Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753569AbbEKMLs (ORCPT ); Mon, 11 May 2015 08:11:48 -0400 Received: from szxga01-in.huawei.com ([58.251.152.64]:31028 "EHLO szxga01-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751592AbbEKMLr (ORCPT ); Mon, 11 May 2015 08:11:47 -0400 Subject: Re: [PATCH 2/2] perf trace: Fix segmentfault on perf trace To: Arnaldo Carvalho de Melo References: <1428399071-7141-1-git-send-email-hekuang@huawei.com> <1428399071-7141-2-git-send-email-hekuang@huawei.com> <20150407123633.GG11983@kernel.org> <55249D3D.7020706@huawei.com> CC: , , , , From: He Kuang Message-ID: <55509C62.6020608@huawei.com> Date: Mon, 11 May 2015 20:11:14 +0800 User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:38.0) Gecko/20100101 Thunderbird/38.0 MIME-Version: 1.0 In-Reply-To: <55249D3D.7020706@huawei.com> Content-Type: text/plain; charset="windows-1252"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [10.110.54.65] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4168 Lines: 122 Hi, Arnaldo On 2015/4/8 11:15, He Kuang wrote: > Hi, Arnaldo > On 2015/4/7 20:36, Arnaldo Carvalho de Melo wrote: >> Em Tue, Apr 07, 2015 at 05:31:11PM +0800, He Kuang escreveu: >>> After perf_evlist__filter_pollfd() filters out fds and releases >>> perf_mmap by using perf_evlist__mmap_put(), refcnt of perf_mmap hits 1 >>> then perf_evlist__mmap_consume() will do the final unmap. In this >>> condition, perf_evlist__mmap_read() will crash by referencing invalid >>> mmap. Put refcnt check before use. >>> >>> Can be reproduced as following: >> After applying 1/2 in this series and trying to reproduce I couldn't, it >> works, looking at the code... >> >> Let me get my head around this, idea was that after all fds associated >> with a mmap would be closed, i.e. the perf_mmap->refcnt hits zero, then >> we would have to drain whatever was left in the mmap, but looking again >> that doesn't look like that is what is doing, becaue in filter_pollfd we >> will munmap it before being able to "drain" it, as all mmaps were >> closed, thus filter_pollfd returned zero... > > In function __perf_evlist__mmap(), refcnt is initialized to 2, see > commit: > 823969860329 ("perf evlist: Refcount mmaps") > > After filter_pollfd, perf_mmap->refcnt is 1 not 0. > > perf_evlist__filter_pollfd() -- refcnt=1 > draining = true > if (perf_evlist__mmap_read() != NULL) > perf_evlist__mmap_consume() -- unmap, refcnt = 0 > perf_evlist__mmap_read() -- segfault > else > exit > > I noticed that this issue also exists in builtin-record.c, but it > checks before mmap_read(): > > if (rec->evlist->mmap[i].base) { > if (record__mmap_read(rec, i, draining) != 0) { > > So we can either do the check outside > builtin-trace.c:perf_evlist__mmap_read() like what > builtin-record.c do or inside. What's your opinion? I found the issue is still there, so ping... >> >> Reading on, thanks for the patch! >> >> - Arnaldo >> >>> $ perf trace --duration 1.0 ls >>> ... >>> perf: Segmentation fault >>> Obtained 14 stack frames. >>> ./perf(dump_stack+0x2e) [0x503c2d] >>> ./perf(sighandler_dump_stack+0x2e) >>> [0x503d0c] >>> /lib64/libc.so.6(+0x34df0) [0x7f5fd9a4adf0] >>> ./perf() [0x4a8fda] >>> ./perf(perf_evlist__mmap_read+0x56) >>> [0x4aae93] >>> ./perf() [0x470b28] >>> ./perf(cmd_trace+0xada) [0x4727bd] >>> ./perf() [0x49c4f4] >>> ./perf() [0x49c74d] >>> ./perf() [0x49c899] >>> ./perf(main+0x23b) >>> [0x49cbfa] >>> /lib64/libc.so.6(__libc_start_main+0xf5) >>> [0x7f5fd9a377b5] >>> ./perf() [0x434ea5] >>> [(nil)] >>> >>> Signed-off-by: He Kuang >>> --- >>> tools/perf/util/evlist.c | 13 ++++++++++--- >>> 1 file changed, 10 insertions(+), 3 deletions(-) >>> >>> diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c >>> index 76ef7ee..9d36433 100644 >>> --- a/tools/perf/util/evlist.c >>> +++ b/tools/perf/util/evlist.c >>> @@ -634,11 +634,18 @@ static struct perf_evsel >>> *perf_evlist__event2evsel(struct perf_evlist *evlist, >>> union perf_event *perf_evlist__mmap_read(struct perf_evlist >>> *evlist, int idx) >>> { >>> struct perf_mmap *md = &evlist->mmap[idx]; >>> - unsigned int head = perf_mmap__read_head(md); >>> - unsigned int old = md->prev; >>> - unsigned char *data = md->base + page_size; >>> + unsigned int head; >>> + unsigned int old; >>> + unsigned char *data; >>> union perf_event *event = NULL; >>> + if (md == NULL || md->refcnt == 0) >>> + return NULL; >>> + >>> + head = perf_mmap__read_head(md); >>> + old = md->prev; >>> + data = md->base + page_size; >>> + >>> if (evlist->overwrite) { >>> /* >>> * If we're further behind than half the buffer, there's a >>> chance >>> -- >>> 2.3.3.220.g9ab698f >> > > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/