From: Greg Kroah-Hartman Date: Mon, 14 Feb 2022 07:25:39 +0000 (+0100) Subject: 4.19-stable patches X-Git-Tag: v4.9.302~11 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ddc3f5b0471500aa0f480e1b0c8fab49dc9bb72a;p=thirdparty%2Fkernel%2Fstable-queue.git 4.19-stable patches added patches: perf-fix-list-corruption-in-perf_cgroup_switch.patch --- diff --git a/queue-4.19/perf-fix-list-corruption-in-perf_cgroup_switch.patch b/queue-4.19/perf-fix-list-corruption-in-perf_cgroup_switch.patch new file mode 100644 index 00000000000..b214fbf42d6 --- /dev/null +++ b/queue-4.19/perf-fix-list-corruption-in-perf_cgroup_switch.patch @@ -0,0 +1,52 @@ +From 5f4e5ce638e6a490b976ade4a40017b40abb2da0 Mon Sep 17 00:00:00 2001 +From: Song Liu +Date: Thu, 3 Feb 2022 16:40:57 -0800 +Subject: perf: Fix list corruption in perf_cgroup_switch() + +From: Song Liu + +commit 5f4e5ce638e6a490b976ade4a40017b40abb2da0 upstream. + +There's list corruption on cgrp_cpuctx_list. This happens on the +following path: + + perf_cgroup_switch: list_for_each_entry(cgrp_cpuctx_list) + cpu_ctx_sched_in + ctx_sched_in + ctx_pinned_sched_in + merge_sched_in + perf_cgroup_event_disable: remove the event from the list + +Use list_for_each_entry_safe() to allow removing an entry during +iteration. + +Fixes: 058fe1c0440e ("perf/core: Make cgroup switch visit only cpuctxs with cgroup events") +Signed-off-by: Song Liu +Reviewed-by: Rik van Riel +Signed-off-by: Peter Zijlstra (Intel) +Link: https://lkml.kernel.org/r/20220204004057.2961252-1-song@kernel.org +Signed-off-by: Greg Kroah-Hartman +--- + kernel/events/core.c | 4 ++-- + 1 file changed, 2 insertions(+), 2 deletions(-) + +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -798,7 +798,7 @@ static DEFINE_PER_CPU(struct list_head, + */ + static void perf_cgroup_switch(struct task_struct *task, int mode) + { +- struct perf_cpu_context *cpuctx; ++ struct perf_cpu_context *cpuctx, *tmp; + struct list_head *list; + unsigned long flags; + +@@ -809,7 +809,7 @@ static void perf_cgroup_switch(struct ta + local_irq_save(flags); + + list = this_cpu_ptr(&cgrp_cpuctx_list); +- list_for_each_entry(cpuctx, list, cgrp_cpuctx_entry) { ++ list_for_each_entry_safe(cpuctx, tmp, list, cgrp_cpuctx_entry) { + WARN_ON_ONCE(cpuctx->ctx.nr_cgroups == 0); + + perf_ctx_lock(cpuctx, cpuctx->task_ctx); diff --git a/queue-4.19/series b/queue-4.19/series index 2732323465b..cb8951ada79 100644 --- a/queue-4.19/series +++ b/queue-4.19/series @@ -46,3 +46,4 @@ usb-serial-cp210x-add-ncr-retail-io-box-id.patch usb-serial-cp210x-add-cpi-bulk-coin-recycler-id.patch seccomp-invalidate-seccomp-mode-to-catch-death-failures.patch hwmon-dell-smm-speed-up-setting-of-fan-speed.patch +perf-fix-list-corruption-in-perf_cgroup_switch.patch