Messages in this thread | | | Date | Wed, 9 Dec 2015 10:05:36 +0100 | From | Peter Zijlstra <> | Subject | Re: use-after-free in __perf_install_in_context |
| |
On Tue, Dec 08, 2015 at 07:57:38PM +0100, Ingo Molnar wrote: > Btw., could we add more redundancy / debug code to the refcounting code? It seems > to be a frequent source of very hard to find/fix races/bugs - so it should be ripe > for some extra debug infrastructure ...
I'll try, but its not easy. The biggest problem so far is the ctx::parent relation. We cannot easily track the reverse of that because of locking (we'd need to hold two ctx->lock, and we cannot because perf_event_context_sched_out()).
The other two relations we have reverse maps for:
task->perf_event_ctxp[] <-> ctx->task event->ctx <-> ctx->event_list
Also, all 3 relations are (more or less) protected under ctx->lock:
- unclone_ctx(): removes the ctx->parent link, with ctx->lock held
- perf_remove_from_context(): removes the event from ctx::event_list, with ctx->lock held; leaves event->ctx set, because nasty games with ctx migration, it will get set to the new context, but can never be NULL.
- perf_event_exit_task_context(): clears task->perf_event_ctxp[], with ctx->lock held; leaves ctx->task set, still looking into this.
| |