Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.debian.kernel > #65484 > unrolled thread

Bug#943398: linux-perf-5.2: perf report segmentation fault

Back to article view | Back to linux.debian.kernel

Contents

  Bug#943398: linux-perf-5.2: perf report segmentation fault Till Junge <debian.bugreport@cloudmail.altermail.ch> - 2019-10-24 14:40 +0200
    Bug#943398: linux-perf-5.2: perf report segmentation fault Bernhard Übelacker <bernhardu@mailbox.org> - 2020-01-14 01:10 +0100
      Bug#943398: linux-perf-5.2: perf report segmentation fault Salvatore Bonaccorso <carnil@debian.org> - 2020-01-15 21:20 +0100
        Bug#943398: linux-perf-5.2: perf report segmentation fault Bernhard Übelacker <bernhardu@mailbox.org> - 2020-01-20 22:50 +0100
          Bug#943398: linux-perf-5.2: perf report segmentation fault Salvatore Bonaccorso <carnil@debian.org> - 2020-01-21 17:40 +0100
            Bug#943398: linux-perf-5.2: perf report segmentation fault Bernhard Übelacker <bernhardu@mailbox.org> - 2020-01-23 11:10 +0100
    Processed: Re: Bug#943398: linux-perf-5.2: perf report  segmentation fault "Debian Bug Tracking System" <owner@bugs.debian.org> - 2020-01-23 11:10 +0100

#65484 — Bug#943398: linux-perf-5.2: perf report segmentation fault

Package: linux-perf-5.2
Version: 5.2.17-1+b1
Severity: important

Dear Maintainer,

`perf report` segfaults, making perf unusable. To reproduce, e.g. do

```
# perf record ls
# perf report perf.data
```

`perf report` loads the file and the curses gui subsequently segfaults




-- System Information:
Debian Release: bullseye/sid
  APT prefers testing
  APT policy: (500, 'testing')
Architecture: amd64 (x86_64)

Kernel: Linux 5.2.0-3-amd64 (SMP w/24 CPU cores)
Kernel taint flags: TAINT_PROPRIETARY_MODULE, TAINT_OOT_MODULE, TAINT_UNSIGNED_MODULE
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8), LANGUAGE=en_US:en (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
Init: systemd (via /run/systemd/system)
LSM: AppArmor: enabled

Versions of packages linux-perf-5.2 depends on:
ii  libbabeltrace1  1.5.7-1
ii  libc6           2.29-2
ii  libdw1          0.176-1.1
ii  libelf1         0.176-1.1
ii  liblzma5        5.2.4-1+b1
ii  libnuma1        2.0.12-1+b1
ii  libperl5.30     5.30.0-7
ii  libpython3.7    3.7.5~rc1-2
ii  libslang2       2.3.2-4
ii  libunwind8      1.2.1-9
ii  perl            5.30.0-7
ii  python3         3.7.5-1
ii  zlib1g          1:1.2.11.dfsg-1+b1

Versions of packages linux-perf-5.2 recommends:
ii  linux-base  4.6

Versions of packages linux-perf-5.2 suggests:
pn  linux-doc-5.2  <none>

-- no debconf information

[toc] | [next] | [standalone]

#66069

[Multipart message — attachments visible in raw view] — view raw

Dear Maintainer,
I could reproduce using linux-perf-5.2 and it is
also visible in linux-perf-5.4 5.4.8-1,
by just pressing enter.

The crash happens because in line 3172
function hist_browser__selected_entry returns
browser->he_selection, which is at this time a
null pointer.
This null pointer gets dereferenced to
access the res_samples member.

Upstream seems to have fixed other occourences [1]
of browser->he_selection being null, but this is
already contained in 5.4 while a crash still happens.

Kind regards,
Bernhard



Program received signal SIGSEGV, Segmentation fault.
(rr) bt
#0  perf_evsel__hists_browse (evsel=0x55e794ebcb40, nr_events=nr_events@entry=1, helpline=helpline@entry=0x55e794f7c040 "Tip: System-wide collection from all CPUs: perf record -a", left_exits=left_exits@entry=false, hbt=hbt@entry=0x0, min_pcnt=<optimized out>, env=env@entry=0x55e794eb54f0, warn_lost_event=true, annotation_opts=0x7ffcc3063dc8) at ui/browsers/hists.c:3170
#1  0x000055e79385cce9 in perf_evlist__tui_browse_hists (evlist=evlist@entry=0x55e794ebc0c0, help=help@entry=0x55e794f7c040 "Tip: System-wide collection from all CPUs: perf record -a", hbt=hbt@entry=0x0, min_pcnt=<optimized out>, env=env@entry=0x55e794eb54f0, warn_lost_event=warn_lost_event@entry=true, annotation_opts=annotation_opts@entry=0x7ffcc3063dc8) at ui/browsers/hists.c:3422
#2  0x000055e7936f1ece in report__browse_hists (rep=0x7ffcc3063c30) at builtin-report.c:585
#3  __cmd_report (rep=0x7ffcc3063c30) at builtin-report.c:930
#4  cmd_report (argc=<optimized out>, argv=<optimized out>) at builtin-report.c:1475
#5  0x000055e79375b823 in run_builtin (p=0x55e793a9ef90 <commands+240>, argc=2, argv=0x7ffcc30661f0) at perf.c:312
#6  0x000055e7936d6a2c in handle_internal_command (argv=<optimized out>, argc=<optimized out>) at perf.c:364
#7  run_argv (argcp=<optimized out>, argv=<optimized out>) at perf.c:408
#8  main (argc=2, argv=0x7ffcc30661f0) at perf.c:538


https://sources.debian.org/src/linux/5.4.8-1/tools/perf/ui/browsers/hists.c/#L2217
    2217 static struct hist_entry *hist_browser__selected_entry(struct hist_browser *browser)
    2218 {
    2219 	return browser->he_selection;
    2220 }

https://sources.debian.org/src/linux/5.4.8-1/tools/perf/ui/browsers/hists.c/#L3170
    3170 		nr_options += add_res_sample_opt(browser, &actions[nr_options],
    3171 						 &options[nr_options],
    3172 				 hist_browser__selected_entry(browser)->res_samples,
    3173 				 evsel, A_NORMAL);


[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/tools/perf/ui/browsers/hists.c?id=ceb75476db1617a88cc29b09839acacb69aa076e

[toc] | [prev] | [next] | [standalone]

#66096

Hi,

On Tue, Jan 14, 2020 at 01:08:02AM +0100, Bernhard Übelacker wrote:
> Dear Maintainer,
> I could reproduce using linux-perf-5.2 and it is
> also visible in linux-perf-5.4 5.4.8-1,
> by just pressing enter.
> 
> The crash happens because in line 3172
> function hist_browser__selected_entry returns
> browser->he_selection, which is at this time a
> null pointer.
> This null pointer gets dereferenced to
> access the res_samples member.
> 
> Upstream seems to have fixed other occourences [1]
> of browser->he_selection being null, but this is
> already contained in 5.4 while a crash still happens.

Can you report the issue directly upstream?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#66175

Hello Salvatore,

> Can you report the issue directly upstream?
Will do, but I am not sure exactly to where.

I found the MAINTAINERS file and I guess if there
is no "B:" line it has to be reported to the "L:" list ?

Kind regards,
Bernhard

https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/MAINTAINERS#n12936

[toc] | [prev] | [next] | [standalone]

#66181

Hi Bernhard,

On Mon, Jan 20, 2020 at 10:41:44PM +0100, Bernhard Übelacker wrote:
> Hello Salvatore,
> 
> > Can you report the issue directly upstream?
> Will do, but I am not sure exactly to where.
> 
> I found the MAINTAINERS file and I guess if there
> is no "B:" line it has to be reported to the "L:" list ?

the mailinglist + the respective maintainers listed ideally.
Cf. https://www.kernel.org/doc/html/latest/admin-guide/bug-hunting.html#reporting-the-bug

Does this help?

Regards,
Salvatore

[toc] | [prev] | [next] | [standalone]

#66194

Control: forwarded -1 https://marc.info/?l=linux-kernel&m=157973791626377&w=2
Control: tags -1 + upstream


Hello Salvatore,
thanks for the link.
I tried to get in contact with upstream.

Kind regards,
Bernhard

https://www.spinics.net/lists/kernel/msg3384013.html
https://marc.info/?l=linux-kernel&m=157973791626377&w=2

[toc] | [prev] | [next] | [standalone]

#66193 — Processed: Re: Bug#943398: linux-perf-5.2: perf report segmentation fault

Processing control commands:

> forwarded -1 https://marc.info/?l=linux-kernel&m=157973791626377&w=2
Bug #943398 [src:linux] linux-perf-5.2: perf report segmentation fault
Set Bug forwarded-to-address to 'https://marc.info/?l=linux-kernel&m=157973791626377&w=2'.
> tags -1 + upstream
Bug #943398 [src:linux] linux-perf-5.2: perf report segmentation fault
Added tag(s) upstream.

-- 
943398: https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=943398
Debian Bug Tracking System
Contact owner@bugs.debian.org with problems

[toc] | [prev] | [standalone]

Back to top | Article view | linux.debian.kernel

csiph-web