linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Arnaldo Carvalho de Melo <acme@kernel.org>
To: Ingo Molnar <mingo@kernel.org>, Thomas Gleixner <tglx@linutronix.de>
Cc: Jiri Olsa <jolsa@kernel.org>, Namhyung Kim <namhyung@kernel.org>,
	Clark Williams <williams@redhat.com>,
	linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org,
	Leo Yan <leo.yan@linaro.org>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	Daniel Borkmann <daniel@iogearbox.net>,
	Jiri Olsa <jolsa@redhat.com>, Martin KaFai Lau <kafai@fb.com>,
	Song Liu <songliubraving@fb.com>, Yonghong Song <yhs@fb.com>,
	Arnaldo Carvalho de Melo <acme@redhat.com>
Subject: [PATCH 09/28] perf trace: Fix segmentation fault when access syscall info on arm64
Date: Wed, 14 Aug 2019 15:40:32 -0300	[thread overview]
Message-ID: <20190814184051.3125-10-acme@kernel.org> (raw)
In-Reply-To: <20190814184051.3125-1-acme@kernel.org>

From: Leo Yan <leo.yan@linaro.org>

'perf trace' reports the segmentation fault as below on Arm64:

  # perf trace -e string -e augmented_raw_syscalls.c
  LLVM: dumping tools/perf/examples/bpf/augmented_raw_syscalls.o
  perf: Segmentation fault
  Obtained 12 stack frames.
  perf(sighandler_dump_stack+0x47) [0xaaaaac96ac87]
  linux-vdso.so.1(+0x5b7) [0xffffadbeb5b7]
  /lib/aarch64-linux-gnu/libc.so.6(strlen+0x10) [0xfffface7d5d0]
  /lib/aarch64-linux-gnu/libc.so.6(_IO_vfprintf+0x1ac7) [0xfffface49f97]
  /lib/aarch64-linux-gnu/libc.so.6(__vsnprintf_chk+0xc7) [0xffffacedfbe7]
  perf(scnprintf+0x97) [0xaaaaac9ca3ff]
  perf(+0x997bb) [0xaaaaac8e37bb]
  perf(cmd_trace+0x28e7) [0xaaaaac8ec09f]
  perf(+0xd4a13) [0xaaaaac91ea13]
  perf(main+0x62f) [0xaaaaac8a147f]
  /lib/aarch64-linux-gnu/libc.so.6(__libc_start_main+0xe3) [0xfffface22d23]
  perf(+0x57723) [0xaaaaac8a1723]
  Segmentation fault

This issue is introduced by commit 30a910d7d3e0 ("perf trace:
Preallocate the syscall table"), it allocates trace->syscalls.table[]
array and the element count is 'trace->sctbl->syscalls.nr_entries'; but
on Arm64, the system call number is not continuously used; e.g. the
syscall maximum id is 436 but the real entries is only 281.

So the table is allocated with 'nr_entries' as the element count, but it
accesses the table with the syscall id, which might be out of the bound
of the array and cause the segmentation fault.

This patch allocates trace->syscalls.table[] with the element count is
'trace->sctbl->syscalls.max_id + 1', this allows any id to access the
table without out of the bound.

Signed-off-by: Leo Yan <leo.yan@linaro.org>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Martin KaFai Lau <kafai@fb.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Song Liu <songliubraving@fb.com>
Cc: Yonghong Song <yhs@fb.com>
Fixes: 30a910d7d3e0 ("perf trace: Preallocate the syscall table")
Link: http://lkml.kernel.org/r/20190809104752.27338-1-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
 tools/perf/builtin-trace.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 75eb3811e942..d553d06a9aeb 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -1492,7 +1492,7 @@ static int trace__read_syscall_info(struct trace *trace, int id)
 	const char *name = syscalltbl__name(trace->sctbl, id);
 
 	if (trace->syscalls.table == NULL) {
-		trace->syscalls.table = calloc(trace->sctbl->syscalls.nr_entries, sizeof(*sc));
+		trace->syscalls.table = calloc(trace->sctbl->syscalls.max_id + 1, sizeof(*sc));
 		if (trace->syscalls.table == NULL)
 			return -ENOMEM;
 	}
-- 
2.21.0


  parent reply	other threads:[~2019-08-14 18:43 UTC|newest]

Thread overview: 29+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-08-14 18:40 [GIT PULL] perf/core improvements and fixes Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 01/28] perf session: Avoid infinite loop when seeing invalid header.size Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 02/28] perf config: Honour $PERF_CONFIG env var to specify alternate .perfconfig Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 03/28] perf config: Document the PERF_CONFIG environment variable Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 04/28] perf test vfs_getname: Disable ~/.perfconfig to get default output Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 05/28] perf tools: Fix paths in include statements Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 06/28] perf vendor events intel: Add Icelake V1.00 event file Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 07/28] perf top: Set display thread COMM to help with debugging Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 08/28] perf hists: Do not link a pair if already linked Arnaldo Carvalho de Melo
2019-08-14 18:40 ` Arnaldo Carvalho de Melo [this message]
2019-08-14 18:40 ` [PATCH 10/28] perf hist: Remove dummy entries when finding real ones Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 11/28] perf top: Collapse and resort all evsels in a group Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 12/28] tools build: Add capability-related feature detection Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 13/28] perf tools: Add helpers to use capabilities if present Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 14/28] perf tools: Add NO_LIBCAP=1 to the minimal build test Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 15/28] perf tools: Add CAP_SYSLOG define for older systems Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 16/28] perf ftrace: Use CAP_SYS_ADMIN instead of euid==0 Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 17/28] perf ftrace: Improve error message about capability to use ftrace Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 18/28] perf record: Add an option to take an AUX snapshot on exit Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 19/28] perf tools: Add aux_output attribute flag Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 20/28] perf tools: Add itrace option 'o' to synthesize aux-output events Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 21/28] perf intel-pt: Process options for PEBS event synthesis Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 22/28] perf tools: Add aux-output config term Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 23/28] perf intel-pt: Add brief documentation for PEBS via Intel PT Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 24/28] perf evsel: Provide meaningful warning when trying to use 'aux_output' on older kernels Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 25/28] tools: Keep list of tools in alphabetical order Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 26/28] perf.data documentation: Clarify HEADER_SAMPLE_TOPOLOGY format Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 27/28] perf record: Support aarch64 random socket_id assignment Arnaldo Carvalho de Melo
2019-08-14 18:40 ` [PATCH 28/28] perf ui: No need to set ui_browser to 1 twice Arnaldo Carvalho de Melo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190814184051.3125-10-acme@kernel.org \
    --to=acme@kernel.org \
    --cc=acme@redhat.com \
    --cc=alexander.shishkin@linux.intel.com \
    --cc=daniel@iogearbox.net \
    --cc=jolsa@kernel.org \
    --cc=jolsa@redhat.com \
    --cc=kafai@fb.com \
    --cc=leo.yan@linaro.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-perf-users@vger.kernel.org \
    --cc=mingo@kernel.org \
    --cc=namhyung@kernel.org \
    --cc=songliubraving@fb.com \
    --cc=tglx@linutronix.de \
    --cc=williams@redhat.com \
    --cc=yhs@fb.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).