From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755403AbbGZXbZ (ORCPT ); Sun, 26 Jul 2015 19:31:25 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:37824 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755092AbbGZXbY (ORCPT ); Sun, 26 Jul 2015 19:31:24 -0400 Message-ID: <1437953468.12842.17.camel@decadent.org.uk> Subject: [PATCH] perf: Avoid double-free of AUX buffer From: Ben Hutchings To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo Cc: linux-kernel@vger.kernel.org Date: Mon, 27 Jul 2015 00:31:08 +0100 Content-Type: multipart/signed; micalg="pgp-sha512"; protocol="application/pgp-signature"; boundary="=-kdLN9ki5VmNnFfRGZ5h2" X-Mailer: Evolution 3.16.3-1 Mime-Version: 1.0 X-SA-Exim-Connect-IP: 192.168.4.249 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org --=-kdLN9ki5VmNnFfRGZ5h2 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable If rb->aux_refcount is decremented to zero before rb->refcount, __rb_free_aux() may be called twice resulting in a double free of rb->aux_pages. Fix this by adding a check to __rb_free_aux(). Fixes: 57ffc5ca679f ("perf: Fix AUX buffer refcounting") Signed-off-by: Ben Hutchings --- Found by inspection, and the fix is compile-tested only. I think both commit 57ffc5ca679f and this should go to stable, but that's up to you. Ben. kernel/events/ring_buffer.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index b2be01b..c8aa3f7 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -559,11 +559,13 @@ static void __rb_free_aux(struct ring_buffer *rb) rb->aux_priv =3D NULL; } =20 - for (pg =3D 0; pg < rb->aux_nr_pages; pg++) - rb_free_aux_page(rb, pg); + if (rb->aux_nr_pages) { + for (pg =3D 0; pg < rb->aux_nr_pages; pg++) + rb_free_aux_page(rb, pg); =20 - kfree(rb->aux_pages); - rb->aux_nr_pages =3D 0; + kfree(rb->aux_pages); + rb->aux_nr_pages =3D 0; + } } =20 void rb_free_aux(struct ring_buffer *rb) --=20 Ben Hutchings Any sufficiently advanced bug is indistinguishable from a feature. --=-kdLN9ki5VmNnFfRGZ5h2 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: This is a digitally signed message part -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQIVAwUAVbVtvOe/yOyVhhEJAQpXjhAAm3UGBZNicQHZNoqQi6ICub1KhvQsh7Hb ZOk3zJ+5Sg/GH7gsdHPK9o0mxMhEq1M8RKqIY4MZqdW3H6iBG6/ZbGpN96jHt0EM PNwja3CzVPkcj2AmHRoEu4KeoP6D40aX2WbkVWad13X/ZmVN2GBSCY8ka2C92Pql 9Um/6QtDXBreFEfSHT+1syfN3VVOiRwMSaNKQ+PZsvSBUHDJWoaWD4x/SE/Z3WCx pi/EFdufk/dKX+rQKk6zm3SEsZTxP1jpfjhr4KgObBG1eg7ZIZ6WtnEOM/PofUrs I/7aOUfvA+kzKpvkJsf5Glykjc0jnvD0EDCV5Kwz6XyHF/nMtnkoZoQab20ztbYn Qh/xx6mkDyGa7qw9x6/F1az5GaZEambbVm6Ytq1cUqgc++Ujj2fy9ObikJuU8Kml 7vT2x95agJs3/LtChyDdTTY0yoQkquHZMx//O71ptjPU4X4JPlBChF22LM/oY2sz gCktYc3bijjExTL/d3ZbyGh7PakJoTsBMuIYH046DOcuOoqzgI2Ar0OImp/8k6bv uqZjo+t6hUNQz4NmUpfVnhqFQaoC8Dd37EDO4AAcGehCO847lcHikTiXE4o7EJ8A ei2PnwGX7qxfMD782Qkk//l2EFNCQY77Jh9QbKg7SfGcVUBoV4TI01CPnbXvnJlq I8qAeAzmYis= =IDyU -----END PGP SIGNATURE----- --=-kdLN9ki5VmNnFfRGZ5h2--