Patch "perf top: Fix TUI exit screen refresh race condition" has been added to the 5.15-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    perf top: Fix TUI exit screen refresh race condition

to the 5.15-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     perf-top-fix-tui-exit-screen-refresh-race-condition.patch
and it can be found in the queue-5.15 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit a905d6053ba71300556fbc81850d9d50abbc0bea
Author: yaowenbin <yaowenbin1@xxxxxxxxxx>
Date:   Wed Dec 29 16:55:19 2021 +0800

    perf top: Fix TUI exit screen refresh race condition
    
    [ Upstream commit 64f18d2d043015b3f835ce4c9f3beb97cfd19b6e ]
    
    When the following command is executed several times, a coredump file is
    generated.
    
            $ timeout -k 9 5 perf top -e task-clock
            *******
            *******
            *******
            0.01%  [kernel]                  [k] __do_softirq
            0.01%  libpthread-2.28.so        [.] __pthread_mutex_lock
            0.01%  [kernel]                  [k] __ll_sc_atomic64_sub_return
            double free or corruption (!prev) perf top --sort comm,dso
            timeout: the monitored command dumped core
    
    When we terminate "perf top" using sending signal method,
    SLsmg_reset_smg() called. SLsmg_reset_smg() resets the SLsmg screen
    management routines by freeing all memory allocated while it was active.
    
    However SLsmg_reinit_smg() maybe be called by another thread.
    
    SLsmg_reinit_smg() will free the same memory accessed by
    SLsmg_reset_smg(), thus it results in a double free.
    
    SLsmg_reinit_smg() is called already protected by ui__lock, so we fix
    the problem by adding pthread_mutex_trylock of ui__lock when calling
    SLsmg_reset_smg().
    
    Signed-off-by: Wenyu Liu <liuwenyu7@xxxxxxxxxx>
    Tested-by: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
    Cc: Alexander Shishkin <alexander.shishkin@xxxxxxxxxxxxxxx>
    Cc: Jiri Olsa <jolsa@xxxxxxxxxx>
    Cc: Mark Rutland <mark.rutland@xxxxxxx>
    Cc: Namhyung Kim <namhyung@xxxxxxxxxx>
    Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
    Cc: wuxu.wu@xxxxxxxxxx
    Link: http://lore.kernel.org/lkml/a91e3943-7ddc-f5c0-a7f5-360f073c20e6@xxxxxxxxxx
    Signed-off-by: Hewenliang <hewenliang4@xxxxxxxxxx>
    Signed-off-by: yaowenbin <yaowenbin1@xxxxxxxxxx>
    Signed-off-by: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
    Stable-dep-of: 769e6a1e15bd ("perf ui browser: Don't save pointer to stack memory")
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/tools/perf/ui/tui/setup.c b/tools/perf/ui/tui/setup.c
index e9bfe856a5dee..b1be59b4e2a4f 100644
--- a/tools/perf/ui/tui/setup.c
+++ b/tools/perf/ui/tui/setup.c
@@ -170,9 +170,11 @@ void ui__exit(bool wait_for_ok)
 				    "Press any key...", 0);
 
 	SLtt_set_cursor_visibility(1);
-	SLsmg_refresh();
-	SLsmg_reset_smg();
+	if (!pthread_mutex_trylock(&ui__lock)) {
+		SLsmg_refresh();
+		SLsmg_reset_smg();
+		pthread_mutex_unlock(&ui__lock);
+	}
 	SLang_reset_tty();
-
 	perf_error__unregister(&perf_tui_eops);
 }