Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751971AbcJBDNx (ORCPT ); Sat, 1 Oct 2016 23:13:53 -0400 Received: from hapkido.dreamhost.com ([66.33.216.122]:55813 "EHLO hapkido.dreamhost.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751294AbcJBDNr (ORCPT ); Sat, 1 Oct 2016 23:13:47 -0400 Date: Sat, 1 Oct 2016 20:13:36 -0700 From: Krister Johansen To: Arnaldo Carvalho de Melo Cc: linux-kernel@vger.kernel.org Subject: [PATCH perf/core] perf script: fix a use after free crash. Message-ID: <20161002031336.GA2635@templeofstupid.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline User-Agent: Mutt/1.5.24 (2015-08-30) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 4839 Lines: 167 If dso__load_kcore frees all of the existing maps, but one has already been attached to a callchain cursor node, then we can get a SIGSEGV in any function that happens to try to use this cursor with the invalid map. Use the existing map refcount mechanism to forestall cleanup of a map until the cursor iterates past the node. Signed-off-by: Krister Johansen --- tools/perf/util/callchain.c | 12 ++++++++++-- tools/perf/util/callchain.h | 20 ++++++++++++++++++++ tools/perf/util/hist.c | 4 ++++ 3 files changed, 34 insertions(+), 2 deletions(-) diff --git a/tools/perf/util/callchain.c b/tools/perf/util/callchain.c index 07fd30b..15c89b2 100644 --- a/tools/perf/util/callchain.c +++ b/tools/perf/util/callchain.c @@ -439,7 +439,7 @@ fill_node(struct callchain_node *node, struct callchain_cursor *cursor) } call->ip = cursor_node->ip; call->ms.sym = cursor_node->sym; - call->ms.map = cursor_node->map; + call->ms.map = map__get(cursor_node->map); list_add_tail(&call->list, &node->val); callchain_cursor_advance(cursor); @@ -464,6 +464,7 @@ add_child(struct callchain_node *parent, list_for_each_entry_safe(call, tmp, &new->val, list) { list_del(&call->list); + map__zput(call->ms.map); free(call); } free(new); @@ -732,6 +733,7 @@ merge_chain_branch(struct callchain_cursor *cursor, callchain_cursor_append(cursor, list->ip, list->ms.map, list->ms.sym); list_del(&list->list); + map__zput(list->ms.map); free(list); } @@ -780,7 +782,8 @@ int callchain_cursor_append(struct callchain_cursor *cursor, } node->ip = ip; - node->map = map; + map__zput(node->map); + node->map = map__get(map); node->sym = sym; cursor->nr++; @@ -830,6 +833,8 @@ int fill_callchain_info(struct addr_location *al, struct callchain_cursor_node * goto out; } + map__get(al->map); + if (al->map->groups == &al->machine->kmaps) { if (machine__is_host(al->machine)) { al->cpumode = PERF_RECORD_MISC_KERNEL; @@ -947,11 +952,13 @@ static void free_callchain_node(struct callchain_node *node) list_for_each_entry_safe(list, tmp, &node->parent_val, list) { list_del(&list->list); + map__zput(list->ms.map); free(list); } list_for_each_entry_safe(list, tmp, &node->val, list) { list_del(&list->list); + map__zput(list->ms.map); free(list); } @@ -1035,6 +1042,7 @@ int callchain_node__make_parent_list(struct callchain_node *node) out: list_for_each_entry_safe(chain, new, &head, list) { list_del(&chain->list); + map__zput(chain->ms.map); free(chain); } return -ENOMEM; diff --git a/tools/perf/util/callchain.h b/tools/perf/util/callchain.h index 13e7554..0d944ef 100644 --- a/tools/perf/util/callchain.h +++ b/tools/perf/util/callchain.h @@ -5,6 +5,7 @@ #include #include #include "event.h" +#include "map.h" #include "symbol.h" #define HELP_PAD "\t\t\t\t" @@ -178,8 +179,13 @@ int callchain_merge(struct callchain_cursor *cursor, */ static inline void callchain_cursor_reset(struct callchain_cursor *cursor) { + struct callchain_cursor_node *node; + cursor->nr = 0; cursor->last = &cursor->first; + + for (node = cursor->first; node != NULL; node = node->next) + map__zput(node->map); } int callchain_cursor_append(struct callchain_cursor *cursor, u64 ip, @@ -238,12 +244,26 @@ int perf_callchain_config(const char *var, const char *value); static inline void callchain_cursor_snapshot(struct callchain_cursor *dest, struct callchain_cursor *src) { + struct callchain_cursor_node *node; + *dest = *src; dest->first = src->curr; dest->nr -= src->pos; + + for (node = dest->first; node != NULL; node = node->next) + map__get(node->map); } +static inline void callchain_cursor_snapshot_rele(struct callchain_cursor *curs) +{ + struct callchain_cursor_node *node; + + for (node = curs->first; node != NULL; node = node->next) + map__put(node->map); +} + + #ifdef HAVE_SKIP_CALLCHAIN_IDX int arch_skip_callchain_idx(struct thread *thread, struct ip_callchain *chain); #else diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c index b02992e..f8335e8 100644 --- a/tools/perf/util/hist.c +++ b/tools/perf/util/hist.c @@ -1,6 +1,7 @@ #include "util.h" #include "build-id.h" #include "hist.h" +#include "map.h" #include "session.h" #include "sort.h" #include "evlist.h" @@ -970,6 +971,8 @@ iter_add_next_cumulative_entry(struct hist_entry_iter *iter, if (symbol_conf.use_callchain) callchain_append(he->callchain, &cursor, sample->period); + /* Cleanup temporary cursor. */ + callchain_cursor_snapshot_rele(&cursor); return 0; } @@ -979,6 +982,7 @@ iter_finish_cumulative_entry(struct hist_entry_iter *iter, { zfree(&iter->priv); iter->he = NULL; + map__zput(al->map); return 0; } -- 2.7.4