Messages in this thread | | | Date | Wed, 25 Oct 2017 15:56:25 +0200 | From | Jiri Olsa <> | Subject | Re: [RFC] perf tool: Fix memory corruption because of zero length symbols |
| |
On Tue, Oct 24, 2017 at 07:50:06PM +0530, Ravi Bangoria wrote: > Perf top is often crashing at very random locations on powerpc. > After investigating, I found the crash only happens when sample > is of zero length symbol. Powerpc kernel has many such symbols > which does not contain length details in vmlinux binary and thus > start and end addresses of such symbols are same. > > Structure > > struct sym_hist { > u64 nr_samples; > u64 period; > struct sym_hist_entry addr[0]; > }; > > has last member 'addr[]' of size zero. 'addr[]' is an array of > addresses that belongs to one symbol (function). If function > consist of 100 instructions, 'addr' points to an array of 100 > 'struct sym_hist_entry' elements. For zero length symbol, it > points to the *empty* array, i.e. no members in the array and > thus offset 0 is also invalid for such array. > > static int __symbol__inc_addr_samples(...) > { > ... > offset = addr - sym->start; > h = annotation__histogram(notes, evidx); > h->nr_samples++; > h->addr[offset].nr_samples++; > h->period += sample->period; > h->addr[offset].period += sample->period; > ... > } > > Here, when 'addr' is same as 'sym->start', 'offset' becomes 0, > which is valid for normal symbols but *invalid* for zero length > symbols and thus updating h->addr[offset] causes memory corruption. > > Fix this by adding one dummy element for zero length symbols. > > Fixes: edee44be5919 ("perf annotate: Don't throw error for zero length symbols") > Signed-off-by: Ravi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
thanks, jirka
| |