perf: Fix sys_perf_event_open() race against self
authorPeter Zijlstra <peterz@infradead.org>
Fri, 20 May 2022 18:38:06 +0000 (20:38 +0200)
committerLinus Torvalds <torvalds@linux-foundation.org>
Fri, 20 May 2022 18:44:00 +0000 (08:44 -1000)
commit3ac6487e584a1eb54071dbe1212e05b884136704
tree07b3b0617e264ae3ef5d188275e7991120859ee2
parent3b5e1590a26713a8c76896f0f1b99f52ec24e72f
perf: Fix sys_perf_event_open() race against self

Norbert reported that it's possible to race sys_perf_event_open() such
that the looser ends up in another context from the group leader,
triggering many WARNs.

The move_group case checks for races against itself, but the
!move_group case doesn't, seemingly relying on the previous
group_leader->ctx == ctx check. However, that check is racy due to not
holding any locks at that time.

Therefore, re-check the result after acquiring locks and bailing
if they no longer match.

Additionally, clarify the not_move_group case from the
move_group-vs-move_group race.

Fixes: f63a8daa5812 ("perf: Fix event->ctx locking")
Reported-by: Norbert Slusarek <nslusarek@gmx.net>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
kernel/events/core.c