2015-12-02 11:29:23

by Wang Nan

Subject: [PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

If feed perf a symbol filter in cmdline and the result is empty,
pressing 'Enter' in the hist browser causes crash:

# ./perf report perf.data <-- Common mistake for beginners

Then press 'Enter':

perf: Segmentation fault
-------- backtrace --------
/home/wangnan/perf[0x53e578]
/lib64/libc.so.6(+0x3545f)[0x7f76bafe045f]
/home/wangnan/perf[0x539dd4]
/home/wangnan/perf(perf_evlist__tui_browse_hists+0x96)[0x53d216]
/home/wangnan/perf(cmd_report+0x1b9f)[0x442c7f]
/home/wangnan/perf[0x47efa2]
/home/wangnan/perf(main+0x5f5)[0x432fa5]
/lib64/libc.so.6(__libc_start_main+0xf4)[0x7f76bafccbd4]
/home/wangnan/perf[0x4330d4]

This is because 'perf.data' is interperted as a symbol filter, and the
result is empty, so selection is empty. However,
hist_browser__toggle_fold() forgets to check it.

This patch simply return faluse when selection is NULL.

Signed-off-by: Wang Nan <[email protected]>
Cc: Arnaldo Carvalho de Melo <[email protected]>
Cc: Namhyung Kim <[email protected]>
---
tools/perf/ui/browsers/hists.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index dcdcbaf..33da341 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -337,9 +337,12 @@ static bool hist_browser__toggle_fold(struct hist_browser *browser)
{
struct hist_entry *he = browser->he_selection;
struct map_symbol *ms = browser->selection;
- struct callchain_list *cl = container_of(ms, struct callchain_list, ms);
+ struct callchain_list *cl = ms ? container_of(ms, struct callchain_list, ms) : NULL;
bool has_children;

+ if (!ms)
+ return false;
+
if (ms == &he->ms)
has_children = hist_entry__toggle_fold(he);
else
--
1.8.3.4

2015-12-02 15:50:20

by Namhyung Kim

Subject: Re: [PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

Hi,

On Wed, Dec 02, 2015 at 11:28:52AM +0000, Wang Nan wrote:
> If feed perf a symbol filter in cmdline and the result is empty,
> pressing 'Enter' in the hist browser causes crash:
>
> # ./perf report perf.data <-- Common mistake for beginners
>
> Then press 'Enter':
>
> perf: Segmentation fault
> -------- backtrace --------
> /home/wangnan/perf[0x53e578]
> /lib64/libc.so.6(+0x3545f)[0x7f76bafe045f]
> /home/wangnan/perf[0x539dd4]
> /home/wangnan/perf(perf_evlist__tui_browse_hists+0x96)[0x53d216]
> /home/wangnan/perf(cmd_report+0x1b9f)[0x442c7f]
> /home/wangnan/perf[0x47efa2]
> /home/wangnan/perf(main+0x5f5)[0x432fa5]
> /lib64/libc.so.6(__libc_start_main+0xf4)[0x7f76bafccbd4]
> /home/wangnan/perf[0x4330d4]
>
> This is because 'perf.data' is interperted as a symbol filter, and the
> result is empty, so selection is empty. However,
> hist_browser__toggle_fold() forgets to check it.
>
> This patch simply return faluse when selection is NULL.

s/faluse/false/

>
> Signed-off-by: Wang Nan <[email protected]>
> Cc: Arnaldo Carvalho de Melo <[email protected]>

Acked-by: Namhyung Kim <[email protected]>

One nitpick below..

> ---
> tools/perf/ui/browsers/hists.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
> index dcdcbaf..33da341 100644
> --- a/tools/perf/ui/browsers/hists.c
> +++ b/tools/perf/ui/browsers/hists.c
> @@ -337,9 +337,12 @@ static bool hist_browser__toggle_fold(struct hist_browser *browser)
> {
> struct hist_entry *he = browser->he_selection;
> struct map_symbol *ms = browser->selection;
> - struct callchain_list *cl = container_of(ms, struct callchain_list, ms);
> + struct callchain_list *cl = ms ? container_of(ms, struct callchain_list, ms) : NULL;

I think this line is not needed as container_of doesn't make a pointer
dereference by itself. Just checking below is enough IMHO.

Thanks,
Namhyung


> bool has_children;
>
> + if (!ms)
> + return false;
> +
> if (ms == &he->ms)
> has_children = hist_entry__toggle_fold(he);
> else
> --
> 1.8.3.4
>

2015-12-03 02:20:19

by Wang Nan

Subject: Re: [PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

On 2015/12/2 23:49, Namhyung Kim wrote:
> Hi,
>
> On Wed, Dec 02, 2015 at 11:28:52AM +0000, Wang Nan wrote:
>> If feed perf a symbol filter in cmdline and the result is empty,
>> pressing 'Enter' in the hist browser causes crash:
>>
>> # ./perf report perf.data <-- Common mistake for beginners
>>
>> Then press 'Enter':
>>
>> perf: Segmentation fault
>> -------- backtrace --------
>> /home/wangnan/perf[0x53e578]
>> /lib64/libc.so.6(+0x3545f)[0x7f76bafe045f]
>> /home/wangnan/perf[0x539dd4]
>> /home/wangnan/perf(perf_evlist__tui_browse_hists+0x96)[0x53d216]
>> /home/wangnan/perf(cmd_report+0x1b9f)[0x442c7f]
>> /home/wangnan/perf[0x47efa2]
>> /home/wangnan/perf(main+0x5f5)[0x432fa5]
>> /lib64/libc.so.6(__libc_start_main+0xf4)[0x7f76bafccbd4]
>> /home/wangnan/perf[0x4330d4]
>>
>> This is because 'perf.data' is interperted as a symbol filter, and the
>> result is empty, so selection is empty. However,
>> hist_browser__toggle_fold() forgets to check it.
>>
>> This patch simply return faluse when selection is NULL.
> s/faluse/false/
>
>> Signed-off-by: Wang Nan <[email protected]>
>> Cc: Arnaldo Carvalho de Melo <[email protected]>
> Acked-by: Namhyung Kim <[email protected]>
>
> One nitpick below..
>
>> ---
>> tools/perf/ui/browsers/hists.c | 5 ++++-
>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
>> index dcdcbaf..33da341 100644
>> --- a/tools/perf/ui/browsers/hists.c
>> +++ b/tools/perf/ui/browsers/hists.c
>> @@ -337,9 +337,12 @@ static bool hist_browser__toggle_fold(struct hist_browser *browser)
>> {
>> struct hist_entry *he = browser->he_selection;
>> struct map_symbol *ms = browser->selection;
>> - struct callchain_list *cl = container_of(ms, struct callchain_list, ms);
>> + struct callchain_list *cl = ms ? container_of(ms, struct callchain_list, ms) : NULL;
> I think this line is not needed as container_of doesn't make a pointer
> dereference by itself. Just checking below is enough IMHO.

I know it. Add it only for correctness.

Will be removed.

Thank you.

> Thanks,
> Namhyung
>
>
>> bool has_children;
>>
>> + if (!ms)
>> + return false;
>> +
>> if (ms == &he->ms)
>> has_children = hist_entry__toggle_fold(he);
>> else
>> --
>> 1.8.3.4
>>

2015-12-06 18:24:13

by Arnaldo Carvalho de Melo

Subject: Re: [PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

Em Thu, Dec 03, 2015 at 12:49:42AM +0900, Namhyung Kim escreveu:
> Hi,
>
> On Wed, Dec 02, 2015 at 11:28:52AM +0000, Wang Nan wrote:
> > If feed perf a symbol filter in cmdline and the result is empty,
> > pressing 'Enter' in the hist browser causes crash:
> >
> > # ./perf report perf.data <-- Common mistake for beginners
> >
> > Then press 'Enter':
> >
> > perf: Segmentation fault
> > -------- backtrace --------
> > /home/wangnan/perf[0x53e578]
> > /lib64/libc.so.6(+0x3545f)[0x7f76bafe045f]
> > /home/wangnan/perf[0x539dd4]
> > /home/wangnan/perf(perf_evlist__tui_browse_hists+0x96)[0x53d216]
> > /home/wangnan/perf(cmd_report+0x1b9f)[0x442c7f]
> > /home/wangnan/perf[0x47efa2]
> > /home/wangnan/perf(main+0x5f5)[0x432fa5]
> > /lib64/libc.so.6(__libc_start_main+0xf4)[0x7f76bafccbd4]
> > /home/wangnan/perf[0x4330d4]
> >
> > This is because 'perf.data' is interperted as a symbol filter, and the
> > result is empty, so selection is empty. However,
> > hist_browser__toggle_fold() forgets to check it.
> >
> > This patch simply return faluse when selection is NULL.
>
> s/faluse/false/

Fixed this and the 'interperted' and some other text details, and also
the container_of usage as reported by you below.

Thanks!

- Arnaldo

> >
> > Signed-off-by: Wang Nan <[email protected]>
> > Cc: Arnaldo Carvalho de Melo <[email protected]>
>
> Acked-by: Namhyung Kim <[email protected]>
>
> One nitpick below..
>
> > ---
> > tools/perf/ui/browsers/hists.c | 5 ++++-
> > 1 file changed, 4 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
> > index dcdcbaf..33da341 100644
> > --- a/tools/perf/ui/browsers/hists.c
> > +++ b/tools/perf/ui/browsers/hists.c
> > @@ -337,9 +337,12 @@ static bool hist_browser__toggle_fold(struct hist_browser *browser)
> > {
> > struct hist_entry *he = browser->he_selection;
> > struct map_symbol *ms = browser->selection;
> > - struct callchain_list *cl = container_of(ms, struct callchain_list, ms);
> > + struct callchain_list *cl = ms ? container_of(ms, struct callchain_list, ms) : NULL;
>
> I think this line is not needed as container_of doesn't make a pointer
> dereference by itself. Just checking below is enough IMHO.

Agreed, changing this.

> Thanks,
> Namhyung
>
>
> > bool has_children;
> >
> > + if (!ms)
> > + return false;
> > +
> > if (ms == &he->ms)
> > has_children = hist_entry__toggle_fold(he);
> > else
> > --
> > 1.8.3.4
> >