From nobody Tue Sep 16 19:48:46 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8C18FC3DA7D for ; Thu, 29 Dec 2022 12:52:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S233449AbiL2MwY (ORCPT ); Thu, 29 Dec 2022 07:52:24 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:40972 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233539AbiL2Mva (ORCPT ); Thu, 29 Dec 2022 07:51:30 -0500 Received: from szxga08-in.huawei.com (szxga08-in.huawei.com [45.249.212.255]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 4C8A01408D; Thu, 29 Dec 2022 04:51:08 -0800 (PST) Received: from kwepemm600003.china.huawei.com (unknown [172.30.72.57]) by szxga08-in.huawei.com (SkyGuard) with ESMTP id 4NjSs80mMqz16Lvr; Thu, 29 Dec 2022 20:49:48 +0800 (CST) Received: from localhost.localdomain (10.67.174.95) by kwepemm600003.china.huawei.com (7.193.23.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) id 15.1.2375.34; Thu, 29 Dec 2022 20:51:05 +0800 From: Yang Jihong To: , , , , , , , , , CC: Subject: [PATCH v2] perf record: Fix coredump with --overwrite and --max-size Date: Thu, 29 Dec 2022 12:47:28 +0000 Message-ID: <20221229124728.66515-1-yangjihong1@huawei.com> X-Mailer: git-send-email 2.30.GIT MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.67.174.95] X-ClientProxiedBy: dggems701-chm.china.huawei.com (10.3.19.178) To kwepemm600003.china.huawei.com (7.193.23.202) X-CFilter-Loop: Reflected Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" When --overwrite and --max-size options of perf record are used together, a segmentation fault occurs. The following is an example: # perf record -e sched:sched* --overwrite --max-size 1M -a -- sleep 1 [ perf record: Woken up 1 times to write data ] perf: Segmentation fault Obtained 1 stack frames. [0xc4c67f] Segmentation fault (core dumped) backtrace of the core file is as follows: #0 0x0000000000417990 in process_locked_synthesized_event (tool=3D0x0, e= vent=3D0x15, sample=3D0x1de0, machine=3D0xf8) at builtin-record.c:630 #1 0x000000000057ee53 in perf_event__synthesize_threads (nr_threads_synt= hesize=3D21, mmap_data=3D, needs_mmap=3D, mac= hine=3D0x17ad9b0, process=3D, tool=3D0x0) at util/synthetic-= events.c:1950 #2 __machine__synthesize_threads (nr_threads_synthesize=3D0, data_mmap= =3D, needs_mmap=3D, process=3D= , threads=3D0x8, target=3D0x8, tool=3D0x0, machine=3D0x17ad9b0) at util/syn= thetic-events.c:1936 #3 machine__synthesize_threads (machine=3D0x17ad9b0, target=3D0x8, threa= ds=3D0x8, needs_mmap=3D, data_mmap=3D, nr_thr= eads_synthesize=3D0) at util/synthetic-events.c:1947 #4 0x000000000040165d in record__synthesize (tail=3D, rec= =3D0xbe2520 ) at builtin-record.c:2010 #5 0x0000000000403989 in __cmd_record (argc=3D, argv=3D, rec=3D0xbe2520 ) at builtin-record.c:2810 #6 0x00000000004196ba in record__init_thread_user_masks (rec=3D0xbe2520 = , cpus=3D0x17a65f0) at builtin-record.c:3837 #7 record__init_thread_masks (rec=3D0xbe2520 ) at builtin-record= .c:3938 #8 cmd_record (argc=3D1, argv=3D0x7ffdd692dc60) at builtin-record.c:4241 #9 0x00000000004b701d in pager_command_config (var=3D0x0, value=3D0x15 <= error: Cannot access memory at address 0x15>, data=3D0x1de0) at perf.c:117 #10 0x00000000004b732b in get_leaf_frame_caller_aarch64 (sample=3D0xfffff= ffb, thread=3D0x0, usr_idx=3D) at util/arm64-frame-pointer-u= nwind-support.c:56 #11 0x0000000000406331 in execv_dashed_external (argv=3D0x7ffdd692d9e8) a= t perf.c:410 #12 run_argv (argcp=3D, argv=3D) at= perf.c:431 #13 main (argc=3D, argv=3D0x7ffdd692d9e8) at perf.c:562 The reason is that record__bytes_written accesses the freed memory rec->thr= ead_data, The process is as follows: __cmd_record -> record__free_thread_data -> zfree(&rec->thread_data) // free rec->thread_data -> record__synthesize -> perf_event__synthesize_id_index -> process_synthesized_event -> record__write -> record__bytes_written // access rec->thread_data we only need to check the value of done first. Also add variable check in record__bytes_written for code hardening, and save bytes_written separately to reduce one calculation. Fixes: 6d57581659f7 ("perf record: Add support for limit perf output file s= ize") Signed-off-by: Yang Jihong --- Changes since v1: - Add variable check in record__bytes_written for code hardening. - Save bytes_written separately to reduce one calculation. - Remove rec->opts.tail_synthesize check. tools/perf/builtin-record.c | 26 +++++++++++++++++--------- 1 file changed, 17 insertions(+), 9 deletions(-) diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c index 29dcd454b8e2..acba9e43e519 100644 --- a/tools/perf/builtin-record.c +++ b/tools/perf/builtin-record.c @@ -230,16 +230,29 @@ static u64 record__bytes_written(struct record *rec) u64 bytes_written =3D rec->bytes_written; struct record_thread *thread_data =3D rec->thread_data; =20 + if (thread_data =3D=3D NULL) + return bytes_written; + for (t =3D 0; t < rec->nr_threads; t++) bytes_written +=3D thread_data[t].bytes_written; =20 return bytes_written; } =20 -static bool record__output_max_size_exceeded(struct record *rec) +static void record__check_output_max_size_exceeded(struct record *rec) { - return rec->output_max_size && - (record__bytes_written(rec) >=3D rec->output_max_size); + u64 bytes_written; + + if (rec->output_max_size =3D=3D 0 || done) + return; + + bytes_written =3D record__bytes_written(rec); + if (bytes_written >=3D rec->output_max_size) { + fprintf(stderr, "[ perf record: perf size limit reached (%" PRIu64 " KB)= ," + " stopping session ]\n", bytes_written >> 10); + + done =3D 1; + } } =20 static int record__write(struct record *rec, struct mmap *map __maybe_unus= ed, @@ -260,12 +273,7 @@ static int record__write(struct record *rec, struct mm= ap *map __maybe_unused, else rec->bytes_written +=3D size; =20 - if (record__output_max_size_exceeded(rec) && !done) { - fprintf(stderr, "[ perf record: perf size limit reached (%" PRIu64 " KB)= ," - " stopping session ]\n", - record__bytes_written(rec) >> 10); - done =3D 1; - } + record__check_output_max_size_exceeded(rec); =20 if (switch_output_size(rec)) trigger_hit(&switch_output_trigger); --=20 2.30.GIT