diff options
| author | Chris Wright <chrisw@sous-sol.org> | 2007-06-01 00:46:39 -0700 |
|---|---|---|
| committer | Chris Wright <chrisw@sous-sol.org> | 2007-06-11 11:36:49 -0700 |
| commit | 99c390976523058d3a4263567a9067f4b0f7556b (patch) | |
| tree | 6c491353d27ffad3e9f775661007a00c0d337099 | |
| parent | 5eba323639c5964dab344eba4f8613c1e724be6a (diff) | |
| download | linux-stable-99c390976523058d3a4263567a9067f4b0f7556b.tar.gz linux-stable-99c390976523058d3a4263567a9067f4b0f7556b.tar.bz2 linux-stable-99c390976523058d3a4263567a9067f4b0f7556b.zip | |
[PATCH] x86: fix oprofile double free
Chuck reports that the recent fix from Andi to oprofile
6c977aad03a18019015035958c65b6729cd0574c introduces a double free. Each
cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free
cpu 0's pointers for_each_possible_cpu. Rather than copy the pointers, do
a deep copy instead.
[acme@redhat.com: allocate_msrs() was using for_each_online_cpu()]
Signed-off-by: Chris Wright <chrisw@sous-sol.org>
Cc: Andi Kleen <ak@suse.de>
Cc: Alan Cox <alan@lxorguk.ukuu.org.uk>
Cc: Dave Jones <davej@redhat.com>
Cc: Chuck Ebbert <cebbert@redhat.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | arch/i386/oprofile/nmi_int.c | 12 |
1 files changed, 9 insertions, 3 deletions
diff --git a/arch/i386/oprofile/nmi_int.c b/arch/i386/oprofile/nmi_int.c index 0b0b0fc3dbd8..bd00876e8606 100644 --- a/arch/i386/oprofile/nmi_int.c +++ b/arch/i386/oprofile/nmi_int.c @@ -154,7 +154,7 @@ static int allocate_msrs(void) size_t counters_size = sizeof(struct op_msr) * model->num_counters; int i; - for_each_online_cpu(i) { + for_each_possible_cpu(i) { cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL); if (!cpu_msrs[i].counters) { success = 0; @@ -211,8 +211,14 @@ static int nmi_setup(void) /* Assume saved/restored counters are the same on all CPUs */ model->fill_in_addresses(&cpu_msrs[0]); for_each_possible_cpu (cpu) { - if (cpu != 0) - cpu_msrs[cpu] = cpu_msrs[0]; + if (cpu != 0) { + memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters, + sizeof(struct op_msr) * model->num_counters); + + memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls, + sizeof(struct op_msr) * model->num_controls); + } + } on_each_cpu(nmi_save_registers, NULL, 0, 1); on_each_cpu(nmi_cpu_setup, NULL, 0, 1); |