linux-kernel - Re: [PATCH] perf map: fix infinite loop on map_groups__fixup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Sat, 14 Dec 2019 14:16:21 +0300
From:   Konstantin Khlebnikov <koct9i@...il.com>
To:     Matheus Marchini <mmarchini@...flix.com>
Cc:     linux-perf-users@...r.kernel.org, jkoch@...flix.com,
        Константин Геннадьевич Хлебников <khlebnikov@...dex-team.ru>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Jiri Olsa <jolsa@...hat.com>,
        Namhyung Kim <namhyung@...nel.org>,
        Changbin Du <changbin.du@...el.com>,
        Song Liu <songliubraving@...com>,
        John Keeping <john@...anate.com>,
        Andi Kleen <ak@...ux.intel.com>,
        Linux Kernel Mailing List <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] perf map: fix infinite loop on map_groups__fixup_overlappings

On Wed, Dec 11, 2019 at 7:10 PM Matheus Marchini <mmarchini@...flix.com> wrote:
>t
> In some cases, when using perf inject and there are JIT_CODE_MOVE
> records in the jitdump file, perf will end up in an infinite loop on
> map_groups__fixup_overlappings, which will keep allocating memory
> indefinitely. This issue was observed on Node.js (with changes to
> generate JIT_CODE_MOVE records) and on Java.

Could you show what it prints with -vv ?
I suppose map tree could be broken, like there is zero (or negative) size maps.

This should help to catch that

--- a/tools/perf/util/map.c
+++ b/tools/perf/util/map.c
@@ -848,13 +848,18 @@ static void __maps__insert(struct maps *maps,
struct map *map)
        const u64 ip = map->start;
        struct map *m;

+       assert((map->start < map->end) || !map->end);
+
        while (*p != NULL) {
                parent = *p;
                m = rb_entry(parent, struct map, rb_node);
-               if (ip < m->start)
+               if (ip < m->start) {
+                       assert(map->end <= m->start);
                        p = &(*p)->rb_left;
-               else
+               } else {
+                       assert(m->end <= map->start);
                        p = &(*p)->rb_right;
+               }
        }

        rb_link_node(&map->rb_node, parent, p);


>
> This issue started to occur after 6a9405b56c274 (perf map:
> Optimize maps__fixup_overlappings()). To prevent it from happening,
> partially revert those changes without losing the optimizations
> introduced in it.
>
> Signed-off-by: Matheus Marchini <mmarchini@...flix.com>
> ---
>  tools/perf/util/map.c | 17 +++++++++++++++++
>  tools/perf/util/map.h |  1 +
>  2 files changed, 18 insertions(+)
>
> diff --git a/tools/perf/util/map.c b/tools/perf/util/map.c
> index 744bfbaf35cf..8918fdb8ddab 100644
> --- a/tools/perf/util/map.c
> +++ b/tools/perf/util/map.c
> @@ -781,6 +781,21 @@ static void __map_groups__insert(struct map_groups *mg, struct map *map)
>         __maps__insert(&mg->maps, map);
>  }
>
> +int map__overlap(struct map *l, struct map *r)
> +{
> +       if (l->start > r->start) {
> +               struct map *t = l;
> +
> +               l = r;
> +               r = t;
> +       }
> +
> +       if (l->end > r->start)
> +               return 1;
> +
> +       return 0;
> +}
> +
>  int map_groups__fixup_overlappings(struct map_groups *mg, struct map *map, FILE *fp)
>  {
>         struct maps *maps = &mg->maps;
> @@ -821,6 +836,8 @@ int map_groups__fixup_overlappings(struct map_groups *mg, struct map *map, FILE
>                  */
>                 if (pos->start >= map->end)
>                         break;
> +               if (!map__overlap(map, pos))
> +                       continue;
>
>                 if (verbose >= 2) {
>
> diff --git a/tools/perf/util/map.h b/tools/perf/util/map.h
> index 5e8899883231..1383571437aa 100644
> --- a/tools/perf/util/map.h
> +++ b/tools/perf/util/map.h
> @@ -132,6 +132,7 @@ static inline void __map__zput(struct map **map)
>
>  #define map__zput(map) __map__zput(&map)
>
> +int map__overlap(struct map *l, struct map *r);
>  size_t map__fprintf(struct map *map, FILE *fp);
>  size_t map__fprintf_dsoname(struct map *map, FILE *fp);
>  char *map__srcline(struct map *map, u64 addr, struct symbol *sym);
> --
> 2.17.1
>