[PATCH] perf script: Fix obtaining next event

[PATCH] perf script: Fix obtaining next event

[Chandan Rajendra]

The current code segfaults when perf.data file contains two or more
events. This happens due to incorrect pointer arithmetic being performed
in trace_find_next_event().

tep_handle->events is an array of pointers to 'struct tep_event'. The
pointer arithmetic interprets tep_handle->events as an array of 'struct
tep_event' elements.

This commit replaces the usage of pointer arithmetic with calls to
tep_get_event().

Fixes: bb3dd7e ("tools lib traceevent, perf tools: Move struct tep_handler definition in a local header file")
Signed-off-by: Chandan Rajendra <chandanrlinux@gmail.com>
---
 tools/perf/util/trace-event-parse.c | 24 +++++++-----------------
 1 file changed, 7 insertions(+), 17 deletions(-)

diff --git a/tools/perf/util/trace-event-parse.c b/tools/perf/util/trace-event-parse.c
index 5d6bfc70b210..7bf423a3631e 100644
--- a/tools/perf/util/trace-event-parse.c
+++ b/tools/perf/util/trace-event-parse.c
@@ -176,31 +176,21 @@ int parse_event_file(struct tep_handle *pevent,
 struct tep_event *trace_find_next_event(struct tep_handle *pevent,
 					struct tep_event *event)
 {
-	static int idx;
+	int idx;
 	int events_count;
-	struct tep_event *all_events;
 
-	all_events = tep_get_first_event(pevent);
 	events_count = tep_get_events_count(pevent);
-	if (!pevent || !all_events || events_count < 1)
+	if (!pevent || events_count < 1)
 		return NULL;
 
-	if (!event) {
-		idx = 0;
-		return all_events;
-	}
+	if (!event)
+		return tep_get_event(pevent, 0);
 
-	if (idx < events_count && event == (all_events + idx)) {
-		idx++;
-		if (idx == events_count)
-			return NULL;
-		return (all_events + idx);
+	for (idx = 0; idx < events_count - 1; idx++) {
+		if (event == tep_get_event(pevent, idx))
+			return tep_get_event(pevent, idx + 1);
 	}
 
-	for (idx = 1; idx < events_count; idx++) {
-		if (event == (all_events + (idx - 1)))
-			return (all_events + idx);
-	}
 	return NULL;
 }
 
-- 
2.19.1

Re: [PATCH] perf script: Fix obtaining next event

[Ravi Bangoria]

On 10/30/19 2:10 PM, Chandan Rajendra wrote:
> The current code segfaults when perf.data file contains two or more
> events. This happens due to incorrect pointer arithmetic being performed
> in trace_find_next_event().
> 
> tep_handle->events is an array of pointers to 'struct tep_event'. The
> pointer arithmetic interprets tep_handle->events as an array of 'struct
> tep_event' elements.
> 
> This commit replaces the usage of pointer arithmetic with calls to
> tep_get_event().
> 
> Fixes: bb3dd7e ("tools lib traceevent, perf tools: Move struct tep_handler definition in a local header file")
> Signed-off-by: Chandan Rajendra <chandanrlinux@gmail.com>

   $ sudo ./perf record -e sched:sched_switch -e syscalls:sys_enter_openat -- make

Without patch:
   $ sudo ./perf script -g python
   Segmentation fault

With patch:
   $ sudo ./perf script -g python
   generated Python script: perf-script.py

Reviewed-and-tested-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>

Re: [PATCH] perf script: Fix obtaining next event

[Arnaldo Carvalho de Melo]

Em Wed, Oct 30, 2019 at 03:16:10PM +0530, Ravi Bangoria escreveu:
> 
> 
> On 10/30/19 2:10 PM, Chandan Rajendra wrote:
> > The current code segfaults when perf.data file contains two or more
> > events. This happens due to incorrect pointer arithmetic being performed
> > in trace_find_next_event().
> > 
> > tep_handle->events is an array of pointers to 'struct tep_event'. The
> > pointer arithmetic interprets tep_handle->events as an array of 'struct
> > tep_event' elements.
> > 
> > This commit replaces the usage of pointer arithmetic with calls to
> > tep_get_event().
> > 
> > Fixes: bb3dd7e ("tools lib traceevent, perf tools: Move struct tep_handler definition in a local header file")
> > Signed-off-by: Chandan Rajendra <chandanrlinux@gmail.com>
> 
>   $ sudo ./perf record -e sched:sched_switch -e syscalls:sys_enter_openat -- make
> 
> Without patch:
>   $ sudo ./perf script -g python
>   Segmentation fault
> 
> With patch:
>   $ sudo ./perf script -g python
>   generated Python script: perf-script.py
> 
> Reviewed-and-tested-by: Ravi Bangoria <ravi.bangoria@linux.ibm.com>

This was fixed already in perf/core, by Steven:

commit 9bdff5b6436655d42dd30253c521e86ce07b9961
Author: Steven Rostedt (VMware) <rostedt@goodmis.org>
Date:   Thu Oct 17 17:05:23 2019 -0400

    perf tools: Remove unused trace_find_next_event()

    trace_find_next_event() was buggy and pretty much a useless helper. As
    there are no more users, just remove it.

    Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
    Cc: linux-trace-devel@vger.kernel.org
    Link: http://lore.kernel.org/lkml/20191017210636.224045576@goodmis.org
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

commit a5e05abc6b8d81148b35cd8632a4a6252383d968
Author: Steven Rostedt (VMware) <rostedt@goodmis.org>
Date:   Thu Oct 17 17:05:22 2019 -0400

    perf scripting engines: Iterate on tep event arrays directly

    Instead of calling a useless (and broken) helper function to get the
    next event of a tep event array, just get the array directly and iterate
    over it.

    Note, the broken part was from trace_find_next_event() which after this
    will no longer be used, and can be removed.

    Committer notes:

    This fixes a segfault when generating python scripts from perf.data
    files with multiple tracepoint events, i.e. the following use case is
    fixed by this patch:

      # perf record -e sched:* sleep 1
      [ perf record: Woken up 31 times to write data ]
      [ perf record: Captured and wrote 0.031 MB perf.data (9 samples) ]
      # perf script -g python
      Segmentation fault (core dumped)
      #

    Reported-by: Daniel Bristot de Oliveira <bristot@redhat.com>
    Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
    Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Tzvetomir Stoyanov <tstoyanov@vmware.com>
    Cc: linux-trace-devel@vger.kernel.org
    Link: http://lkml.kernel.org/r/20191017153733.630cd5eb@gandalf.local.home
    Link: http://lore.kernel.org/lkml/20191017210636.061448713@goodmis.org
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>