perf, tools, stat: Use xyarray dimensions to iterate fds

Poisoned by user: f7
ASan internal: fe

From: Andi Kleen <[email protected]>

perf stat can retry opening events. After opening an file descriptor it adds the ids to the ecsel. Each event keeps a running count of ids.

When we decide to close an evsel and retry
with a different configuration this count needs to be reset, otherwise it can overflow the buffer.

Always reset the ids count.

This fixes the following problem, triggered by a complex perf stat configuration.

==666== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x600600001500 at pc 0x59dfd7 bp 0x7ffc6b397000 sp 0x7ffc6b396ff8 WRITE of size 8 at 0x600600001500 thread T0

    #0 0x59dfd6 in perf_evlist__id_add /home/ak/hle/linux-hle-2.6/tools/perf/util/evlist.c:515
    #1 0x59e291 in perf_evlist__id_add_fd /home/ak/hle/linux-hle-2.6/tools/perf/util/evlist.c:555
    #2 0x4865c6 in __store_counter_ids /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:570
    #3 0x4867d0 in store_counter_ids /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:587
    #4 0x487521 in __run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:703
    #5 0x487d6d in run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:805
    #6 0x492914 in cmd_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:2839
    #7 0x57479a in run_builtin /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:296
    #8 0x574b5f in handle_internal_command /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:348
    #9 0x574e3c in run_argv /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:392
    #10 0x575401 in main /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:536
    #11 0x7f7597af96e4 in __libc_start_main (/lib64/libc.so.6+0x206e4)
    #12 0x444598 in _start /home/abuild/rpmbuild/BUILD/glibc-2.22/csu/../sysdeps/x86_64/start.S:118
0x600600001500 is located 0 bytes to the right of 32-byte region [0x6006000014e0,0x600600001500)
allocated by thread T0 here:
    #0 0x7f759a698ab5 in calloc (/usr/lib64/libasan.so.0+0x15ab5)
    #1 0x5a6045 in zalloc /home/ak/hle/linux-hle-2.6/tools/perf/util/util.h:22
    #2 0x5ab51a in perf_evsel__alloc_id /home/ak/hle/linux-hle-2.6/tools/perf/util/evsel.c:1158
    #3 0x4867ae in store_counter_ids /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:584
    #4 0x487521 in __run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:703
    #5 0x487d6d in run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:805
    #6 0x492914 in cmd_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:2839
    #7 0x57479a in run_builtin /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:296
    #8 0x574b5f in handle_internal_command /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:348
    #9 0x574e3c in run_argv /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:392
    #10 0x575401 in main /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:536
    #11 0x7f7597af96e4 in __libc_start_main (/lib64/libc.so.6+0x206e4)

SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ak/hle/linux-hle-2.6/tools/perf/util/evlist.c:515 perf_evlist__id_add Shadow bytes around the buggy address:
0x0c013fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c013fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c013fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c013fff8280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c013fff8290: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00
=>0x0c013fff82a0:[fa]fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
0x0c013fff82b0: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
0x0c013fff82c0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
0x0c013fff82d0: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
0x0c013fff82e0: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
0x0c013fff82f0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07

  Heap left redzone:     fa
  Heap righ redzone:     fb
  Freed Heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe

Signed-off-by Andi Kleen <[email protected]>

---
 tools/perf/builtin-stat.c | 1 +
 1 file changed, 1 insertion(+)

tools/perf/builtin-stat.c +1 -0

index 3c697118e44b..b54ec8497f97 100644
@@ -652,6 +652,7 @@ static int __run_perf_stat(int argc, const char **argv)
 
 	evlist__for_each_entry(evsel_list, counter) {
 try_again:
+		counter->ids = 0;
 		if (create_perf_stat_counter(counter) < 0) {
 
 			/* Weak group failed. Reset the group. */

Signature · 1 line

2.13.6

Em Thu, Oct 05, 2017 at 07:00:29PM -0700, Andi Kleen escreveu:

Quoted 5 lines

From: Andi Kleen <[email protected]>

perf stat can retry opening events. After opening an file descriptor it adds the ids to the ecsel. Each event keeps a running count of ids.

Ok, and that is done in perf_evlist__id_add() where we also add things to the evlist->heads hashtable, shouldn't we remove all these before retrying? I.e. perf_evlist__close() shouldn't be resetting that hashtable?

I.e. like in the following patch? Jiri? Namhyung?

tools/perf/util/evlist.c +11 -3

index 7b7d535396f7..e8942456106e 100644
@@ -37,13 +37,18 @@
 #define FD(e, x, y) (*(int *)xyarray__entry(e->fd, x, y))
 #define SID(e, x, y) xyarray__entry(e->sample_id, x, y)
 
-void perf_evlist__init(struct perf_evlist *evlist, struct cpu_map *cpus,
-		       struct thread_map *threads)
+static void perf_evlist__init_heads(struct perf_evlist *evlist)
 {
 	int i;
 
 	for (i = 0; i < PERF_EVLIST__HLIST_SIZE; ++i)
 		INIT_HLIST_HEAD(&evlist->heads[i]);
+}
+
+void perf_evlist__init(struct perf_evlist *evlist, struct cpu_map *cpus,
+		       struct thread_map *threads)
+{
+	perf_evlist__init_heads(evlist);
 	INIT_LIST_HEAD(&evlist->entries);
 	perf_evlist__set_maps(evlist, cpus, threads);
 	fdarray__init(&evlist->pollfd, 64);

@@ -1381,8 +1386,11 @@ void perf_evlist__close(struct perf_evlist *evlist)
 {
 	struct perf_evsel *evsel;
 
-	evlist__for_each_entry_reverse(evlist, evsel)
+	evlist__for_each_entry_reverse(evlist, evsel) {
 		perf_evsel__close(evsel);
+	}
+
+	perf_evlist__init_heads(evlist);
 }
 
 static int perf_evlist__create_syswide_maps(struct perf_evlist *evlist)

tools/perf/util/evsel.c +0 -0

index ef351688b797..fba708bc9d98 100644

From: Andi Kleen <[email protected]>

perf stat can retry opening events. After opening an file descriptor it adds the ids to the ecsel. Each event keeps a running count of ids. When we decide to close an evsel and retry with a different configuration this count needs to be reset, otherwise it can overflow the buffer.

Quoted 1 line

From: Andi Kleen <[email protected]>

ouch, sry for overlooking this

Quoted 6 lines

perf stat can retry opening events. After opening an file descriptor it adds the ids to the ecsel. Each event keeps a running count of ids. When we decide to close an evsel and retry with a different configuration this count needs to be reset, otherwise it can overflow the buffer.

how can this happen? we call store_counter_ids at the end of the loop, when the evsel is all done and can't be reconfigured

Em Wed, Feb 21, 2018 at 03:31:17PM +0100, Jiri Olsa escreveu:

Quoted 12 lines · Andi Kleen

Quoted 1 line

From: Andi Kleen <[email protected]>

ouch, sry for overlooking this

Quoted 6 lines

perf stat can retry opening events. After opening an file descriptor it adds the ids to the ecsel. Each event keeps a running count of ids. When we decide to close an evsel and retry with a different configuration this count needs to be reset, otherwise it can overflow the buffer.

Quoted 3 lines

how can this happen? we call store_counter_ids at the end of the loop, when the evsel is all done and can't be reconfigured

Yeah, I couldn't figure out the exact sequence, but I think that we need to reset those hash tables when doing a perf_evlist__close(), no? I.e. when we open we may get new ids, so need to rehash?

From: Andi Kleen <[email protected]>

Now that the xyarray stores the dimensions we can use those to iterate over the FDs for a evsel.

Signed-off-by Andi Kleen <[email protected]>

---
 tools/perf/builtin-stat.c | 11 +++++------
 1 file changed, 5 insertions(+), 6 deletions(-)

tools/perf/builtin-stat.c +5 -6

index dd525417880a..3c697118e44b 100644
@@ -557,14 +557,13 @@ static int perf_stat_synthesize_config(bool is_pipe)
 
 #define FD(e, x, y) (*(int *)xyarray__entry(e->fd, x, y))
 
-static int __store_counter_ids(struct perf_evsel *counter,
-			       struct cpu_map *cpus,
-			       struct thread_map *threads)
+static int __store_counter_ids(struct perf_evsel *counter)
 {
 	int cpu, thread;
 
-	for (cpu = 0; cpu < cpus->nr; cpu++) {
-		for (thread = 0; thread < threads->nr; thread++) {
+	for (cpu = 0; cpu < xyarray__max_x(counter->fd); cpu++) {
+		for (thread = 0; thread < xyarray__max_y(counter->fd);
+		     thread++) {
 			int fd = FD(counter, cpu, thread);
 
 			if (perf_evlist__id_add_fd(evsel_list, counter,

@@ -584,7 +583,7 @@ static int store_counter_ids(struct perf_evsel *counter)
 	if (perf_evsel__alloc_id(counter, cpus->nr, threads->nr))
 		return -ENOMEM;
 
-	return __store_counter_ids(counter, cpus, threads);
+	return __store_counter_ids(counter);
 }
 
 static bool perf_evsel__should_store_id(struct perf_evsel *counter)

Signature · 1 line

2.13.6

Quoted 6 lines

From: Andi Kleen <[email protected]>

Now that the xyarray stores the dimensions we can use those to iterate over the FDs for a evsel.

Signed-off-by Andi Kleen <[email protected]>

Acked-by Jiri Olsa <[email protected]>