Prev: [021/156] tracing: Fix warning in s_next of trace file ops
Next: [079/116] SUNRPC: Fix a potential memory leak in auth_gss
From: Greg KH on 30 Mar 2010 20:00
2.6.33-stable review patch. If anyone has any objections, please let us know.

------------------

From: Steven Rostedt <srostedt(a)redhat.com>

commit 283740c619d211e34572cc93c8cdba92ccbdb9cc upstream.

In the ftrace code that resets the ring buffer it references the
buffer with a local variable, but then uses the tr->buffer as the
parameter to reset. If the wakeup tracer is running, which can
switch the tr->buffer with the max saved buffer, this can break
the requirement of disabling the buffer before the reset.

buffer = tr->buffer;
ring_buffer_record_disable(buffer);
synchronize_sched();
__tracing_reset(tr->buffer, cpu);

If the tr->buffer is swapped, then the reset is not happening to the
buffer that was disabled. This will cause the ring buffer to fail.

Found with Li Zefan's ftrace_stress_test.

Reported-by: Lai Jiangshan <laijs(a)cn.fujitsu.com>
Signed-off-by: Steven Rostedt <rostedt(a)goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh(a)suse.de>

---
kernel/trace/trace.c | 8 ++++----
1 file changed, 4 insertions(+), 4 deletions(-)

--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -747,10 +747,10 @@ out:
mutex_unlock(&trace_types_lock);
}

-static void __tracing_reset(struct trace_array *tr, int cpu)
+static void __tracing_reset(struct ring_buffer *buffer, int cpu)
{
ftrace_disable_cpu();
- ring_buffer_reset_cpu(tr->buffer, cpu);
+ ring_buffer_reset_cpu(buffer, cpu);
ftrace_enable_cpu();
}

@@ -762,7 +762,7 @@ void tracing_reset(struct trace_array *t

/* Make sure all commits have finished */
synchronize_sched();
- __tracing_reset(tr, cpu);
+ __tracing_reset(buffer, cpu);

ring_buffer_record_enable(buffer);
}
@@ -780,7 +780,7 @@ void tracing_reset_online_cpus(struct tr
tr->time_start = ftrace_now(tr->cpu);

for_each_online_cpu(cpu)
- __tracing_reset(tr, cpu);
+ __tracing_reset(buffer, cpu);

ring_buffer_record_enable(buffer);
}


--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: [021/156] tracing: Fix warning in s_next of trace file ops
Next: [079/116] SUNRPC: Fix a potential memory leak in auth_gss