Re: [bisected] perf: yet another fuzzer triggered crash

[Jiri Olsa]

On Wed, Jul 03, 2013 at 09:49:29AM +0200, Peter Zijlstra wrote:
> On Tue, Jul 02, 2013 at 11:15:59PM -0400, Vince Weaver wrote:
> > 
> > OK, I have bisected this problem to the following change:
> > 
> > commit 8dc85d547285668e509f86c177bcd4ea055bcaaf
> > Author: Peter Zijlstra <a.p.zijlstra@xxxxxxxxx>
> > Date:   Thu Sep 2 16:50:03 2010 +0200
> > 
> >     perf: Multiple task contexts
> >     
> >     Provide the infrastructure for multiple task contexts.
> > 
> 
> Thanks, that narrows down the scope a bit. As it happens I was also
> narrowing down on that particular area so that's good.
> 

hi,
patch below gets rid of the warning, and probably the
crash as well

the reason seems to be when HW context is cloned based
on SW event that happened to get there because of the
HW leader, which got closed just before (fd[15] event
in the reproducer)

and the consequence is that in HW context we access
SW's cpuctx -> and thus overwriting its task_ctx variable
any time there's *sched_in routine

need to check if that does not break anything else ;-)

jirka

---
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1833bc5..1d1f030 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -7465,7 +7465,7 @@ inherit_task_group(struct perf_event *event, struct task_struct *parent,
 		 * child.
 		 */
 
-		child_ctx = alloc_perf_context(event->pmu, child);
+		child_ctx = alloc_perf_context(parent_ctx->pmu, child);
 		if (!child_ctx)
 			return -ENOMEM;
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/