summaryrefslogtreecommitdiffstats
path: root/kernel
diff options
context:
space:
mode:
authorSteven Rostedt (Red Hat) <rostedt@goodmis.org>2013-03-12 11:32:32 -0400
committerSteven Rostedt <rostedt@goodmis.org>2013-03-12 11:56:33 -0400
commit2721e72dd10f71a3ba90f59781becf02638aa0d9 (patch)
treece9ce816859204d843fff6917f19d16585ab3782 /kernel
parent1abccd7419de9829bcdf9ab1f81d5f6cf74d55d3 (diff)
downloadlinux-2721e72dd10f71a3ba90f59781becf02638aa0d9.tar.gz
linux-2721e72dd10f71a3ba90f59781becf02638aa0d9.tar.bz2
linux-2721e72dd10f71a3ba90f59781becf02638aa0d9.zip
tracing: Fix race in snapshot swapping
Although the swap is wrapped with a spin_lock, the assignment of the temp buffer used to swap is not within that lock. It needs to be moved into that lock, otherwise two swaps happening on two different CPUs, can end up using the wrong temp buffer to assign in the swap. Luckily, all current callers of the swap function appear to have their own locks. But in case something is added that allows two different callers to call the swap, then there's a chance that this race can trigger and corrupt the buffers. New code is coming soon that will allow for this race to trigger. I've Cc'd stable, so this bug will not show up if someone backports one of the changes that can trigger this bug. Cc: stable@vger.kernel.org Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Diffstat (limited to 'kernel')
-rw-r--r--kernel/trace/trace.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index 1f835a83cb2c..53df2839bb93 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -704,7 +704,7 @@ __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
void
update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
{
- struct ring_buffer *buf = tr->buffer;
+ struct ring_buffer *buf;
if (trace_stop_count)
return;
@@ -719,6 +719,7 @@ update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
arch_spin_lock(&ftrace_max_lock);
+ buf = tr->buffer;
tr->buffer = max_tr.buffer;
max_tr.buffer = buf;