From: Greg KH on
2.6.32-stable review patch. If anyone has any objections, please let us know.

------------------

From: Steven Rostedt <srostedt(a)redhat.com>

commit a2f8071428ed9a0f06865f417c962421c9a6b488 upstream.

When the trace iterator is read, tracing_start() and tracing_stop()
is called to stop tracing while the iterator is processing the trace
output.

These functions disable both the standard buffer and the max latency
buffer. But if the wakeup tracer is running, it can switch these
buffers between the two disables:

buffer = global_trace.buffer;
if (buffer)
ring_buffer_record_disable(buffer);

<<<--------- swap happens here

buffer = max_tr.buffer;
if (buffer)
ring_buffer_record_disable(buffer);

What happens is that we disabled the same buffer twice. On tracing_start()
we can enable the same buffer twice. All ring_buffer_record_disable()
must be matched with a ring_buffer_record_enable() or the buffer
can be disable permanently, or enable prematurely, and cause a bug
where a reset happens while a trace is commiting.

This patch protects these two by taking the ftrace_max_lock to prevent
a switch from occurring.

Found with Li Zefan's ftrace_stress_test.

Reported-by: Lai Jiangshan <laijs(a)cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
kernel/trace/trace.c | 9 +++++++++
1 file changed, 9 insertions(+)

--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -858,6 +858,8 @@ void tracing_start(void)
goto out;
}

+ /* Prevent the buffers from switching */
+ __raw_spin_lock(&ftrace_max_lock);

buffer = global_trace.buffer;
if (buffer)
@@ -867,6 +869,8 @@ void tracing_start(void)
if (buffer)
ring_buffer_record_enable(buffer);

+ __raw_spin_unlock(&ftrace_max_lock);
+
ftrace_start();
out:
spin_unlock_irqrestore(&tracing_start_lock, flags);
@@ -888,6 +892,9 @@ void tracing_stop(void)
if (trace_stop_count++)
goto out;

+ /* Prevent the buffers from switching */
+ __raw_spin_lock(&ftrace_max_lock);
+
buffer = global_trace.buffer;
if (buffer)
ring_buffer_record_disable(buffer);
@@ -896,6 +903,8 @@ void tracing_stop(void)
if (buffer)
ring_buffer_record_disable(buffer);

+ __raw_spin_unlock(&ftrace_max_lock);
+
out:
spin_unlock_irqrestore(&tracing_start_lock, flags);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/