From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755497AbaIBW11 (ORCPT ); Tue, 2 Sep 2014 18:27:27 -0400 Received: from mail-pd0-f180.google.com ([209.85.192.180]:52088 "EHLO mail-pd0-f180.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755361AbaIBW1Z (ORCPT ); Tue, 2 Sep 2014 18:27:25 -0400 From: Cong Wang To: linux-kernel@vger.kernel.org Cc: stable@vger.kernel.org, Peter Zijlstra , Paul Mackerras , Ingo Molnar , Arnaldo Carvalho de Melo , Cong Wang , Cong Wang Subject: [Patch v2] perf_event: fix a race condition in perf_remove_from_context() Date: Tue, 2 Sep 2014 15:27:20 -0700 Message-Id: <1409696840-843-1-git-send-email-xiyou.wangcong@gmail.com> X-Mailer: git-send-email 1.8.3.1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Cong Wang We saw a kernel soft lockup in perf_remove_from_context(), it looks like the `perf` process, when exiting, could not go out of the retry loop. Meanwhile, the target process was forking a child. So either the target process should execute the smp function call to deactive the event (if it was running) or it should do a context switch which deactives the event. It seems we optimize out a context switch in perf_event_context_sched_out(), and what's more important, we still test an obsolete task pointer when retrying, so no one actually would deactive that event in this situation. Fix it directly by reloading the task pointer in perf_remove_from_context(). This should cure the above soft lockup. Cc: stable@vger.kernel.org Cc: Peter Zijlstra Cc: Paul Mackerras Cc: Ingo Molnar Cc: Arnaldo Carvalho de Melo Signed-off-by: Cong Wang Signed-off-by: Cong Wang --- v2: fix perf_install_in_context() too and re-generate this patch diff --git a/kernel/events/core.c b/kernel/events/core.c index f9c1ed0..d640a8b 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -1524,6 +1524,11 @@ static void perf_remove_from_context(struct perf_event *event, bool detach_group */ if (ctx->is_active) { raw_spin_unlock_irq(&ctx->lock); + /* + * Reload the task pointer, it might have been changed by + * a concurrent perf_event_context_sched_out(). + */ + task = ctx->task; goto retry; } @@ -1967,6 +1972,11 @@ perf_install_in_context(struct perf_event_context *ctx, */ if (ctx->is_active) { raw_spin_unlock_irq(&ctx->lock); + /* + * Reload the task pointer, it might have been changed by + * a concurrent perf_event_context_sched_out(). + */ + task = ctx->task; goto retry; }