[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <20190726211415.GE24867@kernel.org>
Date: Fri, 26 Jul 2019 18:14:15 -0300
From: Arnaldo Carvalho de Melo <arnaldo.melo@...il.com>
To: Vince Weaver <vincent.weaver@...ne.edu>
Cc: Arnaldo Carvalho de Melo <arnaldo.melo@...il.com>,
linux-kernel@...r.kernel.org,
Peter Zijlstra <peterz@...radead.org>,
Ingo Molnar <mingo@...hat.com>,
Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
Jiri Olsa <jolsa@...hat.com>,
Namhyung Kim <namhyung@...nel.org>
Subject: Re: perf: perf report stuck in an infinite loop
Em Fri, Jul 26, 2019 at 04:46:51PM -0400, Vince Weaver escreveu:
>
> Currently the perf_data_fuzzer causes perf report to get stuck in an
> infinite loop.
>
> >From what I can tell, the issue happens in reader__process_events()
> when an event is mapped using mmap(), but when it goes to process the
> event finds out the internal event header has the size (invalidly) set to
> something much larger than the mmap buffer size. This means
> fetch_mmaped_event() fails, which gotos remap: which tries again with
> the exact same mmap size, and this will loop forever.
>
> I haven't been able to puzzle out how to fix this, but maybe you have a
> better feel for what's going on here.
Perhaps the patch below?
diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 37efa1f43d8b..f670c028f84b 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -1,6 +1,7 @@
// SPDX-License-Identifier: GPL-2.0
#include <errno.h>
#include <inttypes.h>
+#include <linux/err.h>
#include <linux/kernel.h>
#include <linux/zalloc.h>
#include <traceevent/event-parse.h>
@@ -1954,7 +1955,7 @@ fetch_mmaped_event(struct perf_session *session,
/* We're not fetching the event so swap back again */
if (session->header.needs_swap)
perf_event_header__bswap(&event->header);
- return NULL;
+ return ERR_PTR(-EINVAL);
}
return event;
@@ -1972,6 +1973,9 @@ static int __perf_session__process_decomp_events(struct perf_session *session)
while (decomp->head < decomp->size && !session_done()) {
union perf_event *event = fetch_mmaped_event(session, decomp->head, decomp->size, decomp->data);
+ if (IS_ERR(event))
+ return PTR_ERR(event);
+
if (!event)
break;
@@ -2071,6 +2075,9 @@ reader__process_events(struct reader *rd, struct perf_session *session,
more:
event = fetch_mmaped_event(session, head, mmap_size, buf);
+ if (IS_ERR(event))
+ return PTR_ERR(event);
+
if (!event) {
if (mmaps[map_idx]) {
munmap(mmaps[map_idx], mmap_size);
Powered by blists - more mailing lists