diff options
| author | John Dias <joaodias@google.com> | 2016-11-09 11:03:57 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-01-10 14:18:20 -0800 |
| commit | 5145fb9b0073d2e40eac76699fba16695c0dac78 (patch) | |
| tree | 8e64750f4c1561bac3538558a392551f083abe44 /kernel | |
| parent | 0a8e939a4e57d86da88c9856cd266447fc45ea85 (diff) | |
perf: don't leave group_entry on sibling list (use-after-free)
When perf_group_detach is called on a group leader,
it should empty its sibling list. Otherwise, when
a sibling is later deallocated, list_del_event()
removes the sibling's group_entry from its current
list, which can be the now-deallocated group leader's
sibling list (use-after-free bug).
Bug: 32402548
Change-Id: I99f6bc97c8518df1cb0035814368012ba72ab1f1
Signed-off-by: John Dias <joaodias@google.com>
Git-repo: https://android.googlesource.com/kernel/msm
Git-commit: 6b6cfb2362f09553b46b3b7e5684b16b6e53e373
Signed-off-by: Dennis Cagle <d-cagle@codeaurora.org>
Diffstat (limited to 'kernel')
| -rw-r--r-- | kernel/events/core.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/kernel/events/core.c b/kernel/events/core.c index 446dbad75e60..4a78fba5085e 100644 --- a/kernel/events/core.c +++ b/kernel/events/core.c @@ -1489,10 +1489,17 @@ static void perf_group_detach(struct perf_event *event) * If this was a group event with sibling events then * upgrade the siblings to singleton events by adding them * to whatever list we are on. + * If this isn't on a list, make sure we still remove the sibling's + * group_entry from this sibling_list; otherwise, when that sibling + * is later deallocated, it will try to remove itself from this + * sibling_list, which may well have been deallocated already, + * resulting in a use-after-free. */ list_for_each_entry_safe(sibling, tmp, &event->sibling_list, group_entry) { if (list) list_move_tail(&sibling->group_entry, list); + else + list_del_init(&sibling->group_entry); sibling->group_leader = sibling; /* Inherit group flags from the previous leader */ |