aboutsummaryrefslogtreecommitdiffstats
path: root/arch/i386
diff options
context:
space:
mode:
authorChris Wright <chrisw@sous-sol.org>2007-06-01 03:46:39 -0400
committerLinus Torvalds <torvalds@woody.linux-foundation.org>2007-06-01 11:18:28 -0400
commit0939c17c7bcf1c838bea4445b80a6966809a438f (patch)
tree3d93789babaab344aa9c6840e267ffe34caadc6c /arch/i386
parent24faa9eef876d39e0826a36f31ae0e8b0eeb9835 (diff)
x86: fix oprofile double free
Chuck reports that the recent fix from Andi to oprofile 6c977aad03a18019015035958c65b6729cd0574c introduces a double free. Each cpu's cpu_msrs is setup to point to cpu 0's, which causes free_msrs to free cpu 0's pointers for_each_possible_cpu. Rather than copy the pointers, do a deep copy instead. [acme@redhat.com: allocate_msrs() was using for_each_online_cpu()] Signed-off-by: Chris Wright <chrisw@sous-sol.org> Cc: Andi Kleen <ak@suse.de> Cc: Alan Cox <alan@lxorguk.ukuu.org.uk> Cc: Dave Jones <davej@redhat.com> Cc: Chuck Ebbert <cebbert@redhat.com> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Andrew Morton <akpm@linux-foundation.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Diffstat (limited to 'arch/i386')
-rw-r--r--arch/i386/oprofile/nmi_int.c12
1 files changed, 9 insertions, 3 deletions
diff --git a/arch/i386/oprofile/nmi_int.c b/arch/i386/oprofile/nmi_int.c
index a7c0783b269a..11b7a51566a8 100644
--- a/arch/i386/oprofile/nmi_int.c
+++ b/arch/i386/oprofile/nmi_int.c
@@ -154,7 +154,7 @@ static int allocate_msrs(void)
154 size_t counters_size = sizeof(struct op_msr) * model->num_counters; 154 size_t counters_size = sizeof(struct op_msr) * model->num_counters;
155 155
156 int i; 156 int i;
157 for_each_online_cpu(i) { 157 for_each_possible_cpu(i) {
158 cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL); 158 cpu_msrs[i].counters = kmalloc(counters_size, GFP_KERNEL);
159 if (!cpu_msrs[i].counters) { 159 if (!cpu_msrs[i].counters) {
160 success = 0; 160 success = 0;
@@ -211,8 +211,14 @@ static int nmi_setup(void)
211 /* Assume saved/restored counters are the same on all CPUs */ 211 /* Assume saved/restored counters are the same on all CPUs */
212 model->fill_in_addresses(&cpu_msrs[0]); 212 model->fill_in_addresses(&cpu_msrs[0]);
213 for_each_possible_cpu (cpu) { 213 for_each_possible_cpu (cpu) {
214 if (cpu != 0) 214 if (cpu != 0) {
215 cpu_msrs[cpu] = cpu_msrs[0]; 215 memcpy(cpu_msrs[cpu].counters, cpu_msrs[0].counters,
216 sizeof(struct op_msr) * model->num_counters);
217
218 memcpy(cpu_msrs[cpu].controls, cpu_msrs[0].controls,
219 sizeof(struct op_msr) * model->num_controls);
220 }
221
216 } 222 }
217 on_each_cpu(nmi_save_registers, NULL, 0, 1); 223 on_each_cpu(nmi_save_registers, NULL, 0, 1);
218 on_each_cpu(nmi_cpu_setup, NULL, 0, 1); 224 on_each_cpu(nmi_cpu_setup, NULL, 0, 1);