From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754810AbcBBOIR (ORCPT ); Tue, 2 Feb 2016 09:08:17 -0500 Received: from mail.kernel.org ([198.145.29.136]:55524 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754383AbcBBOIP (ORCPT ); Tue, 2 Feb 2016 09:08:15 -0500 Date: Tue, 2 Feb 2016 11:08:06 -0300 From: Arnaldo Carvalho de Melo To: Adrian Hunter Cc: Wang Nan , Ingo Molnar , linux-kernel@vger.kernel.org, Wang Nan , Josh Poimboeuf Subject: Re: [PATCH 2/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info() Message-ID: <20160202140806.GA32488@kernel.org> References: <1454346792-24419-1-git-send-email-acme@kernel.org> <1454346792-24419-3-git-send-email-acme@kernel.org> <56B083D3.2000402@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <56B083D3.2000402@intel.com> X-Url: http://acmel.wordpress.com User-Agent: Mutt/1.5.23 (2014-03-12) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Em Tue, Feb 02, 2016 at 12:24:19PM +0200, Adrian Hunter escreveu: > This patch does not fix the problem because the thread__zput() will still > segfault later if the error path is not taken. > > Sorry, I didn't look closely at this patch because I was not expecting it > to be taken because of the fix I had already sent: > > http://marc.info/?l=linux-kernel&m=145431692623940 > > However if you want to keep the struct thread rbtree / list union, the > simple fix would be to reinstate the list initialization in this particular > case i.e.: Right, so it keeps the existing thread lifetime assumptions both in the error path, as Wang did, and in the normal pt->unknown_thread end of life at intel_pt_free(), I'm replacing the patch... - Arnaldo > > diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c > index 81a2eb7..18245b8 100644 > --- a/tools/perf/util/intel-pt.c > +++ b/tools/perf/util/intel-pt.c > @@ -2068,6 +2068,7 @@ int intel_pt_process_auxtrace_info(union perf_event > err = -ENOMEM; > goto err_free_queues; > } > + INIT_LIST_HEAD(&pt->unknown_thread->node); > err = thread__set_comm(pt->unknown_thread, "unknown", 0); > if (err) > goto err_delete_thread; > > > > On 01/02/16 19:13, Arnaldo Carvalho de Melo wrote: > > From: Wang Nan > > > > In error processing path of intel_pt_process_auxtrace_info() it calls > > thread__zput() to clean and free pt->unknown_thread which is created by > > thread__new(). However, when error raise, a segfault happen: > > > > # perf record -I -e intel_pt/tsc=1,noretcomp=1/u /bin/ls > > 0 a anaconda-ks.cfg bin perf.data perf.data.old perf-f23-bringup.todo > > [ perf record: Woken up 1 times to write data ] > > [ perf record: Captured and wrote 0.217 MB perf.data ] > > # > > # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs > > Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. > > intel_pt_synth_events: failed to synthesize 'instructions' event type > > Segmentation fault (core dumped) > > # > > > > The problem is: there's a union in 'struct thread' combines a list_head > > and a rb_node. The standard life cycle of a thread is: init rb_node during > > creating, inserted into machine->threads rbtree uses rb_node, move to > > machine->dead_threads using list_head, clean by thread__put: > > list_del_init(&thread->node). > > > > In the above command, it clean a thread before adding it into list, > > causes the above segfault. > > > > This patch gives a fake list_head and link the thread into it before > > calling thread__zput(), get rid of the segfault. > > > > After this patch: > > > > # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs > > Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. > > intel_pt_synth_events: failed to synthesize 'instructions' event type > > 0x248 [0x88]: failed to process type: 70 > > # > > > > Reported-by: Tong Zhang > > Signed-off-by: Wang Nan > > Tested-by: Arnaldo Carvalho de Melo > > Cc: Adrian Hunter > > Cc: Josh Poimboeuf > > Link: http://lkml.kernel.org/r/1454296865-19749-1-git-send-email-wangnan0@huawei.com > > Signed-off-by: Arnaldo Carvalho de Melo > > --- > > tools/perf/util/intel-pt.c | 4 ++++ > > 1 file changed, 4 insertions(+) > > > > diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c > > index 81a2eb77ba7f..e2add6376fec 100644 > > --- a/tools/perf/util/intel-pt.c > > +++ b/tools/perf/util/intel-pt.c > > @@ -2013,6 +2013,7 @@ int intel_pt_process_auxtrace_info(union perf_event *event, > > struct auxtrace_info_event *auxtrace_info = &event->auxtrace_info; > > size_t min_sz = sizeof(u64) * INTEL_PT_PER_CPU_MMAPS; > > struct intel_pt *pt; > > + struct list_head dead_thread; > > int err; > > > > if (auxtrace_info->header.size < sizeof(struct auxtrace_info_event) + > > @@ -2153,6 +2154,9 @@ int intel_pt_process_auxtrace_info(union perf_event *event, > > return 0; > > > > err_delete_thread: > > + RB_CLEAR_NODE(&pt->unknown_thread->rb_node); > > + INIT_LIST_HEAD(&dead_thread); > > + list_add(&pt->unknown_thread->node, &dead_thread); > > thread__zput(pt->unknown_thread); > > err_free_queues: > > intel_pt_log_disable(); > >