Messages in this thread Patch in this message | | | Date | Thu, 20 Oct 2016 13:10:11 +0200 | From | Jiri Olsa <> | Subject | [PATCH] perf: Protect pmu device removal with pmu_bus_running check CONFIG_DEBUG_TEST_DRIVER_REMOVE kernel panic |
| |
On Thu, Oct 20, 2016 at 11:42:59AM +0200, Jiri Olsa wrote: > On Thu, Oct 20, 2016 at 11:04:16AM +0200, Peter Zijlstra wrote: > > On Thu, Oct 20, 2016 at 10:58:03AM +0200, Jiri Olsa wrote: > > > > > @@ -8869,11 +8869,15 @@ void perf_pmu_unregister(struct pmu *pmu) > > > free_percpu(pmu->pmu_disable_count); > > > if (pmu->type >= PERF_TYPE_MAX) > > > idr_remove(&pmu_idr, pmu->type); > > > - if (pmu->nr_addr_filters) > > > - device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); > > > - device_del(pmu->dev); > > > - put_device(pmu->dev); > > > + mutex_lock(&pmus_lock); > > > + if (pmu_bus_running) { > > > + if (pmu->nr_addr_filters) > > > + device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); > > > + device_del(pmu->dev); > > > + put_device(pmu->dev); > > > + } > > > free_pmu_context(pmu); > > > + mutex_unlock(&pmus_lock); > > > } > > > EXPORT_SYMBOL_GPL(perf_pmu_unregister); > > > > I think that is still racy.. > > > > > > unregister: sysfs_init: > > > > mutex_lock(&pmus_lock); > > list_del_rcu(&pmu->entry); > > mutex_unlock(&pmus_lock); > > > > synchronize_*rcu(); > > > > mutex_lock(&pmus_lock); > > list_for_each_entry(pmu, &pmus, entry) { > > /* add device muck */ > > ah, I thought this part would add the device back.. but it's > already out of the pmu list.. right :-\
attached fix, thanks
jirka
--- CAI Qian reported crash [1] in uncore device removal related to CONFIG_DEBUG_TEST_DRIVER_REMOVE option.
The reason for crash is that perf_pmu_unregister tries to remove pmu device which is not added at this point. We add pmu devices only after pmu_bus is registered which happens in perf_event_sysfs_init init call and sets pmu_bus_running flag.
The fix is to get the pmu_bus_running flag state at the point the pmu is taken out of the pmus list and remove the device later only if it's set.
[1] https://marc.info/?l=linux-kernel&m=147688837328451
Reported-by: CAI Qian <caiqian@redhat.com> Signed-off-by: Jiri Olsa <jolsa@kernel.org> --- kernel/events/core.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-)
diff --git a/kernel/events/core.c b/kernel/events/core.c index c6e47e97b33f..a5d2e62faf7e 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -8855,7 +8855,10 @@ EXPORT_SYMBOL_GPL(perf_pmu_register); void perf_pmu_unregister(struct pmu *pmu) { + int remove_device; + mutex_lock(&pmus_lock); + remove_device = pmu_bus_running; list_del_rcu(&pmu->entry); mutex_unlock(&pmus_lock); @@ -8869,10 +8872,12 @@ void perf_pmu_unregister(struct pmu *pmu) free_percpu(pmu->pmu_disable_count); if (pmu->type >= PERF_TYPE_MAX) idr_remove(&pmu_idr, pmu->type); - if (pmu->nr_addr_filters) - device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); - device_del(pmu->dev); - put_device(pmu->dev); + if (remove_device) { + if (pmu->nr_addr_filters) + device_remove_file(pmu->dev, &dev_attr_nr_addr_filters); + device_del(pmu->dev); + put_device(pmu->dev); + } free_pmu_context(pmu); } EXPORT_SYMBOL_GPL(perf_pmu_unregister); -- 2.7.4
| |