oprofile: warn on freeing event buffer too early

[safe/jmp/linux-2.6] / drivers / oprofile / event_buffer.c

diff --git a/drivers/oprofile/event_buffer.c b/drivers/oprofile/event_buffer.c
index d962ba0..5df60a6 100644 (file)
--- a/drivers/oprofile/event_buffer.c
+++ b/drivers/oprofile/event_buffer.c
@@ -35,12 +35,23 @@ static size_t buffer_pos;
 /* atomic_t because wait_event checks it outside of buffer_mutex */
 static atomic_t buffer_ready = ATOMIC_INIT(0);
 
-/* Add an entry to the event buffer. When we
- * get near to the end we wake up the process
- * sleeping on the read() of the file.
+/*
+ * Add an entry to the event buffer. When we get near to the end we
+ * wake up the process sleeping on the read() of the file. To protect
+ * the event_buffer this function may only be called when buffer_mutex
+ * is set.
  */
 void add_event_entry(unsigned long value)
 {
+       /*
+        * This shouldn't happen since all workqueues or handlers are
+        * canceled or flushed before the event buffer is freed.
+        */
+       if (!event_buffer) {
+               WARN_ON_ONCE(1);
+               return;
+       }
+
        if (buffer_pos == buffer_size) {
                atomic_inc(&oprofile_stats.event_lost_overflow);
                return;
@@ -69,32 +80,32 @@ void wake_up_buffer_waiter(void)
 
 int alloc_event_buffer(void)
 {
-       int err = -ENOMEM;
        unsigned long flags;
 
        spin_lock_irqsave(&oprofilefs_lock, flags);
-       buffer_size = fs_buffer_size;
-       buffer_watershed = fs_buffer_watershed;
+       buffer_size = oprofile_buffer_size;
+       buffer_watershed = oprofile_buffer_watershed;
        spin_unlock_irqrestore(&oprofilefs_lock, flags);
 
        if (buffer_watershed >= buffer_size)
                return -EINVAL;
 
+       buffer_pos = 0;
        event_buffer = vmalloc(sizeof(unsigned long) * buffer_size);
        if (!event_buffer)
-               goto out;
+               return -ENOMEM;
 
-       err = 0;
-out:
-       return err;
+       return 0;
 }
 
 
 void free_event_buffer(void)
 {
+       mutex_lock(&buffer_mutex);
        vfree(event_buffer);
-
+       buffer_pos = 0;
        event_buffer = NULL;
+       mutex_unlock(&buffer_mutex);
 }
 
 
@@ -105,7 +116,7 @@ static int event_buffer_open(struct inode *inode, struct file *file)
        if (!capable(CAP_SYS_ADMIN))
                return -EPERM;
 
-       if (test_and_set_bit(0, &buffer_opened))
+       if (test_and_set_bit_lock(0, &buffer_opened))
                return -EBUSY;
 
        /* Register as a user of dcookies
@@ -129,7 +140,7 @@ static int event_buffer_open(struct inode *inode, struct file *file)
 fail:
        dcookie_unregister(file->private_data);
 out:
-       clear_bit(0, &buffer_opened);
+       __clear_bit_unlock(0, &buffer_opened);
        return err;
 }
 
@@ -141,7 +152,7 @@ static int event_buffer_release(struct inode *inode, struct file *file)
        dcookie_unregister(file->private_data);
        buffer_pos = 0;
        atomic_set(&buffer_ready, 0);
-       clear_bit(0, &buffer_opened);
+       __clear_bit_unlock(0, &buffer_opened);
        return 0;
 }
 
@@ -167,6 +178,12 @@ static ssize_t event_buffer_read(struct file *file, char __user *buf,
 
        mutex_lock(&buffer_mutex);
 
+       /* May happen if the buffer is freed during pending reads. */
+       if (!event_buffer) {
+               retval = -EINTR;
+               goto out;
+       }
+
        atomic_set(&buffer_ready, 0);
 
        retval = -EFAULT;