON to WARN_ON
2013-12-09 16:56:29 +01:00
posix-timers.c
…
profile.c
CPU hotplug notifiers registration fixes for 3.15-rc1
2014-04-07 14:55:46 -07:00
ptrace.c
kernel/compat: convert to COMPAT_SYSCALL_DEFINE
2014-03-06 15:35:10 +01:00
range.c
…
reboot.c
kexec: migrate to reboot cpu
2013-12-18 19:04:50 -08:00
relay.c
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs
2014-04-12 14:49:50 -07:00
res_counter.c
res_counter: remove interface for locked charging and uncharging
2014-04-07 16:35:54 -07:00
resource.c
kernel/resource.c: make reallocate_resource() static
2014-04-03 16:21:07 -07:00
seccomp.c
seccomp: fix memory leak on filter attach
2014-04-16 15:25:53 -04:00
signal.c
kernel: use macros from compiler.h instead of __attribute__((...))
2014-04-07 16:36:11 -07:00
smp.c
smp: Rename __smp_call_function_single() to smp_call_function_single_async()
2014-02-24 14:47:15 -08:00
smpboot.c
kernel: delete __cpuinit usage from all core kernel files
2013-07-14 19:36:59 -04:00
smpboot.h
…
softirq.c
genirq: x86: Ensure that dynamic irq allocation does not conflict
2014-04-28 12:20:00 +02:00
stacktrace.c
…
stop_machine.c
stop_machine: Fix^2 race between stop_two_cpus() and stop_cpus()
2014-03-11 11:33:47 +01:00
sys_ni.c
fs, kernel: permit disabling the uselib syscall
2014-04-03 16:21:05 -07:00
sys.c
mm, thp: add VM_INIT_DEF_MASK and PRCTL_THP_DISABLE
2014-04-07 16:35:52 -07:00
sysctl_binary.c
kernel/sysctl_binary.c: use scnprintf() instead of snprintf()
2013-11-13 12:09:33 +09:00
sysctl.c
hung_task: check the value of "sysctl_hung_task_timeout_sec"
2014-04-07 16:36:07 -07:00
system_certificates.S
KEYS: correct alignment of system_certificate_list content in assembly file
2013-12-10 18:25:28 +00:00
system_keyring.c
KEYS: correct alignment of system_certificate_list content in assembly file
2013-12-10 18:25:28 +00:00
task_work.c
task_work: documentation
2013-09-11 15:58:27 -07:00
taskstats.c
genetlink: only pass array to genl_register_family_with_ops()
2013-11-19 16:39:05 -05:00
test_kprobes.c
…
time.c
…
timeconst.bc
…
timer.c
timer: Prevent overflow in apply_slack
2014-04-30 13:46:17 +02:00
torture.c
rcutorture: Gracefully handle NULL cleanup hooks
2014-02-23 09:04:39 -08:00
tracepoint.c
This includes the final patch to clean up and fix the issue with the
2014-04-12 13:06:10 -07:00
tsacct.c
…
uid16.c
userns: Kill nsown_capable it makes the wrong thing easy
2013-08-30 23:44:11 -07:00
up.c
smp: Rename __smp_call_function_single() to smp_call_function_single_async()
2014-02-24 14:47:15 -08:00
user_namespace.c
user namespace: fix incorrect memory barriers
2014-04-14 16:03:02 -07:00
user-return-notifier.c
…
user.c
kernel: audit/fix non-modular users of module_init in core code
2014-04-03 16:21:07 -07:00
utsname_sysctl.c
…
utsname.c
userns: Kill nsown_capable it makes the wrong thing easy
2013-08-30 23:44:11 -07:00
watchdog.c
kernel/watchdog.c:touch_softlockup_watchdog(): use raw_cpu_write()
2014-04-18 16:40:08 -07:00
workqueue_internal.h
…
workqueue.c
Merge branch 'timers-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
2014-04-01 11:00:07 -07:00