Peter Zijlstra 321027c1fe perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race ... Di Shen reported a race between two concurrent sys_perf_event_open() calls where both try and move the same pre-existing software group into a hardware context. The problem is exactly that described in commit: f63a8daa58 ("perf: Fix event->ctx locking") ... where, while we wait for a ctx->mutex acquisition, the event->ctx relation can have changed under us. That very same commit failed to recognise sys_perf_event_context() as an external access vector to the events and thereby didn't apply the established locking rules correctly. So while one sys_perf_event_open() call is stuck waiting on mutex_lock_double(), the other (which owns said locks) moves the group about. So by the time the former sys_perf_event_open() acquires the locks, the context we've acquired is stale (and possibly dead). Apply the established locking rules as per perf_event_ctx_lock_nested() to the mutex_lock_double() for the 'move_group' case. This obviously means we need to validate state after we acquire the locks. Reported-by: Di Shen (Keen Lab) Tested-by: John Dias <joaodias@google.com> Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Kees Cook <keescook@chromium.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Cc: Min Chong <mchong@google.com> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Stephane Eranian <eranian@google.com> Cc: Thomas Gleixner <tglx@linutronix.de> Cc: Vince Weaver <vincent.weaver@maine.edu> Fixes: f63a8daa58 ("perf: Fix event->ctx locking") Link: http://lkml.kernel.org/r/20170106131444.GZ3174@twins.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org>		2017-01-14 10:56:11 +01:00
..
callchain.c	perf core: Per event callchain limit	2016-05-30 12:41:44 -03:00
core.c	perf/core: Fix concurrent sys_perf_event_open() vs. 'move_group' race	2017-01-14 10:56:11 +01:00
hw_breakpoint.c	perf: Collapse and fix event_function_call() users	2016-01-21 18:54:24 +01:00
internal.h	bpf, events: fix offset in skb copy handler	2016-07-25 10:34:11 -07:00
Makefile	ftrace: allow architectures to specify ftrace compile options	2015-01-29 09:19:19 +01:00
ring_buffer.c	perf/core: Fix aux_mmap_count vs aux_refcount order	2016-09-10 11:15:36 +02:00
uprobes.c	Merge branch 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2016-12-23 16:49:12 -08:00