perf: Fix software event overflow, CVE-2011-2918

[linux-flexiantxendom0-natty.git] / kernel / perf_event.c

diff --git a/kernel/perf_event.c b/kernel/perf_event.c
index b22a2ef..478ec5d 100644 (file)
--- a/kernel/perf_event.c
+++ b/kernel/perf_event.c
@@ -62,7 +62,8 @@ static struct srcu_struct pmus_srcu;
  */
 int sysctl_perf_event_paranoid __read_mostly = 1;
 
-int sysctl_perf_event_mlock __read_mostly = 512; /* 'free' kb per user */
+/* Minimum for 512 kiB + 1 user control page */
+int sysctl_perf_event_mlock __read_mostly = 512 + (PAGE_SIZE / 1024); /* 'free' kiB per user */
 
 /*
  * max perf event sample rate
@@ -4446,11 +4447,8 @@ static int __perf_event_overflow(struct perf_event *event, int nmi,
        if (events && atomic_dec_and_test(&event->event_limit)) {
                ret = 1;
                event->pending_kill = POLL_HUP;
-               if (nmi) {
-                       event->pending_disable = 1;
-                       irq_work_queue(&event->pending);
-               } else
-                       perf_event_disable(event);
+               event->pending_disable = 1;
+               irq_work_queue(&event->pending);
        }
 
        if (event->overflow_handler)
@@ -5916,6 +5914,11 @@ SYSCALL_DEFINE5(perf_event_open,
                goto err_alloc;
        }
 
+       if (task) {
+               put_task_struct(task);
+               task = NULL;
+       }
+
        /*
         * Look up the group leader (we will attach this event to it):
         */
@@ -6115,17 +6118,20 @@ __perf_event_exit_task(struct perf_event *child_event,
                         struct perf_event_context *child_ctx,
                         struct task_struct *child)
 {
-       struct perf_event *parent_event;
+       if (child_event->parent) {
+               raw_spin_lock_irq(&child_ctx->lock);
+               perf_group_detach(child_event);
+               raw_spin_unlock_irq(&child_ctx->lock);
+       }
 
        perf_event_remove_from_context(child_event);
 
-       parent_event = child_event->parent;
        /*
-        * It can happen that parent exits first, and has events
+        * It can happen that the parent exits first, and has events
         * that are still around due to the child reference. These
-        * events need to be zapped - but otherwise linger.
+        * events need to be zapped.
         */
-       if (parent_event) {
+       if (child_event->parent) {
                sync_child_event(child_event, child);
                free_event(child_event);
        }