On Wed, Feb 20, 2013 at 7:16 PM, Tejun Heo <tj@xxxxxxxxxx> wrote: > On Wed, Feb 20, 2013 at 07:09:36PM +0200, Andy Shevchenko wrote: >> The guilty commit is cc5b5f6 "events: convert to idr_alloc()" together with >> f49318a "idr: implement lookup hint". In our case the idr_alloc is never called, but idr_find is. The hint field is never initialized and could not be dereferenced. > > Ah, right, ->hint is uninitialized at the beginning. > >> The proposed fix uses the idr_slowpath call which reflects old behaviour. >> >> Signed-off-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxxxxxxxx> >> Reported-by: Kirill A. Shutemov <kirill.shutemov@xxxxxxxxxxxxxxx> >> --- >> kernel/events/core.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/kernel/events/core.c b/kernel/events/core.c >> index 624e53f..20421ea 100644 >> --- a/kernel/events/core.c >> +++ b/kernel/events/core.c >> @@ -6076,7 +6076,7 @@ struct pmu *perf_init_event(struct perf_event *event) >> idx = srcu_read_lock(&pmus_srcu); >> >> rcu_read_lock(); >> - pmu = idr_find(&pmu_idr, event->attr.type); >> + pmu = idr_find_slowpath(&pmu_idr, event->attr.type); > > But I don't think this is the right thing to do. I'm working on > proper fix for idr_find(). Will post soon. Check my v2 -- With Best Regards, Andy Shevchenko -- To unsubscribe from this list: send the line "unsubscribe linux-next" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
