Peter Zijlstra ebf905fc7a perf: Fix use after free in perf_remove_from_context() ... While that mutex should guard the elements, it doesn't guard against the use-after-free that's from list_for_each_entry_rcu(). __perf_event_exit_task() can actually free the event. And because list addition/deletion is guarded by both ctx->mutex and ctx->lock, holding ctx->mutex is sufficient for reading the list, so we don't actually need the rcu list iteration. Fixes: 3a497f4863 ("perf: Simplify perf_event_exit_task_context()") Reported-by: Sasha Levin <sasha.levin@oracle.com> Tested-by: Sasha Levin <sasha.levin@oracle.com> Signed-off-by: Peter Zijlstra <peterz@infradead.org> Cc: Dave Jones <davej@redhat.com> Cc: acme@ghostprotocols.net Cc: Arnaldo Carvalho de Melo <acme@kernel.org> Cc: Linus Torvalds <torvalds@linux-foundation.org> Link: http://lkml.kernel.org/r/20140529170024.GA2315@laptop.programming.kicks-ass.net Signed-off-by: Ingo Molnar <mingo@kernel.org>		2014-06-05 12:29:52 +02:00
..
callchain.c	perf: Roll back callchain buffer refcount under the callchain mutex	2013-08-16 17:55:50 +02:00
core.c	perf: Fix use after free in perf_remove_from_context()	2014-06-05 12:29:52 +02:00
hw_breakpoint.c
internal.h	perf: Fix arch_perf_out_copy_user default	2013-11-06 12:34:25 +01:00
Makefile
ring_buffer.c	perf: Optimize ring-buffer write by depending on control dependencies	2013-12-11 15:53:22 +01:00
uprobes.c	uprobes/x86: Fix the wrong ->si_addr when xol triggers a trap	2014-05-14 13:57:28 +02:00