For some cases, the callchain provided by the kernel may be
empty. So, the callchain ip filtering code will cause a crash
if we do not check whether the struct ip_callchain pointer is
NULL before accessing any members.
This can be observed on a powerpc64le system running Fedora 27
as shown below.
# perf record -b -e cycles:u ls
Before applying this patch:
# perf report --branch-history
perf: Segmentation fault
-------- backtrace --------
perf[0x1027615c]
linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8]
perf(arch_skip_callchain_idx+0x44)[0x10257c58]
perf[0x1017f2e4]
perf(thread__resolve_callchain+0x124)[0x1017ff5c]
perf(sample__resolve_callchain+0xf0)[0x10172788]
...
After applying this patch:
# perf report --branch-history
Samples: 25 of event 'cycles:u', Event count (approx.): 2306870
Overhead Source:Line Symbol Shared Object
+ 11.60% _init+35736 [.] _init ls
+ 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so
+ 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so
+ 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so
+ 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so
+ 8.83% _init+236 [.] _init ls
...
Reported-by: Ravi Bangoria <[email protected]>
Signed-off-by: Sandipan Das <[email protected]>
---
tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
index 3598b8b75d27..ef5d59a5742e 100644
--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain)
u64 ip;
u64 skip_slot = -1;
- if (chain->nr < 3)
+ if (!chain || chain->nr < 3)
return skip_slot;
ip = chain->ips[2];
--
2.14.3
On 06/11/2018 04:10 PM, Sandipan Das wrote:
> For some cases, the callchain provided by the kernel may be
> empty. So, the callchain ip filtering code will cause a crash
> if we do not check whether the struct ip_callchain pointer is
> NULL before accessing any members.
>
> This can be observed on a powerpc64le system running Fedora 27
> as shown below.
>
> # perf record -b -e cycles:u ls
>
> Before applying this patch:
>
> # perf report --branch-history
>
> perf: Segmentation fault
> -------- backtrace --------
> perf[0x1027615c]
> linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8]
> perf(arch_skip_callchain_idx+0x44)[0x10257c58]
> perf[0x1017f2e4]
> perf(thread__resolve_callchain+0x124)[0x1017ff5c]
> perf(sample__resolve_callchain+0xf0)[0x10172788]
> ...
>
> After applying this patch:
>
> # perf report --branch-history
>
> Samples: 25 of event 'cycles:u', Event count (approx.): 2306870
> Overhead Source:Line Symbol Shared Object
> + 11.60% _init+35736 [.] _init ls
> + 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so
> + 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so
> + 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so
> + 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so
> + 8.83% _init+236 [.] _init ls
> ...
>
> Reported-by: Ravi Bangoria <[email protected]>
> Signed-off-by: Sandipan Das <[email protected]>
Acked-by: Ravi Bangoria <[email protected]>
Em Tue, Jun 12, 2018 at 09:28:09AM +0530, Ravi Bangoria escreveu:
> On 06/11/2018 04:10 PM, Sandipan Das wrote:
> > For some cases, the callchain provided by the kernel may be
> > empty. So, the callchain ip filtering code will cause a crash
> > if we do not check whether the struct ip_callchain pointer is
> > NULL before accessing any members.
<SNIP>
> > Reported-by: Ravi Bangoria <[email protected]>
> Acked-by: Ravi Bangoria <[email protected]>
Thanks,
- Arnaldo
Commit-ID: 143c99f6ac6812d23254e80844d6e34be897d3e1
Gitweb: https://git.kernel.org/tip/143c99f6ac6812d23254e80844d6e34be897d3e1
Author: Sandipan Das <[email protected]>
AuthorDate: Mon, 11 Jun 2018 16:10:49 +0530
Committer: Arnaldo Carvalho de Melo <[email protected]>
CommitDate: Mon, 25 Jun 2018 11:59:35 -0300
perf report powerpc: Fix crash if callchain is empty
For some cases, the callchain provided by the kernel may be empty. So,
the callchain ip filtering code will cause a crash if we do not check
whether the struct ip_callchain pointer is NULL before accessing any
members.
This can be observed on a powerpc64le system running Fedora 27 as shown
below.
# perf record -b -e cycles:u ls
Before:
# perf report --branch-history
perf: Segmentation fault
-------- backtrace --------
perf[0x1027615c]
linux-vdso64.so.1(__kernel_sigtramp_rt64+0x0)[0x7fff856304d8]
perf(arch_skip_callchain_idx+0x44)[0x10257c58]
perf[0x1017f2e4]
perf(thread__resolve_callchain+0x124)[0x1017ff5c]
perf(sample__resolve_callchain+0xf0)[0x10172788]
...
After:
# perf report --branch-history
Samples: 25 of event 'cycles:u', Event count (approx.): 2306870
Overhead Source:Line Symbol Shared Object
+ 11.60% _init+35736 [.] _init ls
+ 9.84% strcoll_l.c:137 [.] __strcoll_l libc-2.26.so
+ 9.16% memcpy.S:175 [.] __memcpy_power7 libc-2.26.so
+ 9.01% gconv_charset.h:54 [.] _nl_find_locale libc-2.26.so
+ 8.87% dl-addr.c:52 [.] _dl_addr libc-2.26.so
+ 8.83% _init+236 [.] _init ls
...
Reported-by: Ravi Bangoria <[email protected]>
Signed-off-by: Sandipan Das <[email protected]>
Acked-by: Ravi Bangoria <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Naveen N. Rao <[email protected]>
Cc: Sukadev Bhattiprolu <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
---
tools/perf/arch/powerpc/util/skip-callchain-idx.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/tools/perf/arch/powerpc/util/skip-callchain-idx.c b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
index 3598b8b75d27..ef5d59a5742e 100644
--- a/tools/perf/arch/powerpc/util/skip-callchain-idx.c
+++ b/tools/perf/arch/powerpc/util/skip-callchain-idx.c
@@ -243,7 +243,7 @@ int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain)
u64 ip;
u64 skip_slot = -1;
- if (chain->nr < 3)
+ if (!chain || chain->nr < 3)
return skip_slot;
ip = chain->ips[2];