Messages in this thread | | | Date | Thu, 25 Feb 2010 11:13:51 -0300 | From | Arnaldo Carvalho de Melo <> | Subject | Re: perf per-symbol histogram causes memory corruption |
| |
Em Thu, Feb 25, 2010 at 12:11:48PM +0100, Ingo Molnar escreveu: > > (Added Arnaldo to the Cc: - he's maintaining the symbol lookup bits of perf.) > > * David Miller <davem@davemloft.net> wrote: > > > When builtin-annotate.c processes sample events via > > process_sample_event() it uses 'sample_filter' > > > > sample_filter() sizes the histogram object for a symbol based upon the > > size, calculated as "sym->end - sym->start", to determine the number > > of IP sample slots to allocate. > > > > The problem is, the sym->end value is not stable at this point. > > > > For example, dso__load_sym() first loads all of the symbols, then it > > makes another pass over the symbols by calling symbols__fixup_end() > > which will adjust the sym->end values of various symbols. > > > > At this point, the histogram IP sample array allocated by > > sample_filter() can become too small, and hits recorded can thus > > access past the end of the array corrupting memory. > > > > I get this very reliably on sparc64, and it took me a few days to root > > cause this. :-) > > > > I don't see an immediate way to fix this, any ideas?
This was reported by Anton as well, I guess the right way to fix this is to first load all symbols and then iterate thru them allocating the resources that need to have ->end fixed up.
As we already fix up the symbols when we finish loading them, annotate would have meaningful ->end members.
I.e. 'perf annotate' is not using this mechanism as a filter. Its a post processing phase.
I'll provide a patch.
- Arnaldo
| |