When converting from atomic_t to refcount_t we didn't follow the usual
step of initializing it to one before taking any new reference, which
trips over checking if taking a reference for a freed refcount_t, fix
it.
Brendan's report:
---
It's 4.12-rc7, with node v4.4.1. I'm building 4.13-rc1 now, as I hit
what I think is another unrelated perf bug and I'm starting to wonder
what else is broken on that version:
(root) /mnt/src/linux-4.12-rc7/tools/perf # ./perf record -F 99 -a -e
cpu-clock --cgroup=docker/
f9e9d5df065b14646e8a11edc837a13877fd90c171137b2ba3feb67a0201cb65
-g
perf: /mnt/src/linux-4.12-rc7/tools/include/linux/refcount.h:108:
refcount_inc: Assertion `!(!refcount_inc_not_zero(r))' failed.
Aborted
that used to work...
---
Testing it:
Before:
# perf stat -e cycles -C 0 --cgroup /
perf: /home/acme/git/linux/tools/include/linux/refcount.h:108: refcount_inc: Assertion `!(!refcount_inc_not_zero(r))' failed.
Aborted (core dumped)
#
After:
# perf stat -e cycles -C 0 --cgroup /
^C
Performance counter stats for 'CPU(s) 0':
132,081,393 cycles /
2.
492942763 seconds time elapsed
#
Reported-by: Brendan Gregg <[email protected]>
Acked-by: Elena Reshetova <[email protected]>
Cc: Alexander Shishkin <[email protected]>
Cc: David Ahern <[email protected]>
Cc: David Carrillo-Cisneros <[email protected]>
Cc: Kees Kook <[email protected]>
Cc: Krister Johansen <[email protected]>
Cc: Paul Turner <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Stephane Eranian <[email protected]>
Cc: Sudeep Holla <[email protected]>
Cc: Thomas-Mich Richter <[email protected]>
Cc: Wang Nan <[email protected]>
Fixes: 79c5fe6db8c7 ("perf cgroup: Convert cgroup_sel.refcnt from atomic_t to refcount_t")
Link: http://lkml.kernel.org/n/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
cgrp = counter->cgrp;
if (!cgrp)
continue;
- if (!strcmp(cgrp->name, str))
+ if (!strcmp(cgrp->name, str)) {
+ refcount_inc(&cgrp->refcnt);
break;
+ }
cgrp = NULL;
}
return -1;
cgrp->name = str;
+ refcount_set(&cgrp->refcnt, 1);
cgrp->fd = open_cgroup(str);
if (cgrp->fd == -1) {
goto found;
n++;
}
- if (refcount_read(&cgrp->refcnt) == 0)
+ if (refcount_dec_and_test(&cgrp->refcnt))
free(cgrp);
return -1;
found:
- refcount_inc(&cgrp->refcnt);
counter->cgrp = cgrp;
return 0;
}