Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1640392 > unrolled thread

[PATCH] perf/core: Avoid removing shared pmu_context on unregister

Back to article view | Back to linux.kernel

Contents

  [PATCH] perf/core: Avoid removing shared pmu_context on unregister Chris Wilson <chris@chris-wilson.co.uk> - 2017-05-12 12:50 +0200
    [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister Chris Wilson <chris@chris-wilson.co.uk> - 2017-05-12 13:50 +0200
      Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister David Carrillo-Cisneros <davidcc@google.com> - 2017-05-12 22:50 +0200
      Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister David Carrillo-Cisneros <davidcc@google.com> - 2017-05-12 22:50 +0200
        Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on  unregister Chris Wilson <chris@chris-wilson.co.uk> - 2017-05-12 23:00 +0200
          Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister David Carrillo-Cisneros <davidcc@google.com> - 2017-05-12 23:30 +0200
    Re: [PATCH] perf/core: Avoid removing shared pmu_context on  unregister Chris Wilson <chris@chris-wilson.co.uk> - 2017-05-12 13:50 +0200

#1640392 — [PATCH] perf/core: Avoid removing shared pmu_context on unregister

In commit 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu"),
the search for another user of the pmu_cpu_context was removed, and so
we unconditionally free it during perf_pmu_unregister. This leads to
random corruption later and a BUG at mm/percpu.c:689.

Fixes: 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: David Carrillo-Cisneros <davidcc@google.com>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: <stable@vger.kernel.org> # v4.11+
---
 kernel/events/core.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index aaefaa27e1a6..e62b6207925c 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -9005,7 +9005,8 @@ void perf_pmu_unregister(struct pmu *pmu)
 		device_del(pmu->dev);
 		put_device(pmu->dev);
 	}
-	free_pmu_context(pmu);
+	if (!find_pmu_context(pmu->task_ctx_nr))
+		free_pmu_context(pmu);
 }
 EXPORT_SYMBOL_GPL(perf_pmu_unregister);
 
-- 
2.11.0

[toc] | [next] | [standalone]

#1640405 — [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister

In commit 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu"),
the search for another user of the pmu_cpu_context was removed, and so
we unconditionally free it during perf_pmu_unregister. This leads to
random corruption later and a BUG at mm/percpu.c:689.

v2: Check for shared pmu_contexts under the mutex.

Fixes: 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu")
Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: David Carrillo-Cisneros <davidcc@google.com>
Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: <stable@vger.kernel.org> # v4.11+
---
 kernel/events/core.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index aaefaa27e1a6..4f60f66b35ad 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8983,10 +8983,12 @@ EXPORT_SYMBOL_GPL(perf_pmu_register);
 void perf_pmu_unregister(struct pmu *pmu)
 {
 	int remove_device;
+	int remove_context;
 
 	mutex_lock(&pmus_lock);
 	remove_device = pmu_bus_running;
 	list_del_rcu(&pmu->entry);
+	remove_context = !find_pmu_context(pmu->task_ctx_nr);
 	mutex_unlock(&pmus_lock);
 
 	/*
@@ -9005,7 +9007,8 @@ void perf_pmu_unregister(struct pmu *pmu)
 		device_del(pmu->dev);
 		put_device(pmu->dev);
 	}
-	free_pmu_context(pmu);
+	if (remove_context)
+		free_pmu_context(pmu);
 }
 EXPORT_SYMBOL_GPL(perf_pmu_unregister);
 
-- 
2.11.0

[toc] | [prev] | [next] | [standalone]

#1640741 — Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister

> Shouldn't be cleaner to keep the check in find_pmu_context, just as it
I meant in free_pmu_context

[toc] | [prev] | [next] | [standalone]

#1640742 — Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister

On Fri, May 12, 2017 at 4:45 AM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> In commit 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu"),
> the search for another user of the pmu_cpu_context was removed, and so
> we unconditionally free it during perf_pmu_unregister. This leads to
> random corruption later and a BUG at mm/percpu.c:689.
>
> v2: Check for shared pmu_contexts under the mutex.
>
> Fixes: 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: David Carrillo-Cisneros <davidcc@google.com>
> Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: <stable@vger.kernel.org> # v4.11+
> ---
>  kernel/events/core.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index aaefaa27e1a6..4f60f66b35ad 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -8983,10 +8983,12 @@ EXPORT_SYMBOL_GPL(perf_pmu_register);
>  void perf_pmu_unregister(struct pmu *pmu)
>  {
>         int remove_device;
> +       int remove_context;
>
>         mutex_lock(&pmus_lock);
>         remove_device = pmu_bus_running;
>         list_del_rcu(&pmu->entry);
> +       remove_context = !find_pmu_context(pmu->task_ctx_nr);
>         mutex_unlock(&pmus_lock);
>
>         /*
> @@ -9005,7 +9007,8 @@ void perf_pmu_unregister(struct pmu *pmu)
>                 device_del(pmu->dev);
>                 put_device(pmu->dev);
>         }
> -       free_pmu_context(pmu);
> +       if (remove_context)
> +               free_pmu_context(pmu);
>  }

Shouldn't be cleaner to keep the check in find_pmu_context, just as it
was before commit 1fd7e4169954 ("perf/core: Remove
perf_cpu_context::unique_pmu")?

(Code below untested)

diff --git a/kernel/events/core.c b/kernel/events/core.c
index 6e75a5c9412d..50d90cbf8418 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -8857,7 +8857,8 @@ static struct perf_cpu_context __percpu
*find_pmu_context(int ctxn)
 static void free_pmu_context(struct pmu *pmu)
 {
        mutex_lock(&pmus_lock);
-       free_percpu(pmu->pmu_cpu_context);
+       if (!find_pmu_context(pmu->task_ctx_nr))
+               free_percpu(pmu->pmu_cpu_context);
        mutex_unlock(&pmus_lock);
 }

[toc] | [prev] | [next] | [standalone]

#1640747 — Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister

On Fri, May 12, 2017 at 01:40:37PM -0700, David Carrillo-Cisneros wrote:
> On Fri, May 12, 2017 at 4:45 AM, Chris Wilson <chris@chris-wilson.co.uk> wrote:
> > In commit 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu"),
> > the search for another user of the pmu_cpu_context was removed, and so
> > we unconditionally free it during perf_pmu_unregister. This leads to
> > random corruption later and a BUG at mm/percpu.c:689.
> >
> > v2: Check for shared pmu_contexts under the mutex.
> >
> > Fixes: 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu")
> > Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> > Cc: David Carrillo-Cisneros <davidcc@google.com>
> > Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
> > Cc: Ingo Molnar <mingo@redhat.com>
> > Cc: <stable@vger.kernel.org> # v4.11+
> > ---
> >  kernel/events/core.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/kernel/events/core.c b/kernel/events/core.c
> > index aaefaa27e1a6..4f60f66b35ad 100644
> > --- a/kernel/events/core.c
> > +++ b/kernel/events/core.c
> > @@ -8983,10 +8983,12 @@ EXPORT_SYMBOL_GPL(perf_pmu_register);
> >  void perf_pmu_unregister(struct pmu *pmu)
> >  {
> >         int remove_device;
> > +       int remove_context;
> >
> >         mutex_lock(&pmus_lock);
> >         remove_device = pmu_bus_running;
> >         list_del_rcu(&pmu->entry);
> > +       remove_context = !find_pmu_context(pmu->task_ctx_nr);
> >         mutex_unlock(&pmus_lock);
> >
> >         /*
> > @@ -9005,7 +9007,8 @@ void perf_pmu_unregister(struct pmu *pmu)
> >                 device_del(pmu->dev);
> >                 put_device(pmu->dev);
> >         }
> > -       free_pmu_context(pmu);
> > +       if (remove_context)
> > +               free_pmu_context(pmu);
> >  }
> 
> Shouldn't be cleaner to keep the check in find_pmu_context, just as it
> was before commit 1fd7e4169954 ("perf/core: Remove
> perf_cpu_context::unique_pmu")?
> 
> (Code below untested)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index 6e75a5c9412d..50d90cbf8418 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -8857,7 +8857,8 @@ static struct perf_cpu_context __percpu
> *find_pmu_context(int ctxn)
>  static void free_pmu_context(struct pmu *pmu)
>  {
>         mutex_lock(&pmus_lock);
> -       free_percpu(pmu->pmu_cpu_context);
> +       if (!find_pmu_context(pmu->task_ctx_nr))
> +               free_percpu(pmu->pmu_cpu_context);
>         mutex_unlock(&pmus_lock);

We have the problem that find_pmu_context looks for a matching
task_ctx_nr, but if a second pmu was registered since our list_del and
before our search, we would wrongly conclude that it was using our pmu
context, but it had actually allocated a new one for itself.

We could do a search by pmu_cpu_context instead, but seems overkill
compared to the remove_context approach.
-Chris

-- 
Chris Wilson, Intel Open Source Technology Centre

[toc] | [prev] | [next] | [standalone]

#1640767 — Re: [PATCH v2] perf/core: Avoid removing shared pmu_context on unregister

>>
>> Shouldn't be cleaner to keep the check in find_pmu_context, just as it
>> was before commit 1fd7e4169954 ("perf/core: Remove
>> perf_cpu_context::unique_pmu")?
>>
>> (Code below untested)
>>
>> diff --git a/kernel/events/core.c b/kernel/events/core.c
>> index 6e75a5c9412d..50d90cbf8418 100644
>> --- a/kernel/events/core.c
>> +++ b/kernel/events/core.c
>> @@ -8857,7 +8857,8 @@ static struct perf_cpu_context __percpu
>> *find_pmu_context(int ctxn)
>>  static void free_pmu_context(struct pmu *pmu)
>>  {
>>         mutex_lock(&pmus_lock);
>> -       free_percpu(pmu->pmu_cpu_context);
>> +       if (!find_pmu_context(pmu->task_ctx_nr))
>> +               free_percpu(pmu->pmu_cpu_context);
>>         mutex_unlock(&pmus_lock);
>
> We have the problem that find_pmu_context looks for a matching
> task_ctx_nr, but if a second pmu was registered since our list_del and
> before our search, we would wrongly conclude that it was using our pmu
> context, but it had actually allocated a new one for itself.
>

Makes sense. It'd be nice to have that in a comment. Other than that I
am fine with v2.

David

[toc] | [prev] | [next] | [standalone]

#1640407 — Re: [PATCH] perf/core: Avoid removing shared pmu_context on unregister

On Fri, May 12, 2017 at 11:40:32AM +0100, Chris Wilson wrote:
> In commit 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu"),
> the search for another user of the pmu_cpu_context was removed, and so
> we unconditionally free it during perf_pmu_unregister. This leads to
> random corruption later and a BUG at mm/percpu.c:689.
> 
> Fixes: 1fd7e4169954 ("perf/core: Remove perf_cpu_context::unique_pmu")
> Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
> Cc: David Carrillo-Cisneros <davidcc@google.com>
> Cc: Peter Zijlstra (Intel) <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: <stable@vger.kernel.org> # v4.11+
> ---
>  kernel/events/core.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/kernel/events/core.c b/kernel/events/core.c
> index aaefaa27e1a6..e62b6207925c 100644
> --- a/kernel/events/core.c
> +++ b/kernel/events/core.c
> @@ -9005,7 +9005,8 @@ void perf_pmu_unregister(struct pmu *pmu)
>  		device_del(pmu->dev);
>  		put_device(pmu->dev);
>  	}
> -	free_pmu_context(pmu);
> +	if (!find_pmu_context(pmu->task_ctx_nr))

Bleh, that find should be under some guard, such as the mutex we held
ealier.

> +		free_pmu_context(pmu);
>  }
>  EXPORT_SYMBOL_GPL(perf_pmu_unregister);
>  
> -- 
> 2.11.0
> 

-- 
Chris Wilson, Intel Open Source Technology Centre

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web