linux-kernel - Re: [PATCH] perf map: Fix refcount errors on Arm with -DREFCNT

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZIdYkRHj8tkaxgED@kernel.org>
Date:   Mon, 12 Jun 2023 14:40:33 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Ian Rogers <irogers@...gle.com>
Cc:     James Clark <james.clark@....com>,
        linux-perf-users@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Jiri Olsa <jolsa@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Adrian Hunter <adrian.hunter@...el.com>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] perf map: Fix refcount errors on Arm with
 -DREFCNT_CHECKING=1

Em Mon, Jun 12, 2023 at 02:29:42PM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Mon, Jun 12, 2023 at 09:32:30AM -0700, Ian Rogers escreveu:
> > On Mon, Jun 12, 2023 at 8:05 AM James Clark <james.clark@....com> wrote:
> > >
> > > When quitting after running a perf report, the refcount checker finds
> > > some double frees. The issue is that map__put() is called on a function
> > > argument so it removes the refcount wrapper that someone else was using.
> > >
> > > Fix it by only calling map__put() on a reference that is owned by this
> > > function.
> > >
> > > Signed-off-by: James Clark <james.clark@....com>
> > 
> > Acked-by: Ian Rogers <irogers@...gle.com>
> > 
> > > ---
> > >  tools/perf/util/symbol-elf.c | 9 +++++----
> > >  tools/perf/util/symbol.c     | 9 +++++----
> > >  2 files changed, 10 insertions(+), 8 deletions(-)
> > >
> > > diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
> > > index 63882a4db5c7..ec0d7810bbb0 100644
> > > --- a/tools/perf/util/symbol-elf.c
> > > +++ b/tools/perf/util/symbol-elf.c
> > > @@ -1365,6 +1365,7 @@ static int dso__process_kernel_symbol(struct dso *dso, struct map *map,
> > >         struct dso *curr_dso = *curr_dsop;
> > >         struct map *curr_map;
> > >         char dso_name[PATH_MAX];
> > > +       struct map *map_ref;
> > 
> > nit: can we narrow the scope of this by moving it to the scope where it is used.
> 
> Which is what you did in a patch I already processed, its only in
> tmp.perf-tools-next as I was going thru the other patches, but this one
> is there already.
> 
> I'm checking the tools/perf/util/symbol.c part.

I narrowed the scope and removed the symbol-elf.c part, end result:

>From 6fd34445b8c94aa7f519fb0b1ed45c7ef9f6cc4e Mon Sep 17 00:00:00 2001
From: James Clark <james.clark@....com>
Date: Mon, 12 Jun 2023 16:04:24 +0100
Subject: [PATCH 1/1] perf map: Fix double 'struct map' reference free found
 with -DREFCNT_CHECKING=1

When quitting after running a 'perf report', the refcount checker finds
some double frees. The issue is that map__put() is called on a function
argument so it removes the refcount wrapper that someone else was using.

Fix it by only calling map__put() on a reference that is owned by this
function.

Committer notes:

Narrowed the map_ref scope as suggested by Ian, removed the symbol-elf
part as it was already fixed by another patch, from Ian.

Signed-off-by: James Clark <james.clark@....com>
Acked-by: Ian Rogers <irogers@...gle.com>
Cc: Adrian Hunter <adrian.hunter@...el.com>
Cc: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Cc: Ingo Molnar <mingo@...hat.com>
Cc: Jiri Olsa <jolsa@...nel.org>
Cc: Mark Rutland <mark.rutland@....com>
Cc: Namhyung Kim <namhyung@...nel.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Link: https://lore.kernel.org/r/20230612150424.198914-1-james.clark@arm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
---
 tools/perf/util/symbol.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 6b9c55784b56a4be..d275d3bef7d54a40 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1458,16 +1458,18 @@ static int dso__load_kcore(struct dso *dso, struct map *map,
 		list_del_init(&new_node->node);
 
 		if (RC_CHK_ACCESS(new_map) == RC_CHK_ACCESS(replacement_map)) {
+			struct map *map_ref;
+
 			map__set_start(map, map__start(new_map));
 			map__set_end(map, map__end(new_map));
 			map__set_pgoff(map, map__pgoff(new_map));
 			map__set_map_ip(map, map__map_ip_ptr(new_map));
 			map__set_unmap_ip(map, map__unmap_ip_ptr(new_map));
 			/* Ensure maps are correctly ordered */
-			map__get(map);
-			maps__remove(kmaps, map);
-			err = maps__insert(kmaps, map);
-			map__put(map);
+			map_ref = map__get(map);
+			maps__remove(kmaps, map_ref);
+			err = maps__insert(kmaps, map_ref);
+			map__put(map_ref);
 			map__put(new_map);
 			if (err)
 				goto out_err;
-- 
2.37.1