perf tools: Fix crash in ordered_events__free
Jiri Olsa
reviewerPATCH 1/1 perf tools: Fix crash in ordered_events__free
Song Liu reported crash in perf record:
Quoted 6 lines
#0 0x0000000000500055 in ordered_events(float, long double,...)(...) () #1 0x0000000000500196 in ordered_events.reinit () #2 0x00000000004fe413 in perf_session.process_events () #3 0x0000000000440431 in cmd_record () #4 0x00000000004a439f in run_builtin () #5 0x000000000042b3e5 in main ()"
This can happen when we get out of the buffers during event processing. The subsequent ordered_events__free assumes the oe->buffer != NULL and crashes. Adding the check to prevent that.
--- tools/perf/util/ordered-events.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/perf/util/ordered-events.c +4 -2
@@ -391,8 +391,10 @@ void ordered_events__free(struct ordered_events *oe)* Current buffer might not have all the events allocated * yet, we need to free only allocated ones ... */ -list_del (&oe->buffer->list); -ordered_events_buffer__free (oe->buffer, oe->buffer_idx, oe); +if (oe->buffer) { +list_del (&oe->buffer->list); +ordered_events_buffer__free (oe->buffer, oe->buffer_idx, oe); + }/* ... and continue with the rest */ list_for_each_entry_safe (buffer, tmp, &oe->to_free, list) {
Signature · 1 line
2.17.2
Quoted 15 lines · Jiri Olsa
Song Liu reported crash in perf record:
Quoted 6 lines
#0 0x0000000000500055 in ordered_events(float, long double,...)(...) () #1 0x0000000000500196 in ordered_events.reinit () #2 0x00000000004fe413 in perf_session.process_events () #3 0x0000000000440431 in cmd_record () #4 0x00000000004a439f in run_builtin () #5 0x000000000042b3e5 in main ()"This can happen when we get out of the buffers during event processing. The subsequent
ordered_events__freeassumes theoe->buffer!= NULL and crashes. Adding the check to prevent that.
Quoted 5 lines
Cc Stephane Eranian <[email protected]>Fixes d5ceb62b3654 ("perf ordered_events: Add 'struct ordered_events_buffer' layer")Reported-by Song Liu <[email protected]>Signed-off-by Jiri Olsa <[email protected]>
Thanks again for the fix!
Song
Quoted 24 lines
--- tools/perf/util/ordered-events.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)tools/perf/util/ordered-events.c +4
-3@@ -391,8 +391,10 @@ void ordered_events__free(struct ordered_events *oe)* Current buffer might not have all the events allocated * yet, we need to free only allocated ones ... */ -list_del (&oe->buffer->list); -ordered_events_buffer__free (oe->buffer, oe->buffer_idx, oe); +if (oe->buffer) { +list_del (&oe->buffer->list); +ordered_events_buffer__free (oe->buffer, oe->buffer_idx, oe); + }/* ... and continue with the rest */ list_for_each_entry_safe (buffer, tmp, &oe->to_free, list) { --2.17.2
Em Thu, Jan 17, 2019 at 06:03:04AM -0800, Song Liu escreveu:
Quoted 22 lines · Jiri Olsa
Quoted 15 lines
Song Liu reported crash in perf record:
Quoted 6 lines
#0 0x0000000000500055 in ordered_events(float, long double,...)(...) () #1 0x0000000000500196 in ordered_events.reinit () #2 0x00000000004fe413 in perf_session.process_events () #3 0x0000000000440431 in cmd_record () #4 0x00000000004a439f in run_builtin () #5 0x000000000042b3e5 in main ()"This can happen when we get out of the buffers during event processing. The subsequent
ordered_events__freeassumes theoe->buffer!= NULL and crashes. Adding the check to prevent that.Quoted 5 lines
Cc Stephane Eranian <[email protected]>Fixes d5ceb62b3654 ("perf ordered_events: Add 'struct ordered_events_buffer' layer")Reported-by Song Liu <[email protected]>Signed-off-by Jiri Olsa <[email protected]>
Quoted 3 lines
Reviewed-and-tested-by Song Liu <[email protected]>Thanks again for the fix!
Thanks, applied to acme/perf/urgent,
- Arnaldo
tip-bot for Jiri Olsa
merge bot[tip:perf/urgent] perf ordered_events: Fix crash in ordered_events__free
In reply to Jiri Olsaperf ordered_events: Fix crash in ordered_events__free
Commit-ID: 99d86c8b88393e29cf07c020585f2c8afbcdd97d Gitweb: https://git.kernel.org/tip/99d86c8b88393e29cf07c020585f2c8afbcdd97d Author: Jiri Olsa <[email protected]> AuthorDate: Thu, 17 Jan 2019 12:30:17 +0100 Committer: Arnaldo Carvalho de Melo <[email protected]> CommitDate: Thu, 17 Jan 2019 11:07:00 -0300
perf ordered_events: Fix crash in ordered_events__free
Song Liu reported crash in 'perf record':
Quoted 6 lines
#0 0x0000000000500055 in ordered_events(float, long double,...)(...) () #1 0x0000000000500196 in ordered_events.reinit () #2 0x00000000004fe413 in perf_session.process_events () #3 0x0000000000440431 in cmd_record () #4 0x00000000004a439f in run_builtin () #5 0x000000000042b3e5 in main ()"
This can happen when we get out of buffers during event processing.
The subsequent ordered_events__free() call assumes oe->buffer != NULL and crashes. Add a check to prevent that.
--- tools/perf/util/ordered-events.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-)
tools/perf/util/ordered-events.c +4 -2
@@ -391,8 +391,10 @@ void ordered_events__free(struct ordered_events *oe)* Current buffer might not have all the events allocated * yet, we need to free only allocated ones ... */ -list_del (&oe->buffer->list); -ordered_events_buffer__free (oe->buffer, oe->buffer_idx, oe); +if (oe->buffer) { +list_del (&oe->buffer->list); +ordered_events_buffer__free (oe->buffer, oe->buffer_idx, oe); + }/* ... and continue with the rest */ list_for_each_entry_safe (buffer, tmp, &oe->to_free, list) {