LKML Archive on lore.kernel.org
 help / color / Atom feed
From: Arnaldo Carvalho de Melo <acme@kernel.org>
To: kan.liang@linux.intel.com
Cc: mingo@redhat.com, linux-kernel@vger.kernel.org, jolsa@kernel.org,
	namhyung@kernel.org, wangnan0@huawei.com
Subject: Re: [PATCH] perf mmap: Fix accessing unmapped mmap in perf_mmap__read_done()
Date: Mon, 26 Mar 2018 11:41:27 -0300
Message-ID: <20180326144127.GF18897@kernel.org> (raw)
In-Reply-To: <20180326142604.GE18897@kernel.org>

Em Mon, Mar 26, 2018 at 11:26:04AM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Mon, Mar 26, 2018 at 09:42:09AM -0400, kan.liang@linux.intel.com escreveu:
> > From: Kan Liang <kan.liang@linux.intel.com>
> > 
> > There is segmentation fault when running perf trace. For example,
> >   [root@jouet e]# perf trace -e *chdir -o /tmp/bla perf report
> >   --ignore-vmlinux -i ../perf.data
> > 
> > The perf_mmap__consume() could unmap the mmap. It needs to check the
> > refcnt in perf_mmap__read_done().
> > 
> > Fixes: ee023de05f35 ("perf mmap: Introduce perf_mmap__read_done()")
> > Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
> > Signed-off-by: Kan Liang <kan.liang@linux.intel.com>
> 
> Seems insuficient:
> 
> [root@jouet ~]# perf trace -e *chdir -o /tmp/bla perf report --ignore-vmlinux
> perf: Segmentation fault
> Obtained 9 stack frames.
> perf(sighandler_dump_stack+0x3e) [0x4fe31e]
> /lib64/libc.so.6(+0x346df) [0x7fc0c3ced6df]
> perf(perf_mmap__read_init+0x26) [0x4ccd06]
> perf(cmd_trace+0x1bf6) [0x47bb76]
> perf() [0x4a824e]
> perf() [0x4a8550]
> perf(main+0x331) [0x42bef1]
> /lib64/libc.so.6(__libc_start_main+0xe9) [0x7fc0c3cd9f29]
> perf(_start+0x29) [0x42c319]
> Segmentation fault (core dumped)
> [root@jouet ~]#

I'm adding this as a separate patch, with yours and this one, the
segfault is gone.

- Arnaldo

diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
index f6cfc52ff1fe..fc832676a798 100644
--- a/tools/perf/util/mmap.c
+++ b/tools/perf/util/mmap.c
@@ -234,7 +234,7 @@ static int overwrite_rb_find_range(void *buf, int mask, u64 *start, u64 *end)
 /*
  * Report the start and end of the available data in ringbuffer
  */
-int perf_mmap__read_init(struct perf_mmap *md)
+static int __perf_mmap__read_init(struct perf_mmap *md)
 {
 	u64 head = perf_mmap__read_head(md);
 	u64 old = md->prev;
@@ -268,6 +268,17 @@ int perf_mmap__read_init(struct perf_mmap *md)
 	return 0;
 }
 
+int perf_mmap__read_init(struct perf_mmap *map)
+{
+	/*
+	 * Check if event was unmapped due to a POLLHUP/POLLERR.
+	 */
+	if (!refcount_read(&map->refcnt))
+		return -ENOENT;
+
+	return __perf_mmap__read_init(map);
+}
+
 int perf_mmap__push(struct perf_mmap *md, void *to,
 		    int push(void *to, void *buf, size_t size))
 {

  reply index

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2018-03-26 13:42 kan.liang
2018-03-26 14:26 ` Arnaldo Carvalho de Melo
2018-03-26 14:41   ` Arnaldo Carvalho de Melo [this message]
2018-03-26 14:51     ` Liang, Kan
2018-03-29 13:58     ` [tip:perf/core] perf mmap: Be consistent when checking for an unmaped ring buffer tip-bot for Arnaldo Carvalho de Melo
2018-03-29 13:58 ` [tip:perf/core] perf mmap: Fix accessing unmapped mmap in perf_mmap__read_done() tip-bot for Kan Liang

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20180326144127.GF18897@kernel.org \
    --to=acme@kernel.org \
    --cc=jolsa@kernel.org \
    --cc=kan.liang@linux.intel.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=namhyung@kernel.org \
    --cc=wangnan0@huawei.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

LKML Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/lkml/0 lkml/git/0.git
	git clone --mirror https://lore.kernel.org/lkml/1 lkml/git/1.git
	git clone --mirror https://lore.kernel.org/lkml/2 lkml/git/2.git
	git clone --mirror https://lore.kernel.org/lkml/3 lkml/git/3.git
	git clone --mirror https://lore.kernel.org/lkml/4 lkml/git/4.git
	git clone --mirror https://lore.kernel.org/lkml/5 lkml/git/5.git
	git clone --mirror https://lore.kernel.org/lkml/6 lkml/git/6.git
	git clone --mirror https://lore.kernel.org/lkml/7 lkml/git/7.git
	git clone --mirror https://lore.kernel.org/lkml/8 lkml/git/8.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 lkml lkml/ https://lore.kernel.org/lkml \
		linux-kernel@vger.kernel.org
	public-inbox-index lkml

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-kernel


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git