mirror of
				https://github.com/torvalds/linux.git
				synced 2025-11-04 10:40:15 +02:00 
			
		
		
		
	The array str[] should have six elements.
  =================================================================
  ==4322==ERROR: AddressSanitizer: global-buffer-overflow on address 0x56463844e300 at pc 0x564637e7ad0d bp 0x7f30c8c89d10 sp 0x7f30c8c89d00
  READ of size 8 at 0x56463844e300 thread T9
      #0 0x564637e7ad0c in __ordered_events__flush util/ordered-events.c:316
      #1 0x564637e7b0e4 in ordered_events__flush util/ordered-events.c:338
      #2 0x564637c6a57d in process_thread /home/changbin/work/linux/tools/perf/builtin-top.c:1073
      #3 0x7f30d173a163 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8163)
      #4 0x7f30cfffbdee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11adee)
  0x56463844e300 is located 32 bytes to the left of global variable 'flags' defined in 'util/trace-event-parse.c:229:26' (0x56463844e320) of size 192
  0x56463844e300 is located 0 bytes to the right of global variable 'str' defined in 'util/ordered-events.c:268:28' (0x56463844e2e0) of size 32
  SUMMARY: AddressSanitizer: global-buffer-overflow util/ordered-events.c:316 in __ordered_events__flush
  Shadow bytes around the buggy address:
    0x0ac947081c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0ac947081c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0ac947081c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0ac947081c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0ac947081c50: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
  =>0x0ac947081c60:[f9]f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
    0x0ac947081c70: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
    0x0ac947081c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0ac947081c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0ac947081ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x0ac947081cb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Partially addressable: 01 02 03 04 05 06 07
    Heap left redzone:       fa
    Freed heap region:       fd
    Stack left redzone:      f1
    Stack mid redzone:       f2
    Stack right redzone:     f3
    Stack after return:      f5
    Stack use after scope:   f8
    Global redzone:          f9
    Global init order:       f6
    Poisoned by user:        f7
    Container overflow:      fc
    Array cookie:            ac
    Intra object redzone:    bb
    ASan internal:           fe
    Left alloca redzone:     ca
    Right alloca redzone:    cb
  Thread T9 created by T0 here:
      #0 0x7f30d179de5f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x4ae5f)
      #1 0x564637c6b954 in __cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1253
      #2 0x564637c7173c in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1642
      #3 0x564637d85038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
      #4 0x564637d85577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
      #5 0x564637d8597b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
      #6 0x564637d860e9 in main /home/changbin/work/linux/tools/perf/perf.c:520
      #7 0x7f30cff0509a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
Signed-off-by: Changbin Du <changbin.du@gmail.com>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Fixes: 16c66bc167 ("perf top: Add processing thread")
Fixes: 68ca5d07de ("perf ordered_events: Add ordered_events__flush_time interface")
Link: http://lkml.kernel.org/r/20190316080556.3075-13-changbin.du@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
		
	
			
		
			
				
	
	
		
			415 lines
		
	
	
	
		
			9.6 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			415 lines
		
	
	
	
		
			9.6 KiB
		
	
	
	
		
			C
		
	
	
	
	
	
// SPDX-License-Identifier: GPL-2.0
 | 
						|
#include <errno.h>
 | 
						|
#include <inttypes.h>
 | 
						|
#include <linux/list.h>
 | 
						|
#include <linux/compiler.h>
 | 
						|
#include <linux/string.h>
 | 
						|
#include "ordered-events.h"
 | 
						|
#include "session.h"
 | 
						|
#include "asm/bug.h"
 | 
						|
#include "debug.h"
 | 
						|
 | 
						|
#define pr_N(n, fmt, ...) \
 | 
						|
	eprintf(n, debug_ordered_events, fmt, ##__VA_ARGS__)
 | 
						|
 | 
						|
#define pr(fmt, ...) pr_N(1, pr_fmt(fmt), ##__VA_ARGS__)
 | 
						|
 | 
						|
static void queue_event(struct ordered_events *oe, struct ordered_event *new)
 | 
						|
{
 | 
						|
	struct ordered_event *last = oe->last;
 | 
						|
	u64 timestamp = new->timestamp;
 | 
						|
	struct list_head *p;
 | 
						|
 | 
						|
	++oe->nr_events;
 | 
						|
	oe->last = new;
 | 
						|
 | 
						|
	pr_oe_time2(timestamp, "queue_event nr_events %u\n", oe->nr_events);
 | 
						|
 | 
						|
	if (!last) {
 | 
						|
		list_add(&new->list, &oe->events);
 | 
						|
		oe->max_timestamp = timestamp;
 | 
						|
		return;
 | 
						|
	}
 | 
						|
 | 
						|
	/*
 | 
						|
	 * last event might point to some random place in the list as it's
 | 
						|
	 * the last queued event. We expect that the new event is close to
 | 
						|
	 * this.
 | 
						|
	 */
 | 
						|
	if (last->timestamp <= timestamp) {
 | 
						|
		while (last->timestamp <= timestamp) {
 | 
						|
			p = last->list.next;
 | 
						|
			if (p == &oe->events) {
 | 
						|
				list_add_tail(&new->list, &oe->events);
 | 
						|
				oe->max_timestamp = timestamp;
 | 
						|
				return;
 | 
						|
			}
 | 
						|
			last = list_entry(p, struct ordered_event, list);
 | 
						|
		}
 | 
						|
		list_add_tail(&new->list, &last->list);
 | 
						|
	} else {
 | 
						|
		while (last->timestamp > timestamp) {
 | 
						|
			p = last->list.prev;
 | 
						|
			if (p == &oe->events) {
 | 
						|
				list_add(&new->list, &oe->events);
 | 
						|
				return;
 | 
						|
			}
 | 
						|
			last = list_entry(p, struct ordered_event, list);
 | 
						|
		}
 | 
						|
		list_add(&new->list, &last->list);
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
static union perf_event *__dup_event(struct ordered_events *oe,
 | 
						|
				     union perf_event *event)
 | 
						|
{
 | 
						|
	union perf_event *new_event = NULL;
 | 
						|
 | 
						|
	if (oe->cur_alloc_size < oe->max_alloc_size) {
 | 
						|
		new_event = memdup(event, event->header.size);
 | 
						|
		if (new_event)
 | 
						|
			oe->cur_alloc_size += event->header.size;
 | 
						|
	}
 | 
						|
 | 
						|
	return new_event;
 | 
						|
}
 | 
						|
 | 
						|
static union perf_event *dup_event(struct ordered_events *oe,
 | 
						|
				   union perf_event *event)
 | 
						|
{
 | 
						|
	return oe->copy_on_queue ? __dup_event(oe, event) : event;
 | 
						|
}
 | 
						|
 | 
						|
static void __free_dup_event(struct ordered_events *oe, union perf_event *event)
 | 
						|
{
 | 
						|
	if (event) {
 | 
						|
		oe->cur_alloc_size -= event->header.size;
 | 
						|
		free(event);
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
static void free_dup_event(struct ordered_events *oe, union perf_event *event)
 | 
						|
{
 | 
						|
	if (oe->copy_on_queue)
 | 
						|
		__free_dup_event(oe, event);
 | 
						|
}
 | 
						|
 | 
						|
#define MAX_SAMPLE_BUFFER	(64 * 1024 / sizeof(struct ordered_event))
 | 
						|
static struct ordered_event *alloc_event(struct ordered_events *oe,
 | 
						|
					 union perf_event *event)
 | 
						|
{
 | 
						|
	struct list_head *cache = &oe->cache;
 | 
						|
	struct ordered_event *new = NULL;
 | 
						|
	union perf_event *new_event;
 | 
						|
	size_t size;
 | 
						|
 | 
						|
	new_event = dup_event(oe, event);
 | 
						|
	if (!new_event)
 | 
						|
		return NULL;
 | 
						|
 | 
						|
	/*
 | 
						|
	 * We maintain the following scheme of buffers for ordered
 | 
						|
	 * event allocation:
 | 
						|
	 *
 | 
						|
	 *   to_free list -> buffer1 (64K)
 | 
						|
	 *                   buffer2 (64K)
 | 
						|
	 *                   ...
 | 
						|
	 *
 | 
						|
	 * Each buffer keeps an array of ordered events objects:
 | 
						|
	 *    buffer -> event[0]
 | 
						|
	 *              event[1]
 | 
						|
	 *              ...
 | 
						|
	 *
 | 
						|
	 * Each allocated ordered event is linked to one of
 | 
						|
	 * following lists:
 | 
						|
	 *   - time ordered list 'events'
 | 
						|
	 *   - list of currently removed events 'cache'
 | 
						|
	 *
 | 
						|
	 * Allocation of the ordered event uses the following order
 | 
						|
	 * to get the memory:
 | 
						|
	 *   - use recently removed object from 'cache' list
 | 
						|
	 *   - use available object in current allocation buffer
 | 
						|
	 *   - allocate new buffer if the current buffer is full
 | 
						|
	 *
 | 
						|
	 * Removal of ordered event object moves it from events to
 | 
						|
	 * the cache list.
 | 
						|
	 */
 | 
						|
	size = sizeof(*oe->buffer) + MAX_SAMPLE_BUFFER * sizeof(*new);
 | 
						|
 | 
						|
	if (!list_empty(cache)) {
 | 
						|
		new = list_entry(cache->next, struct ordered_event, list);
 | 
						|
		list_del(&new->list);
 | 
						|
	} else if (oe->buffer) {
 | 
						|
		new = &oe->buffer->event[oe->buffer_idx];
 | 
						|
		if (++oe->buffer_idx == MAX_SAMPLE_BUFFER)
 | 
						|
			oe->buffer = NULL;
 | 
						|
	} else if ((oe->cur_alloc_size + size) < oe->max_alloc_size) {
 | 
						|
		oe->buffer = malloc(size);
 | 
						|
		if (!oe->buffer) {
 | 
						|
			free_dup_event(oe, new_event);
 | 
						|
			return NULL;
 | 
						|
		}
 | 
						|
 | 
						|
		pr("alloc size %" PRIu64 "B (+%zu), max %" PRIu64 "B\n",
 | 
						|
		   oe->cur_alloc_size, size, oe->max_alloc_size);
 | 
						|
 | 
						|
		oe->cur_alloc_size += size;
 | 
						|
		list_add(&oe->buffer->list, &oe->to_free);
 | 
						|
 | 
						|
		oe->buffer_idx = 1;
 | 
						|
		new = &oe->buffer->event[0];
 | 
						|
	} else {
 | 
						|
		pr("allocation limit reached %" PRIu64 "B\n", oe->max_alloc_size);
 | 
						|
		return NULL;
 | 
						|
	}
 | 
						|
 | 
						|
	new->event = new_event;
 | 
						|
	return new;
 | 
						|
}
 | 
						|
 | 
						|
static struct ordered_event *
 | 
						|
ordered_events__new_event(struct ordered_events *oe, u64 timestamp,
 | 
						|
		    union perf_event *event)
 | 
						|
{
 | 
						|
	struct ordered_event *new;
 | 
						|
 | 
						|
	new = alloc_event(oe, event);
 | 
						|
	if (new) {
 | 
						|
		new->timestamp = timestamp;
 | 
						|
		queue_event(oe, new);
 | 
						|
	}
 | 
						|
 | 
						|
	return new;
 | 
						|
}
 | 
						|
 | 
						|
void ordered_events__delete(struct ordered_events *oe, struct ordered_event *event)
 | 
						|
{
 | 
						|
	list_move(&event->list, &oe->cache);
 | 
						|
	oe->nr_events--;
 | 
						|
	free_dup_event(oe, event->event);
 | 
						|
	event->event = NULL;
 | 
						|
}
 | 
						|
 | 
						|
int ordered_events__queue(struct ordered_events *oe, union perf_event *event,
 | 
						|
			  u64 timestamp, u64 file_offset)
 | 
						|
{
 | 
						|
	struct ordered_event *oevent;
 | 
						|
 | 
						|
	if (!timestamp || timestamp == ~0ULL)
 | 
						|
		return -ETIME;
 | 
						|
 | 
						|
	if (timestamp < oe->last_flush) {
 | 
						|
		pr_oe_time(timestamp,      "out of order event\n");
 | 
						|
		pr_oe_time(oe->last_flush, "last flush, last_flush_type %d\n",
 | 
						|
			   oe->last_flush_type);
 | 
						|
 | 
						|
		oe->nr_unordered_events++;
 | 
						|
	}
 | 
						|
 | 
						|
	oevent = ordered_events__new_event(oe, timestamp, event);
 | 
						|
	if (!oevent) {
 | 
						|
		ordered_events__flush(oe, OE_FLUSH__HALF);
 | 
						|
		oevent = ordered_events__new_event(oe, timestamp, event);
 | 
						|
	}
 | 
						|
 | 
						|
	if (!oevent)
 | 
						|
		return -ENOMEM;
 | 
						|
 | 
						|
	oevent->file_offset = file_offset;
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int do_flush(struct ordered_events *oe, bool show_progress)
 | 
						|
{
 | 
						|
	struct list_head *head = &oe->events;
 | 
						|
	struct ordered_event *tmp, *iter;
 | 
						|
	u64 limit = oe->next_flush;
 | 
						|
	u64 last_ts = oe->last ? oe->last->timestamp : 0ULL;
 | 
						|
	struct ui_progress prog;
 | 
						|
	int ret;
 | 
						|
 | 
						|
	if (!limit)
 | 
						|
		return 0;
 | 
						|
 | 
						|
	if (show_progress)
 | 
						|
		ui_progress__init(&prog, oe->nr_events, "Processing time ordered events...");
 | 
						|
 | 
						|
	list_for_each_entry_safe(iter, tmp, head, list) {
 | 
						|
		if (session_done())
 | 
						|
			return 0;
 | 
						|
 | 
						|
		if (iter->timestamp > limit)
 | 
						|
			break;
 | 
						|
		ret = oe->deliver(oe, iter);
 | 
						|
		if (ret)
 | 
						|
			return ret;
 | 
						|
 | 
						|
		ordered_events__delete(oe, iter);
 | 
						|
		oe->last_flush = iter->timestamp;
 | 
						|
 | 
						|
		if (show_progress)
 | 
						|
			ui_progress__update(&prog, 1);
 | 
						|
	}
 | 
						|
 | 
						|
	if (list_empty(head))
 | 
						|
		oe->last = NULL;
 | 
						|
	else if (last_ts <= limit)
 | 
						|
		oe->last = list_entry(head->prev, struct ordered_event, list);
 | 
						|
 | 
						|
	if (show_progress)
 | 
						|
		ui_progress__finish();
 | 
						|
 | 
						|
	return 0;
 | 
						|
}
 | 
						|
 | 
						|
static int __ordered_events__flush(struct ordered_events *oe, enum oe_flush how,
 | 
						|
				   u64 timestamp)
 | 
						|
{
 | 
						|
	static const char * const str[] = {
 | 
						|
		"NONE",
 | 
						|
		"FINAL",
 | 
						|
		"ROUND",
 | 
						|
		"HALF ",
 | 
						|
		"TOP  ",
 | 
						|
		"TIME ",
 | 
						|
	};
 | 
						|
	int err;
 | 
						|
	bool show_progress = false;
 | 
						|
 | 
						|
	if (oe->nr_events == 0)
 | 
						|
		return 0;
 | 
						|
 | 
						|
	switch (how) {
 | 
						|
	case OE_FLUSH__FINAL:
 | 
						|
		show_progress = true;
 | 
						|
		__fallthrough;
 | 
						|
	case OE_FLUSH__TOP:
 | 
						|
		oe->next_flush = ULLONG_MAX;
 | 
						|
		break;
 | 
						|
 | 
						|
	case OE_FLUSH__HALF:
 | 
						|
	{
 | 
						|
		struct ordered_event *first, *last;
 | 
						|
		struct list_head *head = &oe->events;
 | 
						|
 | 
						|
		first = list_entry(head->next, struct ordered_event, list);
 | 
						|
		last = oe->last;
 | 
						|
 | 
						|
		/* Warn if we are called before any event got allocated. */
 | 
						|
		if (WARN_ONCE(!last || list_empty(head), "empty queue"))
 | 
						|
			return 0;
 | 
						|
 | 
						|
		oe->next_flush  = first->timestamp;
 | 
						|
		oe->next_flush += (last->timestamp - first->timestamp) / 2;
 | 
						|
		break;
 | 
						|
	}
 | 
						|
 | 
						|
	case OE_FLUSH__TIME:
 | 
						|
		oe->next_flush = timestamp;
 | 
						|
		show_progress = false;
 | 
						|
		break;
 | 
						|
 | 
						|
	case OE_FLUSH__ROUND:
 | 
						|
	case OE_FLUSH__NONE:
 | 
						|
	default:
 | 
						|
		break;
 | 
						|
	};
 | 
						|
 | 
						|
	pr_oe_time(oe->next_flush, "next_flush - ordered_events__flush PRE  %s, nr_events %u\n",
 | 
						|
		   str[how], oe->nr_events);
 | 
						|
	pr_oe_time(oe->max_timestamp, "max_timestamp\n");
 | 
						|
 | 
						|
	err = do_flush(oe, show_progress);
 | 
						|
 | 
						|
	if (!err) {
 | 
						|
		if (how == OE_FLUSH__ROUND)
 | 
						|
			oe->next_flush = oe->max_timestamp;
 | 
						|
 | 
						|
		oe->last_flush_type = how;
 | 
						|
	}
 | 
						|
 | 
						|
	pr_oe_time(oe->next_flush, "next_flush - ordered_events__flush POST %s, nr_events %u\n",
 | 
						|
		   str[how], oe->nr_events);
 | 
						|
	pr_oe_time(oe->last_flush, "last_flush\n");
 | 
						|
 | 
						|
	return err;
 | 
						|
}
 | 
						|
 | 
						|
int ordered_events__flush(struct ordered_events *oe, enum oe_flush how)
 | 
						|
{
 | 
						|
	return __ordered_events__flush(oe, how, 0);
 | 
						|
}
 | 
						|
 | 
						|
int ordered_events__flush_time(struct ordered_events *oe, u64 timestamp)
 | 
						|
{
 | 
						|
	return __ordered_events__flush(oe, OE_FLUSH__TIME, timestamp);
 | 
						|
}
 | 
						|
 | 
						|
u64 ordered_events__first_time(struct ordered_events *oe)
 | 
						|
{
 | 
						|
	struct ordered_event *event;
 | 
						|
 | 
						|
	if (list_empty(&oe->events))
 | 
						|
		return 0;
 | 
						|
 | 
						|
	event = list_first_entry(&oe->events, struct ordered_event, list);
 | 
						|
	return event->timestamp;
 | 
						|
}
 | 
						|
 | 
						|
void ordered_events__init(struct ordered_events *oe, ordered_events__deliver_t deliver,
 | 
						|
			  void *data)
 | 
						|
{
 | 
						|
	INIT_LIST_HEAD(&oe->events);
 | 
						|
	INIT_LIST_HEAD(&oe->cache);
 | 
						|
	INIT_LIST_HEAD(&oe->to_free);
 | 
						|
	oe->max_alloc_size = (u64) -1;
 | 
						|
	oe->cur_alloc_size = 0;
 | 
						|
	oe->deliver	   = deliver;
 | 
						|
	oe->data	   = data;
 | 
						|
}
 | 
						|
 | 
						|
static void
 | 
						|
ordered_events_buffer__free(struct ordered_events_buffer *buffer,
 | 
						|
			    unsigned int max, struct ordered_events *oe)
 | 
						|
{
 | 
						|
	if (oe->copy_on_queue) {
 | 
						|
		unsigned int i;
 | 
						|
 | 
						|
		for (i = 0; i < max; i++)
 | 
						|
			__free_dup_event(oe, buffer->event[i].event);
 | 
						|
	}
 | 
						|
 | 
						|
	free(buffer);
 | 
						|
}
 | 
						|
 | 
						|
void ordered_events__free(struct ordered_events *oe)
 | 
						|
{
 | 
						|
	struct ordered_events_buffer *buffer, *tmp;
 | 
						|
 | 
						|
	if (list_empty(&oe->to_free))
 | 
						|
		return;
 | 
						|
 | 
						|
	/*
 | 
						|
	 * Current buffer might not have all the events allocated
 | 
						|
	 * yet, we need to free only allocated ones ...
 | 
						|
	 */
 | 
						|
	if (oe->buffer) {
 | 
						|
		list_del(&oe->buffer->list);
 | 
						|
		ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
 | 
						|
	}
 | 
						|
 | 
						|
	/* ... and continue with the rest */
 | 
						|
	list_for_each_entry_safe(buffer, tmp, &oe->to_free, list) {
 | 
						|
		list_del(&buffer->list);
 | 
						|
		ordered_events_buffer__free(buffer, MAX_SAMPLE_BUFFER, oe);
 | 
						|
	}
 | 
						|
}
 | 
						|
 | 
						|
void ordered_events__reinit(struct ordered_events *oe)
 | 
						|
{
 | 
						|
	ordered_events__deliver_t old_deliver = oe->deliver;
 | 
						|
 | 
						|
	ordered_events__free(oe);
 | 
						|
	memset(oe, '\0', sizeof(*oe));
 | 
						|
	ordered_events__init(oe, old_deliver, oe->data);
 | 
						|
}
 |