linux-kernel - [PATCH 2/2] perf tools: Fix another seg fault using Intel PT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Tue, 26 Jan 2016 14:05:21 +0200
From:	Adrian Hunter <adrian.hunter@...el.com>
To:	Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:	Jiri Olsa <jolsa@...hat.com>, linux-kernel@...r.kernel.org
Subject: [PATCH 2/2] perf tools: Fix another seg fault using Intel PT

Fix segmentation fault using:

	perf record -e intel_pt//u uname
	perf script

Back trace:

  0  __list_del (next=0x1880710, prev=0x0) at /home/ahunter/git/linux/tools/include/linux/list.h:89
  1  __list_del_entry (entry=0x1880710) at /home/ahunter/git/linux/tools/include/linux/list.h:101
  2  list_del_init (entry=0x1880710) at /home/ahunter/git/linux/tools/include/linux/list.h:144
  3  thread__put (thread=0x1880710) at util/thread.c:104
  4  0x00000000004fd699 in intel_pt_free (session=0x186fb90) at util/intel-pt.c:1747
  5  0x00000000004c23cc in auxtrace__free (session=0x186fb90) at util/auxtrace.h:511
  6  perf_session__delete (session=session@...ry=0x186fb90) at util/session.c:181
  7  0x0000000000443398 in cmd_script (argc=<optimized out>, argv=<optimized out>, prefix=<optimized out>) at builtin-script.c:2232
  8  0x000000000047cbd3 in run_builtin (p=p@...ry=0x7cf3a8 <commands+360>, argc=argc@...ry=1, argv=argv@...ry=0x7fffffffe210) at perf.c:390
  9  0x00000000004216a7 in handle_internal_command (argv=0x7fffffffe210, argc=1) at perf.c:451
 10 run_argv (argv=0x7fffffffdf90, argcp=0x7fffffffdf9c) at perf.c:495
 11 main (argc=1, argv=0x7fffffffe210) at perf.c:618

The seg fault happens when Intel PT "puts" a "struct thread"
that has been created as a placeholder for unknown threads.
thread__put() assumes that a thread's list node can be deleted,
which is not true in the case above because of:

       commit fdce6a4edaad ("perf tools: Remove redundant initialization of thread linkage members")

which removed the list node initialization.

Expecting the list node to be re-initialized whenever removing a
thread from an rb-tree seems fragile, so fix by taking the list
node out of union, so that list_del_init() can be used on it with
impunity.

Signed-off-by: Adrian Hunter <adrian.hunter@...el.com>
---
 tools/perf/util/thread.c | 2 ++
 tools/perf/util/thread.h | 6 ++----
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/thread.c b/tools/perf/util/thread.c
index dfd00c6dad6e..e8af90c1e66d 100644
--- a/tools/perf/util/thread.c
+++ b/tools/perf/util/thread.c
@@ -56,6 +56,7 @@ struct thread *thread__new(pid_t pid, pid_t tid)
 
 		list_add(&comm->list, &thread->comm_list);
 		atomic_set(&thread->refcnt, 1);
+		INIT_LIST_HEAD(&thread->node);
 		RB_CLEAR_NODE(&thread->rb_node);
 	}
 
@@ -71,6 +72,7 @@ void thread__delete(struct thread *thread)
 	struct comm *comm, *tmp;
 
 	BUG_ON(!RB_EMPTY_NODE(&thread->rb_node));
+	BUG_ON(!list_empty(&thread->node));
 
 	thread_stack__free(thread);
 
diff --git a/tools/perf/util/thread.h b/tools/perf/util/thread.h
index a0ac0317affb..6430b168a62f 100644
--- a/tools/perf/util/thread.h
+++ b/tools/perf/util/thread.h
@@ -13,10 +13,8 @@
 struct thread_stack;
 
 struct thread {
-	union {
-		struct rb_node	 rb_node;
-		struct list_head node;
-	};
+	struct rb_node		rb_node;
+	struct list_head	node;
 	struct map_groups	*mg;
 	pid_t			pid_; /* Not all tools update this */
 	pid_t			tid;
-- 
1.9.1