releases/2.6.36.2/perf_events-fix-perf_counter_mmap-hook-in-mprotect.patch

   1 From 63bfd7384b119409685a17d5c58f0b56e5dc03da Mon Sep 17 00:00:00 2001
   2 From: Pekka Enberg <penberg@kernel.org>
   3 Date: Mon, 8 Nov 2010 21:29:07 +0200
   4 Subject: perf_events: Fix perf_counter_mmap() hook in mprotect()
   5
   6 From: Pekka Enberg <penberg@kernel.org>
   7
   8 commit 63bfd7384b119409685a17d5c58f0b56e5dc03da upstream.
   9
  10 As pointed out by Linus, commit dab5855 ("perf_counter: Add mmap event hooks to
  11 mprotect()") is fundamentally wrong as mprotect_fixup() can free 'vma' due to
  12 merging. Fix the problem by moving perf_event_mmap() hook to
  13 mprotect_fixup().
  14
  15 Note: there's another successful return path from mprotect_fixup() if old
  16 flags equal to new flags. We don't, however, need to call
  17 perf_event_mmap() there because 'perf' already knows the VMA is
  18 executable.
  19
  20 Reported-by: Dave Jones <davej@redhat.com>
  21 Analyzed-by: Linus Torvalds <torvalds@linux-foundation.org>
  22 Cc: Ingo Molnar <mingo@elte.hu>
  23 Reviewed-by: Peter Zijlstra <a.p.zijlstra@chello.nl>
  24 Signed-off-by: Pekka Enberg <penberg@kernel.org>
  25 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  26 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  27
  28 ---
  29  mm/mprotect.c |    2 +-
  30  1 file changed, 1 insertion(+), 1 deletion(-)
  31
  32 --- a/mm/mprotect.c
  33 +++ b/mm/mprotect.c
  34 @@ -211,6 +211,7 @@ success:
  35         mmu_notifier_invalidate_range_end(mm, start, end);
  36         vm_stat_account(mm, oldflags, vma->vm_file, -nrpages);
  37         vm_stat_account(mm, newflags, vma->vm_file, nrpages);
  38 +       perf_event_mmap(vma);
  39         return 0;
  40
  41  fail:
  42 @@ -299,7 +300,6 @@ SYSCALL_DEFINE3(mprotect, unsigned long,
  43                 error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
  44                 if (error)
  45                         goto out;
  46 -               perf_event_mmap(vma);
  47                 nstart = tmp;
  48
  49                 if (nstart < prev->vm_end)