2019-09-12 10:55:12

by Jiri Olsa

Subject: [PATCH] perf tools: Fix segfault in cpu_cache_level__read

We release wrong pointer on error path in
cpu_cache_level__read function, leading to
segfault:

(gdb) r record ls
Starting program: /root/perf/tools/perf/perf record ls
...
[ perf record: Woken up 1 times to write data ]
double free or corruption (out)

Thread 1 "perf" received signal SIGABRT, Aborted.
0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
(gdb) bt
#0 0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
#1 0x00007ffff7443bac in abort () from /lib64/power9/libc.so.6
#2 0x00007ffff74af8bc in __libc_message () from /lib64/power9/libc.so.6
#3 0x00007ffff74b92b8 in malloc_printerr () from /lib64/power9/libc.so.6
#4 0x00007ffff74bb874 in _int_free () from /lib64/power9/libc.so.6
#5 0x0000000010271260 in __zfree (ptr=0x7fffffffa0b0) at ../../lib/zalloc..
#6 0x0000000010139340 in cpu_cache_level__read (cache=0x7fffffffa090, cac..
#7 0x0000000010143c90 in build_caches (cntp=0x7fffffffa118, size=<optimiz..
...

Releasing the proper pointer.

Link: http://lkml.kernel.org/n/[email protected]
Signed-off-by: Jiri Olsa <[email protected]>
---
tools/perf/util/header.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index b0c34dda30a0..3527b9897b6f 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1081,7 +1081,7 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev

scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path);
if (sysfs__read_str(file, &cache->map, &len)) {
- zfree(&cache->map);
+ zfree(&cache->size);
zfree(&cache->type);
return -1;
}
--
2.21.0

2019-09-23 08:30:45

by Arnaldo Carvalho de Melo

Subject: Re: [PATCH] perf tools: Fix segfault in cpu_cache_level__read

Em Thu, Sep 12, 2019 at 12:52:35PM +0200, Jiri Olsa escreveu:
> We release wrong pointer on error path in
> cpu_cache_level__read function, leading to
> segfault:
>
> (gdb) r record ls
> Starting program: /root/perf/tools/perf/perf record ls
> ...
> [ perf record: Woken up 1 times to write data ]
> double free or corruption (out)
>
> Thread 1 "perf" received signal SIGABRT, Aborted.
> 0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
> (gdb) bt
> #0 0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
> #1 0x00007ffff7443bac in abort () from /lib64/power9/libc.so.6
> #2 0x00007ffff74af8bc in __libc_message () from /lib64/power9/libc.so.6
> #3 0x00007ffff74b92b8 in malloc_printerr () from /lib64/power9/libc.so.6
> #4 0x00007ffff74bb874 in _int_free () from /lib64/power9/libc.so.6
> #5 0x0000000010271260 in __zfree (ptr=0x7fffffffa0b0) at ../../lib/zalloc..
> #6 0x0000000010139340 in cpu_cache_level__read (cache=0x7fffffffa090, cac..
> #7 0x0000000010143c90 in build_caches (cntp=0x7fffffffa118, size=<optimiz..
> ...
>
> Releasing the proper pointer.

You forgot to add:

Fixes: 720e98b5faf1 ("perf tools: Add perf data cache feature")
Cc: [email protected]: # v4.6+

I did it, please consider doing it next time,

- Arnaldo

> Link: http://lkml.kernel.org/n/[email protected]
> Signed-off-by: Jiri Olsa <[email protected]>
> ---
> tools/perf/util/header.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index b0c34dda30a0..3527b9897b6f 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c
> @@ -1081,7 +1081,7 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
>
> scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path);
> if (sysfs__read_str(file, &cache->map, &len)) {
> - zfree(&cache->map);
> + zfree(&cache->size);
> zfree(&cache->type);
> return -1;
> }
> --
> 2.21.0

--

- Arnaldo

2019-09-23 10:08:14

by Jiri Olsa

Subject: Re: [PATCH] perf tools: Fix segfault in cpu_cache_level__read

On Fri, Sep 20, 2019 at 03:20:26PM -0300, Arnaldo Carvalho de Melo wrote:
> Em Thu, Sep 12, 2019 at 12:52:35PM +0200, Jiri Olsa escreveu:
> > We release wrong pointer on error path in
> > cpu_cache_level__read function, leading to
> > segfault:
> >
> > (gdb) r record ls
> > Starting program: /root/perf/tools/perf/perf record ls
> > ...
> > [ perf record: Woken up 1 times to write data ]
> > double free or corruption (out)
> >
> > Thread 1 "perf" received signal SIGABRT, Aborted.
> > 0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
> > (gdb) bt
> > #0 0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
> > #1 0x00007ffff7443bac in abort () from /lib64/power9/libc.so.6
> > #2 0x00007ffff74af8bc in __libc_message () from /lib64/power9/libc.so.6
> > #3 0x00007ffff74b92b8 in malloc_printerr () from /lib64/power9/libc.so.6
> > #4 0x00007ffff74bb874 in _int_free () from /lib64/power9/libc.so.6
> > #5 0x0000000010271260 in __zfree (ptr=0x7fffffffa0b0) at ../../lib/zalloc..
> > #6 0x0000000010139340 in cpu_cache_level__read (cache=0x7fffffffa090, cac..
> > #7 0x0000000010143c90 in build_caches (cntp=0x7fffffffa118, size=<optimiz..
> > ...
> >
> > Releasing the proper pointer.
>
> You forgot to add:
>
> Fixes: 720e98b5faf1 ("perf tools: Add perf data cache feature")
> Cc: [email protected]: # v4.6+
>
> I did it, please consider doing it next time,

will do, sry

jirka