convert_variable_type does not correctly check type of arrays
PATCH 1/1 convert_variable_type does not correctly check type of arrays
While casting an array of (unsigned) chars to a string, perf does not check the containing type but only the opaque type and is bailing out:
$ perf probe -v -a 'neigh_destroy:22 dev->name:string'
probe-definition(0): neigh_destroy:22 dev->name:string
symbol:neigh_destroy file:(null) line:22 offset:0 return:0 lazy:(null)
parsing arg: dev->name:string into type:string dev, name(1)
1 arguments
Use vmlinux: /home/hannes/linux/vmlinux
Using /home/hannes/linux/vmlinux for symbols
Probe point found: neigh_destroy+115
Searching 'dev' variable in context.
Converting variable dev into trace event.
converting name in dev
name type is (null).
Failed to cast into string: name is not (unsigned) char *.
Failed to find 'dev' in this function.
An error occurred in debuginfo analysis (-22).
Error: Failed to add events. (-22)After the code flow ensures that type could only be a pointer or array type, call die_get_real_type unconditionally again to fetch the containing type and have further validation been done on that Die.
--- tools/perf/util/probe-finder.c | 11 ++++++----- 1 file changed, 6 insertions(+), 5 deletions(-)
tools/perf/util/probe-finder.c +6 -5
@@ -413,12 +413,13 @@ static int convert_variable_type(Dwarf_Die *vr_die, dwarf_diename(vr_die), dwarf_diename(&type));return -EINVAL ; } +if (die_get_real_type (&type, &type) ==NULL ) { +pr_warning ("Failed to get a type information.\n" ); +return -ENOENT ; + } +pr_debug ("containing type of %s is %s.\n" , +dwarf_diename (vr_die),dwarf_diename (&type));if (ret == DW_TAG_pointer_type) { -if (die_get_real_type (&type, &type) ==NULL ) { -pr_warning ("Failed to get a type" -" information.\n" ); -return -ENOENT ; - }while (*ref_ptr) ref_ptr = &(*ref_ptr)->next;/* Add new reference with offset +0 */
Namhyung Kim
maintainerHi Hannes,
Quoted 20 lines · Hannes Frederic Sowa
While casting an array of (unsigned) chars to a string, perf does not check the containing type but only the opaque type and is bailing out:
$ perf probe -v -a 'neigh_destroy:22 dev->name:string' probe-definition(0): neigh_destroy:22 dev->name:string symbol:neigh_destroy file:(null) line:22 offset:0 return:0 lazy:(null) parsing arg: dev->name:string into type:string dev, name(1) 1 arguments Use vmlinux: /home/hannes/linux/vmlinux Using /home/hannes/linux/vmlinux for symbols Probe point found: neigh_destroy+115 Searching 'dev' variable in context. Converting variable dev into trace event. converting name in dev name type is (null). Failed to cast into string: name is not (unsigned) char *. Failed to find 'dev' in this function. An error occurred in debuginfo analysis (-22). Error: Failed to add events. (-22)
Quoted 3 lines
After the code flow ensures that type could only be a pointer or array type, call
die_get_real_typeunconditionally again to fetch the containing type and have further validation been done on that Die.
Hyeoncheol posted a same fix before, but not merged yet, Arnaldo?
https://lkml.org/lkml/2012/9/20/3
Thanks,
Namhyung