From d7971d81fed601028ee003095b0790c7c669a703 Mon Sep 17 00:00:00 2001 From: Peter Zijlstra Date: Fri, 26 Aug 2011 09:59:37 +0100 Subject: [PATCH] perf: Fix software event overflow, CVE-2011-2918 BugLink: http://bugs.launchpad.net/bugs/834121 The below patch is for -stable only, upstream has a much larger patch that contains the below hunk in commit a8b0ca17b80e92faab46ee7179ba9e99ccb61233 Vince found that under certain circumstances software event overflows go wrong and deadlock. Avoid trying to delete a timer from the timer callback. Reported-by: Vince Weaver Signed-off-by: Peter Zijlstra Signed-off-by: Greg Kroah-Hartman CVE-2011-2918 backported from commit 462fee3af72df0de7b60b96c525ffe8baf4db0f0 stable-3.0.y Signed-off-by: Andy Whitcroft Acked-by: Stefan Bader Signed-off-by: Tim Gardner --- kernel/perf_event.c | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/kernel/perf_event.c b/kernel/perf_event.c index b2536bd..478ec5d 100644 --- a/kernel/perf_event.c +++ b/kernel/perf_event.c @@ -4447,11 +4447,8 @@ static int __perf_event_overflow(struct perf_event *event, int nmi, if (events && atomic_dec_and_test(&event->event_limit)) { ret = 1; event->pending_kill = POLL_HUP; - if (nmi) { - event->pending_disable = 1; - irq_work_queue(&event->pending); - } else - perf_event_disable(event); + event->pending_disable = 1; + irq_work_queue(&event->pending); } if (event->overflow_handler) -- 1.7.10.4