lkml.org 
[lkml]   [2019]   [May]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Date
SubjectRe: [PATCH v2] fix use-after-free in perf_sched__lat
Em Wed, May 22, 2019 at 03:56:10PM +0900, Namhyung Kim escreveu:
> On Wed, May 08, 2019 at 10:36:48PM +0800, Wei Li wrote:
> > After thread is added to machine->threads[i].dead in
> > __machine__remove_thread, the machine->threads[i].dead is freed
> > when calling free(session) in perf_session__delete(). So it get a
> > Segmentation fault when accessing it in thread__put().
> >
> > In this patch, we delay the perf_session__delete until all threads
> > have been deleted.
> >
> > This can be reproduced by following steps:
> > ulimit -c unlimited
> > export MALLOC_MMAP_THRESHOLD_=0
> > perf sched record sleep 10
> > perf sched latency --sort max
> > Segmentation fault (core dumped)
> >
> > Signed-off-by: Zhipeng Xie <xiezhipeng1@huawei.com>
> > Signed-off-by: Wei Li <liwei391@huawei.com>
>
> Acked-by: Namhyung Kim <namhyung@kernel.org>

I'll try to analyse this one soon, but my first impression was that we
should just grab reference counts when keeping a pointer to those
threads instead of keeping _all_ threads alive when supposedly we could
trow away unreferenced data structures.

But this is just a first impression from just reading the patch
description, probably I'm missing something.

Thanks for providing instructions on readily triggering the segfault.

- Arnaldo

\
 
 \ /
  Last update: 2019-05-22 13:09    [W:0.566 / U:0.308 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site