Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 11 Jul 2022 21:11:39 +0530
From:   "Naveen N. Rao" <naveen.n.rao@linux.vnet.ibm.com>
Subject: Re: [PATCH v2] perf trace: Fix SIGSEGV when processing syscall args
To:     Namhyung Kim <namhyung@kernel.org>
Cc:     Arnaldo Carvalho de Melo <acme@kernel.org>, cclaudio@linux.ibm.com,
        Jiri Olsa <jolsa@kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>
References: <20220707090900.572584-1-naveen.n.rao@linux.vnet.ibm.com>
        <CAM9d7cjUVd+O3Ftg3vSAEHnZqS2ZAGez26BjyjY_ZZ3ce40qyA@mail.gmail.com>
In-Reply-To: <CAM9d7cjUVd+O3Ftg3vSAEHnZqS2ZAGez26BjyjY_ZZ3ce40qyA@mail.gmail.com>
User-Agent: astroid/4d6b06ad (https://github.com/astroidmail/astroid)
Message-Id: <1657553759.3ij85y5uv1.naveen@linux.ibm.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Transfer-Encoding: quoted-printable
MIME-Version: 1.0
Precedence: bulk

Hi Namhyung,

Namhyung Kim wrote:
> Hello,
>=20
> On Thu, Jul 7, 2022 at 2:09 AM Naveen N. Rao
> <naveen.n.rao@linux.vnet.ibm.com> wrote:
>>
>> On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to
>> process a perf.data file created with 'perf trace record -p':
>>
>>   #0  0x00000001225b8988 in syscall_arg__scnprintf_augmented_string <sni=
p> at builtin-trace.c:1492
>>   #1  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1492
>>   #2  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1486
>>   #3  0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val <snip> at bui=
ltin-trace.c:1973
>>   #4  syscall__scnprintf_args <snip> at builtin-trace.c:2041
>>   #5  0x00000001225bff04 in trace__sys_enter <snip> at builtin-trace.c:2=
319
>>
>> That points to the below code in tools/perf/builtin-trace.c:
>>         /*
>>          * If this is raw_syscalls.sys_enter, then it always comes with =
the 6 possible
>>          * arguments, even if the syscall being handled, say "openat", u=
ses only 4 arguments
>>          * this breaks syscall__augmented_args() check for augmented arg=
s, as we calculate
>>          * syscall->args_size using each syscalls:sys_enter_NAME tracefs=
 format file,
>>          * so when handling, say the openat syscall, we end up getting 6=
 args for the
>>          * raw_syscalls:sys_enter event, when we expected just 4, we end=
 up mistakenly
>>          * thinking that the extra 2 u64 args are the augmented filename=
, so just check
>>          * here and avoid using augmented syscalls when the evsel is the=
 raw_syscalls one.
>>          */
>>         if (evsel !=3D trace->syscalls.events.sys_enter)
>>                 augmented_args =3D syscall__augmented_args(sc, sample, &=
augmented_args_size, trace->raw_augmented_syscalls_args_size);
>>
>> As the comment points out, we should not be trying to augment the args
>> for raw_syscalls. However, when processing a perf.data file, we are not
>> initializing those properly. Fix the same.
>>
>> Reported-by: Claudio Carvalho <cclaudio@linux.ibm.com>
>> Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
>> ---
>>  tools/perf/builtin-trace.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
>> index 897fc504918b91..f075cf37a65ef8 100644
>> --- a/tools/perf/builtin-trace.c
>> +++ b/tools/perf/builtin-trace.c
>> @@ -4280,6 +4280,7 @@ static int trace__replay(struct trace *trace)
>>                 goto out;
>>
>>         evsel =3D evlist__find_tracepoint_by_name(session->evlist, "raw_=
syscalls:sys_enter");
>> +       trace->syscalls.events.sys_enter =3D evsel;
>>         /* older kernels have syscalls tp versus raw_syscalls */
>=20
> Isn't it better to set it after the NULL check below?

From trace__sys_enter():
	/*
	 * If this is raw_syscalls.sys_enter, then it always comes with the 6 poss=
ible
	 * arguments, even if the syscall being handled, say "openat", uses only 4=
 arguments
	 * this breaks syscall__augmented_args() check for augmented args, as we c=
alculate
	 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format fi=
le,
	 * so when handling, say the openat syscall, we end up getting 6 args for =
the
	 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistak=
enly
	 * thinking that the extra 2 u64 args are the augmented filename, so just =
check
	 * here and avoid using augmented syscalls when the evsel is the raw_sysca=
lls one.
	 */
	if (evsel !=3D trace->syscalls.events.sys_enter)
		augmented_args =3D syscall__augmented_args(sc, sample, &augmented_args_si=
ze, trace->raw_augmented_syscalls_args_size);

From the previous discussion [1], it looks like the assumption above is=20
that sys_enter would be set to raw_syscalls.

As such, I set it before the NULL check below, which ends up falling=20
back to the non-raw syscalls tracepoint.


Thanks,
Naveen

[1] https://lore.kernel.org/all/YjDSRb1wwswKpJNJ@kernel.org/