From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755432AbcCDNn0 (ORCPT ); Fri, 4 Mar 2016 08:43:26 -0500 Received: from mga04.intel.com ([192.55.52.120]:62426 "EHLO mga04.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751213AbcCDNnX (ORCPT ); Fri, 4 Mar 2016 08:43:23 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.22,535,1449561600"; d="scan'208";a="901292832" From: Alexander Shishkin To: Peter Zijlstra Cc: Ingo Molnar , linux-kernel@vger.kernel.org, vince@deater.net, eranian@google.com, Arnaldo Carvalho de Melo , Alexander Shishkin Subject: [PATCH v2 1/5] perf: Refuse to begin aux transaction after aux_mmap_count drops Date: Fri, 4 Mar 2016 15:42:45 +0200 Message-Id: <1457098969-21595-2-git-send-email-alexander.shishkin@linux.intel.com> X-Mailer: git-send-email 2.7.0 In-Reply-To: <1457098969-21595-1-git-send-email-alexander.shishkin@linux.intel.com> References: <1457098969-21595-1-git-send-email-alexander.shishkin@linux.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org When ring buffer's aux area is unmapped and aux_mmap_count drops to zero, new aux transactions into this buffer can still be started, even though the buffer in en route to deallocation. This patch adds a check to perf_aux_output_begin() for aux_mmap_count being zero, in which case there is no point starting new transactions, in other words, the ring buffers that pass a certain point in perf_mmap_close will not have their events sending new data, which clears path for freeing those buffers' pages right there and then, provided that no active transactions are holding the aux reference. Signed-off-by: Alexander Shishkin --- kernel/events/ring_buffer.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/kernel/events/ring_buffer.c b/kernel/events/ring_buffer.c index 1faad2cfdb..af5fbc7e91 100644 --- a/kernel/events/ring_buffer.c +++ b/kernel/events/ring_buffer.c @@ -288,6 +288,13 @@ void *perf_aux_output_begin(struct perf_output_handle *handle, goto err; /* + * If rb::aux_mmap_count is zero (and rb_has_aux() above went through), + * the aux buffer is in perf_mmap_close(), about to get free'd. + */ + if (!atomic_read(&rb->aux_mmap_count)) + goto err; + + /* * Nesting is not supported for AUX area, make sure nested * writers are caught early */ -- 2.7.0