Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1322803 > unrolled thread

[PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info()

Back to article view | Back to linux.kernel

Contents

  [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info() Wang Nan <wangnan0@huawei.com> - 2016-02-01 04:30 +0100
    Re: [PATCH 1/2] perf tools: Fix fault in error patch of  intel_pt_process_auxtrace_info() Adrian Hunter <adrian.hunter@intel.com> - 2016-02-01 10:00 +0100
    [tip:perf/urgent] perf tools:   Fix thread lifetime related segfaut in intel_pt tip-bot for Adrian Hunter <tipbot@zytor.com> - 2016-02-04 09:00 +0100

#1322803 — [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info()

In error processing path of intel_pt_process_auxtrace_info() it calls
thread__zput() to clean and free pt->unknown_thread which is created by
thread__new(). However, when error raise, a segfault happen:

 # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs
 Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field.
 intel_pt_synth_events: failed to synthesize 'instructions' event type
 Segmentation fault (core dumped)

The problem is: there's a union in 'struct thread' combines a list_head
and a rb_node. The standard life cycle of a thread is: init rb_node during
creating, inserted into machine->threads rbtree uses rb_node, move to
machine->dead_threads using list_head, clean by thread__put:
list_del_init(&thread->node).

In the above command, it clean a thread before adding it into list,
causes the above segfault.

This patch gives a fake list_head and link the thread into it before
calling thread__zput(), get rid of the segfault.

After this patch:
 # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs
 Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field.
 intel_pt_synth_events: failed to synthesize 'instructions' event type
 0x248 [0x88]: failed to process type: 70

Reported-by: Tong Zhang <ztong@vt.edu>
Signed-off-by: Wang Nan <wangnan0@huawei.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
---
 tools/perf/util/intel-pt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 81a2eb7..e2add63 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -2013,6 +2013,7 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
 	struct auxtrace_info_event *auxtrace_info = &event->auxtrace_info;
 	size_t min_sz = sizeof(u64) * INTEL_PT_PER_CPU_MMAPS;
 	struct intel_pt *pt;
+	struct list_head dead_thread;
 	int err;
 
 	if (auxtrace_info->header.size < sizeof(struct auxtrace_info_event) +
@@ -2153,6 +2154,9 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
 	return 0;
 
 err_delete_thread:
+	RB_CLEAR_NODE(&pt->unknown_thread->rb_node);
+	INIT_LIST_HEAD(&dead_thread);
+	list_add(&pt->unknown_thread->node, &dead_thread);
 	thread__zput(pt->unknown_thread);
 err_free_queues:
 	intel_pt_log_disable();
-- 
1.8.3.4

[toc] | [next] | [standalone]

#1322915 — Re: [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info()

On 01/02/16 05:21, Wang Nan wrote:
> In error processing path of intel_pt_process_auxtrace_info() it calls
> thread__zput() to clean and free pt->unknown_thread which is created by
> thread__new(). However, when error raise, a segfault happen:
> 
>  # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs
>  Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field.
>  intel_pt_synth_events: failed to synthesize 'instructions' event type
>  Segmentation fault (core dumped)
> 
> The problem is: there's a union in 'struct thread' combines a list_head
> and a rb_node. The standard life cycle of a thread is: init rb_node during
> creating, inserted into machine->threads rbtree uses rb_node, move to
> machine->dead_threads using list_head, clean by thread__put:
> list_del_init(&thread->node).

I sent a different patch for this:

	http://marc.info/?l=linux-kernel&m=145381014011697


> 
> In the above command, it clean a thread before adding it into list,
> causes the above segfault.
> 
> This patch gives a fake list_head and link the thread into it before
> calling thread__zput(), get rid of the segfault.
> 
> After this patch:
>  # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs
>  Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field.
>  intel_pt_synth_events: failed to synthesize 'instructions' event type
>  0x248 [0x88]: failed to process type: 70
> 
> Reported-by: Tong Zhang <ztong@vt.edu>
> Signed-off-by: Wang Nan <wangnan0@huawei.com>
> Cc: Adrian Hunter <adrian.hunter@intel.com>
> Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
> Cc: Josh Poimboeuf <jpoimboe@redhat.com>
> ---
>  tools/perf/util/intel-pt.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
> index 81a2eb7..e2add63 100644
> --- a/tools/perf/util/intel-pt.c
> +++ b/tools/perf/util/intel-pt.c
> @@ -2013,6 +2013,7 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
>  	struct auxtrace_info_event *auxtrace_info = &event->auxtrace_info;
>  	size_t min_sz = sizeof(u64) * INTEL_PT_PER_CPU_MMAPS;
>  	struct intel_pt *pt;
> +	struct list_head dead_thread;
>  	int err;
>  
>  	if (auxtrace_info->header.size < sizeof(struct auxtrace_info_event) +
> @@ -2153,6 +2154,9 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
>  	return 0;
>  
>  err_delete_thread:
> +	RB_CLEAR_NODE(&pt->unknown_thread->rb_node);
> +	INIT_LIST_HEAD(&dead_thread);
> +	list_add(&pt->unknown_thread->node, &dead_thread);
>  	thread__zput(pt->unknown_thread);
>  err_free_queues:
>  	intel_pt_log_disable();
> 

[toc] | [prev] | [next] | [standalone]

#1326465 — [tip:perf/urgent] perf tools: Fix thread lifetime related segfaut in intel_pt

Commit-ID:  3a4acda1ecbd290973de08250d7dcdfaf5b2fe0f
Gitweb:     http://git.kernel.org/tip/3a4acda1ecbd290973de08250d7dcdfaf5b2fe0f
Author:     Adrian Hunter <adrian.hunter@intel.com>
AuthorDate: Mon, 1 Feb 2016 03:21:04 +0000
Committer:  Arnaldo Carvalho de Melo <acme@redhat.com>
CommitDate: Tue, 2 Feb 2016 12:51:11 -0300

perf tools: Fix thread lifetime related segfaut in intel_pt

intel_pt_process_auxtrace_info() creates a pt->unknown_thread thread
that eventually needs to be freed by the last thread__put() on it, when
its refcount hits zero, which may happen in
intel_pt_process_auxtrace_info() error handling path and triggers the
following segfault, which would happen as well at intel_pt_free, when
tools using this intel_pt codebase frees up resources:

  # perf record -I -e intel_pt/tsc=1,noretcomp=1/u /bin/ls
  0  a  anaconda-ks.cfg  bin   perf.data	perf.data.old  perf-f23-bringup.todo
  [ perf record: Woken up 1 times to write data ]
  [ perf record: Captured and wrote 0.217 MB perf.data ]
  #
  # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs
  Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field.
  intel_pt_synth_events: failed to synthesize 'instructions' event type
  Segmentation fault (core dumped)
  #

The problem is: there's a union in 'struct thread' combines a list_head
and a rb_node. The standard life cycle of a thread is: init rb_node in
the constructor, insert it into machine->threads rbtree using rb_node,
move it to machine->dead_threads using list_head, clean in the last
thread__put: list_del_init(&thread->node).

In the above command, it clean a thread before adding it into list,
causes the above segfault.

Since pt->unknown_thread will never live in an rbtree, initialize its
list node so that when list_del_init() is done on it we don't segfault.

After this patch:

  # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs
  Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field.
  intel_pt_synth_events: failed to synthesize 'instructions' event type
  0x248 [0x88]: failed to process type: 70
  #

Reported-by: Tong Zhang <ztong@vt.edu>
Reported-by: Wang Nan <wangnan0@huawei.com>
Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Link: http://lkml.kernel.org/r/1454296865-19749-1-git-send-email-wangnan0@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
 tools/perf/util/intel-pt.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 81a2eb7..05d8158 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -2068,6 +2068,15 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
 		err = -ENOMEM;
 		goto err_free_queues;
 	}
+
+	/*
+	 * Since this thread will not be kept in any rbtree not in a
+	 * list, initialize its list node so that at thread__put() the
+	 * current thread lifetime assuption is kept and we don't segfault
+	 * at list_del_init().
+	 */
+	INIT_LIST_HEAD(&pt->unknown_thread->node);
+
 	err = thread__set_comm(pt->unknown_thread, "unknown", 0);
 	if (err)
 		goto err_delete_thread;

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web