From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753040AbaEBUpI (ORCPT ); Fri, 2 May 2014 16:45:08 -0400 Received: from www.linutronix.de ([62.245.132.108]:44294 "EHLO Galois.linutronix.de" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752336AbaEBUpG (ORCPT ); Fri, 2 May 2014 16:45:06 -0400 Date: Fri, 2 May 2014 22:45:09 +0200 (CEST) From: Thomas Gleixner To: Vince Weaver cc: Peter Zijlstra , Ingo Molnar , linux-kernel@vger.kernel.org, Steven Rostedt Subject: Re: [perf] more perf_fuzzer memory corruption In-Reply-To: Message-ID: References: <20140501150948.GR11096@twins.programming.kicks-ass.net> <20140502154217.GW11096@twins.programming.kicks-ass.net> <20140502162234.GX11096@twins.programming.kicks-ass.net> <20140502172731.GK30445@twins.programming.kicks-ass.net> User-Agent: Alpine 2.02 (DEB 1266 2009-07-14) MIME-Version: 1.0 Content-Type: TEXT/PLAIN; charset=US-ASCII X-Linutronix-Spam-Score: -1.0 X-Linutronix-Spam-Level: - X-Linutronix-Spam-Status: No , -1.0 points, 5.0 required, ALL_TRUSTED=-1,SHORTCIRCUIT=-0.0001 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Fri, 2 May 2014, Vince Weaver wrote: > On Fri, 2 May 2014, Thomas Gleixner wrote: > > > Hmm, and where comes the WARN_ON in _free_event() from? That's not in > > Peters last patch. > > ahh, you're right :( My fault. I gave the new patch and the previous > patch similar names and applied the wrong one. > > OK the proper patch has been running the quick reproducer for a bit > without triggering the issue, I'll let it run a bit more and then upgrade > to full fuzzing. If you do that, please add the patch below. Thanks, tglx Index: linux-2.6/kernel/events/core.c =================================================================== --- linux-2.6.orig/kernel/events/core.c +++ linux-2.6/kernel/events/core.c @@ -7378,7 +7378,7 @@ __perf_event_exit_task(struct perf_event struct perf_event_context *child_ctx, struct task_struct *child) { - perf_remove_from_context(child_event, !!child_event->parent); + perf_remove_from_context(child_event, true); /* * It can happen that the parent exits first, and has events