tracing/perf: Fix double put of trace event when init fails

If in perf_trace_event_init(), the perf_trace_event_open() fails, then it
will call perf_trace_event_unreg() which will not only unregister the perf
trace event, but will also call the put() function of the tp_event.

The problem here is that the trace_event_try_get_ref() is called by the
caller of perf_trace_event_init() and if perf_trace_event_init() returns a
failure, it will then call trace_event_put(). But since the
perf_trace_event_unreg() already called the trace_event_put() function, it
triggers a WARN_ON().

 WARNING: CPU: 1 PID: 30309 at kernel/trace/trace_dynevent.c:46 trace_event_dyn_put_ref+0x15/0x20

If perf_trace_event_reg() does not call the trace_event_try_get_ref() then
the perf_trace_event_unreg() should not be calling trace_event_put(). This
breaks symmetry and causes bugs like these.

Pull out the trace_event_put() from perf_trace_event_unreg() and call it
in the locations that perf_trace_event_unreg() is called. This not only
fixes this bug, but also brings back the proper symmetry of the reg/unreg
vs get/put logic.

Link: https://lore.kernel.org/all/cover.1660347763.git.kjlx@templeofstupid.com/
Link: https://lkml.kernel.org/r/20220816192817.43d5e17f@gandalf.local.home

Cc: stable@vger.kernel.org
Fixes: 1d18538e ("tracing: Have dynamic events have a ref counter")
Reported-by: default avatarKrister Johansen <kjlx@templeofstupid.com>
Reviewed-by: default avatarKrister Johansen <kjlx@templeofstupid.com>
Tested-by: default avatarKrister Johansen <kjlx@templeofstupid.com>
Acked-by: default avatarJiri Olsa <jolsa@kernel.org>
Signed-off-by: default avatarSteven Rostedt (Google) <rostedt@goodmis.org>
parent d8a64313
...@@ -157,7 +157,7 @@ static void perf_trace_event_unreg(struct perf_event *p_event) ...@@ -157,7 +157,7 @@ static void perf_trace_event_unreg(struct perf_event *p_event)
int i; int i;
if (--tp_event->perf_refcount > 0) if (--tp_event->perf_refcount > 0)
goto out; return;
tp_event->class->reg(tp_event, TRACE_REG_PERF_UNREGISTER, NULL); tp_event->class->reg(tp_event, TRACE_REG_PERF_UNREGISTER, NULL);
...@@ -176,8 +176,6 @@ static void perf_trace_event_unreg(struct perf_event *p_event) ...@@ -176,8 +176,6 @@ static void perf_trace_event_unreg(struct perf_event *p_event)
perf_trace_buf[i] = NULL; perf_trace_buf[i] = NULL;
} }
} }
out:
trace_event_put_ref(tp_event);
} }
static int perf_trace_event_open(struct perf_event *p_event) static int perf_trace_event_open(struct perf_event *p_event)
...@@ -241,6 +239,7 @@ void perf_trace_destroy(struct perf_event *p_event) ...@@ -241,6 +239,7 @@ void perf_trace_destroy(struct perf_event *p_event)
mutex_lock(&event_mutex); mutex_lock(&event_mutex);
perf_trace_event_close(p_event); perf_trace_event_close(p_event);
perf_trace_event_unreg(p_event); perf_trace_event_unreg(p_event);
trace_event_put_ref(p_event->tp_event);
mutex_unlock(&event_mutex); mutex_unlock(&event_mutex);
} }
...@@ -292,6 +291,7 @@ void perf_kprobe_destroy(struct perf_event *p_event) ...@@ -292,6 +291,7 @@ void perf_kprobe_destroy(struct perf_event *p_event)
mutex_lock(&event_mutex); mutex_lock(&event_mutex);
perf_trace_event_close(p_event); perf_trace_event_close(p_event);
perf_trace_event_unreg(p_event); perf_trace_event_unreg(p_event);
trace_event_put_ref(p_event->tp_event);
mutex_unlock(&event_mutex); mutex_unlock(&event_mutex);
destroy_local_trace_kprobe(p_event->tp_event); destroy_local_trace_kprobe(p_event->tp_event);
...@@ -347,6 +347,7 @@ void perf_uprobe_destroy(struct perf_event *p_event) ...@@ -347,6 +347,7 @@ void perf_uprobe_destroy(struct perf_event *p_event)
mutex_lock(&event_mutex); mutex_lock(&event_mutex);
perf_trace_event_close(p_event); perf_trace_event_close(p_event);
perf_trace_event_unreg(p_event); perf_trace_event_unreg(p_event);
trace_event_put_ref(p_event->tp_event);
mutex_unlock(&event_mutex); mutex_unlock(&event_mutex);
destroy_local_trace_uprobe(p_event->tp_event); destroy_local_trace_uprobe(p_event->tp_event);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment