Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1322803 > unrolled thread
| Started by | Wang Nan <wangnan0@huawei.com> |
|---|---|
| First post | 2016-02-01 04:30 +0100 |
| Last post | 2016-02-04 09:00 +0100 |
| Articles | 3 — 3 participants |
Back to article view | Back to linux.kernel
[PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info() Wang Nan <wangnan0@huawei.com> - 2016-02-01 04:30 +0100
Re: [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info() Adrian Hunter <adrian.hunter@intel.com> - 2016-02-01 10:00 +0100
[tip:perf/urgent] perf tools: Fix thread lifetime related segfaut in intel_pt tip-bot for Adrian Hunter <tipbot@zytor.com> - 2016-02-04 09:00 +0100
| From | Wang Nan <wangnan0@huawei.com> |
|---|---|
| Date | 2016-02-01 04:30 +0100 |
| Subject | [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info() |
| Message-ID | <qXdlD-4Sy-3@gated-at.bofh.it> |
In error processing path of intel_pt_process_auxtrace_info() it calls thread__zput() to clean and free pt->unknown_thread which is created by thread__new(). However, when error raise, a segfault happen: # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. intel_pt_synth_events: failed to synthesize 'instructions' event type Segmentation fault (core dumped) The problem is: there's a union in 'struct thread' combines a list_head and a rb_node. The standard life cycle of a thread is: init rb_node during creating, inserted into machine->threads rbtree uses rb_node, move to machine->dead_threads using list_head, clean by thread__put: list_del_init(&thread->node). In the above command, it clean a thread before adding it into list, causes the above segfault. This patch gives a fake list_head and link the thread into it before calling thread__zput(), get rid of the segfault. After this patch: # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. intel_pt_synth_events: failed to synthesize 'instructions' event type 0x248 [0x88]: failed to process type: 70 Reported-by: Tong Zhang <ztong@vt.edu> Signed-off-by: Wang Nan <wangnan0@huawei.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Josh Poimboeuf <jpoimboe@redhat.com> --- tools/perf/util/intel-pt.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c index 81a2eb7..e2add63 100644 --- a/tools/perf/util/intel-pt.c +++ b/tools/perf/util/intel-pt.c @@ -2013,6 +2013,7 @@ int intel_pt_process_auxtrace_info(union perf_event *event, struct auxtrace_info_event *auxtrace_info = &event->auxtrace_info; size_t min_sz = sizeof(u64) * INTEL_PT_PER_CPU_MMAPS; struct intel_pt *pt; + struct list_head dead_thread; int err; if (auxtrace_info->header.size < sizeof(struct auxtrace_info_event) + @@ -2153,6 +2154,9 @@ int intel_pt_process_auxtrace_info(union perf_event *event, return 0; err_delete_thread: + RB_CLEAR_NODE(&pt->unknown_thread->rb_node); + INIT_LIST_HEAD(&dead_thread); + list_add(&pt->unknown_thread->node, &dead_thread); thread__zput(pt->unknown_thread); err_free_queues: intel_pt_log_disable(); -- 1.8.3.4
[toc] | [next] | [standalone]
| From | Adrian Hunter <adrian.hunter@intel.com> |
|---|---|
| Date | 2016-02-01 10:00 +0100 |
| Subject | Re: [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info() |
| Message-ID | <qXiv1-4W-21@gated-at.bofh.it> |
| In reply to | #1322803 |
On 01/02/16 05:21, Wang Nan wrote: > In error processing path of intel_pt_process_auxtrace_info() it calls > thread__zput() to clean and free pt->unknown_thread which is created by > thread__new(). However, when error raise, a segfault happen: > > # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs > Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. > intel_pt_synth_events: failed to synthesize 'instructions' event type > Segmentation fault (core dumped) > > The problem is: there's a union in 'struct thread' combines a list_head > and a rb_node. The standard life cycle of a thread is: init rb_node during > creating, inserted into machine->threads rbtree uses rb_node, move to > machine->dead_threads using list_head, clean by thread__put: > list_del_init(&thread->node). I sent a different patch for this: http://marc.info/?l=linux-kernel&m=145381014011697 > > In the above command, it clean a thread before adding it into list, > causes the above segfault. > > This patch gives a fake list_head and link the thread into it before > calling thread__zput(), get rid of the segfault. > > After this patch: > # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs > Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. > intel_pt_synth_events: failed to synthesize 'instructions' event type > 0x248 [0x88]: failed to process type: 70 > > Reported-by: Tong Zhang <ztong@vt.edu> > Signed-off-by: Wang Nan <wangnan0@huawei.com> > Cc: Adrian Hunter <adrian.hunter@intel.com> > Cc: Arnaldo Carvalho de Melo <acme@redhat.com> > Cc: Josh Poimboeuf <jpoimboe@redhat.com> > --- > tools/perf/util/intel-pt.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c > index 81a2eb7..e2add63 100644 > --- a/tools/perf/util/intel-pt.c > +++ b/tools/perf/util/intel-pt.c > @@ -2013,6 +2013,7 @@ int intel_pt_process_auxtrace_info(union perf_event *event, > struct auxtrace_info_event *auxtrace_info = &event->auxtrace_info; > size_t min_sz = sizeof(u64) * INTEL_PT_PER_CPU_MMAPS; > struct intel_pt *pt; > + struct list_head dead_thread; > int err; > > if (auxtrace_info->header.size < sizeof(struct auxtrace_info_event) + > @@ -2153,6 +2154,9 @@ int intel_pt_process_auxtrace_info(union perf_event *event, > return 0; > > err_delete_thread: > + RB_CLEAR_NODE(&pt->unknown_thread->rb_node); > + INIT_LIST_HEAD(&dead_thread); > + list_add(&pt->unknown_thread->node, &dead_thread); > thread__zput(pt->unknown_thread); > err_free_queues: > intel_pt_log_disable(); >
[toc] | [prev] | [next] | [standalone]
| From | tip-bot for Adrian Hunter <tipbot@zytor.com> |
|---|---|
| Date | 2016-02-04 09:00 +0100 |
| Subject | [tip:perf/urgent] perf tools: Fix thread lifetime related segfaut in intel_pt |
| Message-ID | <qYmZA-5D0-7@gated-at.bofh.it> |
| In reply to | #1322803 |
Commit-ID: 3a4acda1ecbd290973de08250d7dcdfaf5b2fe0f Gitweb: http://git.kernel.org/tip/3a4acda1ecbd290973de08250d7dcdfaf5b2fe0f Author: Adrian Hunter <adrian.hunter@intel.com> AuthorDate: Mon, 1 Feb 2016 03:21:04 +0000 Committer: Arnaldo Carvalho de Melo <acme@redhat.com> CommitDate: Tue, 2 Feb 2016 12:51:11 -0300 perf tools: Fix thread lifetime related segfaut in intel_pt intel_pt_process_auxtrace_info() creates a pt->unknown_thread thread that eventually needs to be freed by the last thread__put() on it, when its refcount hits zero, which may happen in intel_pt_process_auxtrace_info() error handling path and triggers the following segfault, which would happen as well at intel_pt_free, when tools using this intel_pt codebase frees up resources: # perf record -I -e intel_pt/tsc=1,noretcomp=1/u /bin/ls 0 a anaconda-ks.cfg bin perf.data perf.data.old perf-f23-bringup.todo [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.217 MB perf.data ] # # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. intel_pt_synth_events: failed to synthesize 'instructions' event type Segmentation fault (core dumped) # The problem is: there's a union in 'struct thread' combines a list_head and a rb_node. The standard life cycle of a thread is: init rb_node in the constructor, insert it into machine->threads rbtree using rb_node, move it to machine->dead_threads using list_head, clean in the last thread__put: list_del_init(&thread->node). In the above command, it clean a thread before adding it into list, causes the above segfault. Since pt->unknown_thread will never live in an rbtree, initialize its list node so that when list_del_init() is done on it we don't segfault. After this patch: # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. intel_pt_synth_events: failed to synthesize 'instructions' event type 0x248 [0x88]: failed to process type: 70 # Reported-by: Tong Zhang <ztong@vt.edu> Reported-by: Wang Nan <wangnan0@huawei.com> Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> Cc: Josh Poimboeuf <jpoimboe@redhat.com> Link: http://lkml.kernel.org/r/1454296865-19749-1-git-send-email-wangnan0@huawei.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> --- tools/perf/util/intel-pt.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c index 81a2eb7..05d8158 100644 --- a/tools/perf/util/intel-pt.c +++ b/tools/perf/util/intel-pt.c @@ -2068,6 +2068,15 @@ int intel_pt_process_auxtrace_info(union perf_event *event, err = -ENOMEM; goto err_free_queues; } + + /* + * Since this thread will not be kept in any rbtree not in a + * list, initialize its list node so that at thread__put() the + * current thread lifetime assuption is kept and we don't segfault + * at list_del_init(). + */ + INIT_LIST_HEAD(&pt->unknown_thread->node); + err = thread__set_comm(pt->unknown_thread, "unknown", 0); if (err) goto err_delete_thread;
[toc] | [prev] | [standalone]
Back to top | Article view | linux.kernel
csiph-web