lkml.org 
[lkml]   [2018]   [Mar]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
SubjectRe: [PATCH] perf mmap: Fix accessing unmapped mmap in perf_mmap__read_done()
From
Date


On 3/26/2018 10:41 AM, Arnaldo Carvalho de Melo wrote:
> Em Mon, Mar 26, 2018 at 11:26:04AM -0300, Arnaldo Carvalho de Melo escreveu:
>> Em Mon, Mar 26, 2018 at 09:42:09AM -0400, kan.liang@linux.intel.com escreveu:
>>> From: Kan Liang <kan.liang@linux.intel.com>
>>>
>>> There is segmentation fault when running perf trace. For example,
>>> [root@jouet e]# perf trace -e *chdir -o /tmp/bla perf report
>>> --ignore-vmlinux -i ../perf.data
>>>
>>> The perf_mmap__consume() could unmap the mmap. It needs to check the
>>> refcnt in perf_mmap__read_done().
>>>
>>> Fixes: ee023de05f35 ("perf mmap: Introduce perf_mmap__read_done()")
>>> Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
>>> Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
>>
>> Seems insuficient:
>>
>> [root@jouet ~]# perf trace -e *chdir -o /tmp/bla perf report --ignore-vmlinux
>> perf: Segmentation fault
>> Obtained 9 stack frames.
>> perf(sighandler_dump_stack+0x3e) [0x4fe31e]
>> /lib64/libc.so.6(+0x346df) [0x7fc0c3ced6df]
>> perf(perf_mmap__read_init+0x26) [0x4ccd06]
>> perf(cmd_trace+0x1bf6) [0x47bb76]
>> perf() [0x4a824e]
>> perf() [0x4a8550]
>> perf(main+0x331) [0x42bef1]
>> /lib64/libc.so.6(__libc_start_main+0xe9) [0x7fc0c3cd9f29]
>> perf(_start+0x29) [0x42c319]
>> Segmentation fault (core dumped)
>> [root@jouet ~]#
>
> I'm adding this as a separate patch, with yours and this one, the
> segfault is gone.
>

Thanks. Yes, we should check the mmap before using it for all new
interfaces.

Thanks,
Kan

> - Arnaldo
>
> diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
> index f6cfc52ff1fe..fc832676a798 100644
> --- a/tools/perf/util/mmap.c
> +++ b/tools/perf/util/mmap.c
> @@ -234,7 +234,7 @@ static int overwrite_rb_find_range(void *buf, int mask, u64 *start, u64 *end)
> /*
> * Report the start and end of the available data in ringbuffer
> */
> -int perf_mmap__read_init(struct perf_mmap *md)
> +static int __perf_mmap__read_init(struct perf_mmap *md)
> {
> u64 head = perf_mmap__read_head(md);
> u64 old = md->prev;
> @@ -268,6 +268,17 @@ int perf_mmap__read_init(struct perf_mmap *md)
> return 0;
> }
>
> +int perf_mmap__read_init(struct perf_mmap *map)
> +{
> + /*
> + * Check if event was unmapped due to a POLLHUP/POLLERR.
> + */
> + if (!refcount_read(&map->refcnt))
> + return -ENOENT;
> +
> + return __perf_mmap__read_init(map);
> +}
> +
> int perf_mmap__push(struct perf_mmap *md, void *to,
> int push(void *to, void *buf, size_t size))
> {
>

\
 
 \ /
  Last update: 2018-03-26 16:52    [W:0.414 / U:0.280 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site