linux-kernel - [PATCH 5.10.y 0/2] Fixed perf abort when taken branch stack sampling enabled

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241104112736.28554-1-xueshuai@linux.alibaba.com>
Date: Mon,  4 Nov 2024 19:27:34 +0800
From: Shuai Xue <xueshuai@...ux.alibaba.com>
To: stable@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	linux-perf-users@...r.kernel.org,
	acme@...nel.org,
	gregkh@...uxfoundation.org
Cc: adrian.hunter@...el.com,
	alexander.shishkin@...ux.intel.com,
	irogers@...gle.com,
	mark.rutland@....com,
	namhyung@...nel.org,
	peterz@...radead.org,
	acme@...hat.com,
	kprateek.nayak@....com,
	ravi.bangoria@....com,
	sandipan.das@....com,
	anshuman.khandual@....com,
	german.gomez@....com,
	james.clark@....com,
	terrelln@...com,
	seanjc@...gle.com,
	changbin.du@...wei.com,
	liuwenyu7@...wei.com,
	yangjihong1@...wei.com,
	mhiramat@...nel.org,
	ojeda@...nel.org,
	song@...nel.org,
	leo.yan@...aro.org,
	kjain@...ux.ibm.com,
	ak@...ux.intel.com,
	kan.liang@...ux.intel.com,
	atrajeev@...ux.vnet.ibm.com,
	siyanteng@...ngson.cn,
	liam.howlett@...cle.com,
	pbonzini@...hat.com,
	jolsa@...nel.org
Subject: [PATCH 5.10.y 0/2] Fixed perf abort when taken branch stack sampling enabled

On x86 platform, kernel v5.10.228, perf-report command aborts due to "free():
invalid pointer" when perf-record command is run with taken branch stack
sampling enabled. This regression can be reproduced with the following steps:

	- sudo perf record -b
	- sudo perf report

The root cause is that bi[i].to.ms.maps does not always point to thread->maps,
which is a buffer dynamically allocated by maps_new(). Instead, it may point to
&machine->kmaps, while kmaps is not a pointer but a variable. The original
upstream commit c1149037f65b ("perf hist: Add missing puts to
hist__account_cycles") worked well because machine->kmaps had been refactored to
a pointer by the previous commit 1a97cee604dc ("perf maps: Use a pointer for
kmaps").

The memory leak issue, which the reverted patch intended to fix, has been solved
by commit cf96b8e45a9b ("perf session: Add missing evlist__delete when deleting
a session"). The root cause is that the evlist is not being deleted on exit in
perf-report, perf-script, and perf-data. Consequently, the reference count of
the thread increased by thread__get() in hist_entry__init() is not decremented
in hist_entry__delete(). As a result, thread->maps is not properly freed.

To this end,

- PATCH 1/2 reverts commit a83fc293acd5c5050a4828eced4a71d2b2fffdd3 to fix the
  abort regression.
- PATCH 2/2 backports cf96b8e45a9b ("perf session: Add missing evlist__delete
  when deleting a session") to fix memory leak issue.

Riccardo Mancini (1):
  perf session: Add missing evlist__delete when deleting a session

Shuai Xue (1):
  Revert "perf hist: Add missing puts to hist__account_cycles"

 tools/perf/util/hist.c    | 10 +++-------
 tools/perf/util/session.c |  5 ++++-
 2 files changed, 7 insertions(+), 8 deletions(-)

-- 
2.39.3