From: Frederic Weisbecker on
If we call perf_event_stop() on a software event and then the
disable() pmu callback on them after that, we'll call twice
hlist_del_rcu() on the same hlist node and then bring a crash
by dereferencing LIST_POISON2.

Just use hlist_del_init_rcu() instead to fix this problem.

This preparates for new context exclusions.

Signed-off-by: Frederic Weisbecker <fweisbec(a)gmail.com>
Cc: Ingo Molnar <mingo(a)elte.hu>
Cc: Peter Zijlstra <a.p.zijlstra(a)chello.nl>
Cc: Arnaldo Carvalho de Melo <acme(a)redhat.com>
Cc: Paul Mackerras <paulus(a)samba.org>
Cc: Stephane Eranian <eranian(a)google.com>
Cc: Cyrill Gorcunov <gorcunov(a)gmail.com>
Cc: Zhang Yanmin <yanmin_zhang(a)linux.intel.com>
Cc: Steven Rostedt <rostedt(a)goodmis.org>
---
kernel/perf_event.c | 2 +-
kernel/trace/trace_event_perf.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index 95a56ed..c5f2306 100644
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -4292,7 +4292,7 @@ static int perf_swevent_enable(struct perf_event *event)

static void perf_swevent_disable(struct perf_event *event)
{
- hlist_del_rcu(&event->hlist_entry);
+ hlist_del_init_rcu(&event->hlist_entry);
}

static void perf_swevent_void(struct perf_event *event)
diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index 4799d70..7bc1f26 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c
@@ -122,7 +122,7 @@ int perf_trace_enable(struct perf_event *p_event)

void perf_trace_disable(struct perf_event *p_event)
{
- hlist_del_rcu(&p_event->hlist_entry);
+ hlist_del_init_rcu(&p_event->hlist_entry);
}

void perf_trace_destroy(struct perf_event *p_event)
--
1.6.2.3

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/