This contains two fixes.
The first is a long standing bug that causes bogus data to show up in the refcnt field of the module_refcnt tracepoint. It was introduced by a merge conflict resolution back in 2.6.35-rc days. The result should be refcnt = incs - decs, but instead it did refcnt = incs + decs. The second fix is to a bug that was introduced in this merge window that allowed for a tracepoint funcs pointer to be used after it was freed. Moving the location of where the probes are released solved the problem. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAABAgAGBQJTa/GQAAoJEKQekfcNnQGuGGUIAJCkrDZdnliE6f6Ur8aXJoX7 gjkXRMmCjLM/X8yQc1H8YwDbSgaTQNmeyQvBbBZ1hUQBaMf5ft4KuFYMGvQRk3jp ZheQVumSzsQfO+yp5dRmzJ6H2G0BCInxq9VZyufZkCPUGsMyiIc+7+SGHEfjMgmW 9XFWyfSr09thVlGanr+OTLXfwFm7GMD9nohLKXh9dhi/tO/gHq6lI83HK42Y1bWG 4fZWJjO5GgCVbW4RanB6yr9RIe8NESKl37JYsAZX61iAvT8/mqIYGWx0i/DEGN5Q ap3WW5QPALLUlvUVgI9Um0KOrotbmKtnRwPeHYDmSQODwuKj5veiLXxL9XdHPLU= =lt0T -----END PGP SIGNATURE----- Merge tag 'trace-fixes-v3.15-rc4-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace Pull tracing fixes from Steven Rostedt: "This contains two fixes. The first is a long standing bug that causes bogus data to show up in the refcnt field of the module_refcnt tracepoint. It was introduced by a merge conflict resolution back in 2.6.35-rc days. The result should be 'refcnt = incs - decs', but instead it did 'refcnt = incs + decs'. The second fix is to a bug that was introduced in this merge window that allowed for a tracepoint funcs pointer to be used after it was freed. Moving the location of where the probes are released solved the problem" * tag 'trace-fixes-v3.15-rc4-v2' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-trace: tracepoint: Fix use of tracepoint funcs after rcu free trace: module: Maintain a valid user count
This commit is contained in:
commit
f322e26238
|
@ -80,7 +80,7 @@ DECLARE_EVENT_CLASS(module_refcnt,
|
|||
|
||||
TP_fast_assign(
|
||||
__entry->ip = ip;
|
||||
__entry->refcnt = __this_cpu_read(mod->refptr->incs) + __this_cpu_read(mod->refptr->decs);
|
||||
__entry->refcnt = __this_cpu_read(mod->refptr->incs) - __this_cpu_read(mod->refptr->decs);
|
||||
__assign_str(name, mod->name);
|
||||
),
|
||||
|
||||
|
|
|
@ -188,7 +188,6 @@ static int tracepoint_add_func(struct tracepoint *tp,
|
|||
WARN_ON_ONCE(1);
|
||||
return PTR_ERR(old);
|
||||
}
|
||||
release_probes(old);
|
||||
|
||||
/*
|
||||
* rcu_assign_pointer has a smp_wmb() which makes sure that the new
|
||||
|
@ -200,6 +199,7 @@ static int tracepoint_add_func(struct tracepoint *tp,
|
|||
rcu_assign_pointer(tp->funcs, tp_funcs);
|
||||
if (!static_key_enabled(&tp->key))
|
||||
static_key_slow_inc(&tp->key);
|
||||
release_probes(old);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
@ -221,7 +221,6 @@ static int tracepoint_remove_func(struct tracepoint *tp,
|
|||
WARN_ON_ONCE(1);
|
||||
return PTR_ERR(old);
|
||||
}
|
||||
release_probes(old);
|
||||
|
||||
if (!tp_funcs) {
|
||||
/* Removed last function */
|
||||
|
@ -232,6 +231,7 @@ static int tracepoint_remove_func(struct tracepoint *tp,
|
|||
static_key_slow_dec(&tp->key);
|
||||
}
|
||||
rcu_assign_pointer(tp->funcs, tp_funcs);
|
||||
release_probes(old);
|
||||
return 0;
|
||||
}
|
||||
|
||||
|
|
Loading…
Reference in New Issue