From: He Kuang <hekuang@huawei.com>
To: <acme@kernel.org>, <a.p.zijlstra@chello.nl>, <mingo@redhat.com>,
<jolsa@kernel.org>
Cc: <wangnan0@huawei.com>, <linux-kernel@vger.kernel.org>
Subject: [PATCH 2/2] perf trace: Fix segmentfault on perf trace
Date: Tue, 7 Apr 2015 17:31:11 +0800 [thread overview]
Message-ID: <1428399071-7141-2-git-send-email-hekuang@huawei.com> (raw)
In-Reply-To: <1428399071-7141-1-git-send-email-hekuang@huawei.com>
After perf_evlist__filter_pollfd() filters out fds and releases
perf_mmap by using perf_evlist__mmap_put(), refcnt of perf_mmap hits 1
then perf_evlist__mmap_consume() will do the final unmap. In this
condition, perf_evlist__mmap_read() will crash by referencing invalid
mmap. Put refcnt check before use.
Can be reproduced as following:
$ perf trace --duration 1.0 ls
...
perf: Segmentation fault
Obtained 14 stack frames.
./perf(dump_stack+0x2e) [0x503c2d]
./perf(sighandler_dump_stack+0x2e)
[0x503d0c]
/lib64/libc.so.6(+0x34df0) [0x7f5fd9a4adf0]
./perf() [0x4a8fda]
./perf(perf_evlist__mmap_read+0x56)
[0x4aae93]
./perf() [0x470b28]
./perf(cmd_trace+0xada) [0x4727bd]
./perf() [0x49c4f4]
./perf() [0x49c74d]
./perf() [0x49c899]
./perf(main+0x23b)
[0x49cbfa]
/lib64/libc.so.6(__libc_start_main+0xf5)
[0x7f5fd9a377b5]
./perf() [0x434ea5]
[(nil)]
Signed-off-by: He Kuang <hekuang@huawei.com>
---
tools/perf/util/evlist.c | 13 ++++++++++---
1 file changed, 10 insertions(+), 3 deletions(-)
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index 76ef7ee..9d36433 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -634,11 +634,18 @@ static struct perf_evsel *perf_evlist__event2evsel(struct perf_evlist *evlist,
union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
{
struct perf_mmap *md = &evlist->mmap[idx];
- unsigned int head = perf_mmap__read_head(md);
- unsigned int old = md->prev;
- unsigned char *data = md->base + page_size;
+ unsigned int head;
+ unsigned int old;
+ unsigned char *data;
union perf_event *event = NULL;
+ if (md == NULL || md->refcnt == 0)
+ return NULL;
+
+ head = perf_mmap__read_head(md);
+ old = md->prev;
+ data = md->base + page_size;
+
if (evlist->overwrite) {
/*
* If we're further behind than half the buffer, there's a chance
--
2.3.3.220.g9ab698f
next prev parent reply other threads:[~2015-04-07 9:36 UTC|newest]
Thread overview: 9+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-07 9:31 [PATCH 1/2] perf evlist: Fix inverted logic in perf_mmap__empty He Kuang
2015-04-07 9:31 ` He Kuang [this message]
2015-04-07 12:36 ` [PATCH 2/2] perf trace: Fix segmentfault on perf trace Arnaldo Carvalho de Melo
2015-04-08 3:15 ` He Kuang
2015-05-11 12:11 ` He Kuang
2015-05-11 13:47 ` Arnaldo Carvalho de Melo
2015-05-11 13:57 ` Arnaldo Carvalho de Melo
2015-04-07 11:59 ` [PATCH 1/2] perf evlist: Fix inverted logic in perf_mmap__empty Arnaldo Carvalho de Melo
2015-04-08 15:10 ` [tip:perf/core] " tip-bot for He Kuang
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1428399071-7141-2-git-send-email-hekuang@huawei.com \
--to=hekuang@huawei.com \
--cc=a.p.zijlstra@chello.nl \
--cc=acme@kernel.org \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@redhat.com \
--cc=wangnan0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.