* perf-probe crash in dwarf_getcfi_elf
@ 2014-12-30 4:39 David Ahern
2014-12-30 8:47 ` Namhyung Kim
0 siblings, 1 reply; 8+ messages in thread
From: David Ahern @ 2014-12-30 4:39 UTC (permalink / raw)
To: Namhyung Kim; +Cc: Masami Hiramatsu, Arnaldo Carvalho de Melo, LKML
Hi Namhyung:
Using perf-probe from top of Linus' tree I get a segfault on both Fedora
16 and 18 (does not crash on Fedora 20). Command used is:
perf probe -x /lib64/libc-2.14.90.so -a 'malloc size=%di'
git bisect points to:
commit 03d89412981a7681971bc77edba1669595763030
Author: Namhyung Kim <namhyung@kernel.org>
Date: Mon Apr 7 16:05:48 2014 +0900
perf probe: Use dwarf_getcfi_elf() instead of dwarf_getcfi()
Backtrace at time of crash is:
(gdb) bt
#0 parse_eh_frame_hdr (hdr=0x0, hdr_size=2596, hdr_vaddr=71788,
ehdr=0x7fffffffd390, eh_frame_vaddr=
0x7fffffffd378, table_entries=0x8808d8, table_encoding=0x8808e0 "")
at dwarf_getcfi_elf.c:79
#1 0x000000385f81615a in getcfi_scn_eh_frame (hdr_vaddr=71788,
hdr_scn=0x8839b0, shdr=0x7fffffffd2f0,
scn=<optimized out>, ehdr=0x7fffffffd390, elf=0x882b30) at
dwarf_getcfi_elf.c:231
#2 getcfi_shdr (ehdr=0x7fffffffd390, elf=0x882b30) at
dwarf_getcfi_elf.c:283
#3 dwarf_getcfi_elf (elf=0x882b30) at dwarf_getcfi_elf.c:309
#4 0x00000000004d5bac in debuginfo__find_probes (pf=0x7fffffffd4f0,
dbg=Unhandled dwarf expression opcode 0xfa
) at util/probe-finder.c:993
#5 0x00000000004d634a in debuginfo__find_trace_events (dbg=0x880840,
pev=<optimized out>, tevs=0x880f88,
max_tevs=<optimized out>) at util/probe-finder.c:1200
#6 0x00000000004aed6b in try_to_find_probe_trace_events
(target=0x881b20 "/lib64/libpthread-2.14.90.so",
max_tevs=128, tevs=0x880f88, pev=0x859b30) at util/probe-event.c:482
#7 convert_to_probe_trace_events (target=0x881b20
"/lib64/libpthread-2.14.90.so", max_tevs=128, tevs=0x880f88,
pev=0x859b30) at util/probe-event.c:2356
#8 add_perf_probe_events (pevs=<optimized out>, npevs=1, max_tevs=128,
target=
0x881b20 "/lib64/libpthread-2.14.90.so", force_add=false) at
util/probe-event.c:2391
#9 0x000000000044014f in __cmd_probe (argc=<optimized out>,
argv=0x7fffffffe2f0, prefix=Unhandled dwarf expression opcode 0xfa
)
at builtin-probe.c:488
#10 0x0000000000440313 in cmd_probe (argc=5, argv=0x7fffffffe2f0,
prefix=<optimized out>) at builtin-probe.c:506
#11 0x000000000041d133 in run_builtin (p=0x805680, argc=5,
argv=0x7fffffffe2f0) at perf.c:341
#12 0x000000000041c8b2 in handle_internal_command (argv=<optimized out>,
argc=<optimized out>) at perf.c:400
#13 run_argv (argv=<optimized out>, argcp=<optimized out>) at perf.c:444
#14 main (argc=5, argv=0x7fffffffe2f0) at perf.c:559
David
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: perf-probe crash in dwarf_getcfi_elf
2014-12-30 4:39 perf-probe crash in dwarf_getcfi_elf David Ahern
@ 2014-12-30 8:47 ` Namhyung Kim
2014-12-30 9:05 ` Namhyung Kim
0 siblings, 1 reply; 8+ messages in thread
From: Namhyung Kim @ 2014-12-30 8:47 UTC (permalink / raw)
To: David Ahern
Cc: Masami Hiramatsu, Arnaldo Carvalho de Melo, LKML, Mark Wielaard
On Mon, Dec 29, 2014 at 09:39:18PM -0700, David Ahern wrote:
> Hi Namhyung:
>
> Using perf-probe from top of Linus' tree I get a segfault on both Fedora 16
> and 18 (does not crash on Fedora 20). Command used is:
>
> perf probe -x /lib64/libc-2.14.90.so -a 'malloc size=%di'
>
> git bisect points to:
>
> commit 03d89412981a7681971bc77edba1669595763030
> Author: Namhyung Kim <namhyung@kernel.org>
> Date: Mon Apr 7 16:05:48 2014 +0900
>
> perf probe: Use dwarf_getcfi_elf() instead of dwarf_getcfi()
>
It seems to be related to below commit in elfutils. We might need to
check .eh_frame section has SHT_PROGBITS. Will send a patch soon.
Thanks,
Namhyung
commit 5704c8c4fa717b6e9c2d2e4304dfbc810ad42e4b
Author: Mark Wielaard <mjw@redhat.com>
Date: Tue Jul 2 11:22:35 2013 +0200
getcfi_scn_eh_frame: Don't crash and burn when .eh_frame bits aren't there.
Trying to read non-existing bits sometimes works and normally a sanity
check will fail. But it could also lead to an unexpected crash much later
when trying to use the non-existing data.
Signed-off-by: Mark Wielaard <mjw@redhat.com>
diff --git a/libdw/ChangeLog b/libdw/ChangeLog
index 700c166..22f8b0c 100644
--- a/libdw/ChangeLog
+++ b/libdw/ChangeLog
@@ -1,3 +1,7 @@
+2013-07-02 Mark Wielaard <mjw@redhat.com>
+
+ * dwarf_getcfi_elf.c (getcfi_shdr): Check sh_type == SHT_PROGBITS.
+
2013-06-26 Mark Wielaard <mjw@redhat.com>
* libdw_visit_scopes.c (__libdw_visit_scopes): Don't reject root
diff --git a/libdw/dwarf_getcfi_elf.c b/libdw/dwarf_getcfi_elf.c
index ba00e05..a423ef3 100644
--- a/libdw/dwarf_getcfi_elf.c
+++ b/libdw/dwarf_getcfi_elf.c
@@ -280,8 +280,13 @@ getcfi_shdr (Elf *elf, const GElf_Ehdr *ehdr)
hdr_vaddr = shdr->sh_addr;
}
else if (!strcmp (name, ".eh_frame"))
- return getcfi_scn_eh_frame (elf, ehdr, scn, shdr,
- hdr_scn, hdr_vaddr);
+ {
+ if (shdr->sh_type == SHT_PROGBITS)
+ return getcfi_scn_eh_frame (elf, ehdr, scn, shdr,
+ hdr_scn, hdr_vaddr);
+ else
+ return NULL;
+ }
}
}
> Backtrace at time of crash is:
>
> (gdb) bt
> #0 parse_eh_frame_hdr (hdr=0x0, hdr_size=2596, hdr_vaddr=71788,
> ehdr=0x7fffffffd390, eh_frame_vaddr=
> 0x7fffffffd378, table_entries=0x8808d8, table_encoding=0x8808e0 "") at
> dwarf_getcfi_elf.c:79
> #1 0x000000385f81615a in getcfi_scn_eh_frame (hdr_vaddr=71788,
> hdr_scn=0x8839b0, shdr=0x7fffffffd2f0,
> scn=<optimized out>, ehdr=0x7fffffffd390, elf=0x882b30) at
> dwarf_getcfi_elf.c:231
> #2 getcfi_shdr (ehdr=0x7fffffffd390, elf=0x882b30) at
> dwarf_getcfi_elf.c:283
> #3 dwarf_getcfi_elf (elf=0x882b30) at dwarf_getcfi_elf.c:309
> #4 0x00000000004d5bac in debuginfo__find_probes (pf=0x7fffffffd4f0,
> dbg=Unhandled dwarf expression opcode 0xfa
> ) at util/probe-finder.c:993
> #5 0x00000000004d634a in debuginfo__find_trace_events (dbg=0x880840,
> pev=<optimized out>, tevs=0x880f88,
> max_tevs=<optimized out>) at util/probe-finder.c:1200
> #6 0x00000000004aed6b in try_to_find_probe_trace_events (target=0x881b20
> "/lib64/libpthread-2.14.90.so",
> max_tevs=128, tevs=0x880f88, pev=0x859b30) at util/probe-event.c:482
> #7 convert_to_probe_trace_events (target=0x881b20
> "/lib64/libpthread-2.14.90.so", max_tevs=128, tevs=0x880f88,
> pev=0x859b30) at util/probe-event.c:2356
> #8 add_perf_probe_events (pevs=<optimized out>, npevs=1, max_tevs=128,
> target=
> 0x881b20 "/lib64/libpthread-2.14.90.so", force_add=false) at
> util/probe-event.c:2391
> #9 0x000000000044014f in __cmd_probe (argc=<optimized out>,
> argv=0x7fffffffe2f0, prefix=Unhandled dwarf expression opcode 0xfa
> )
> at builtin-probe.c:488
> #10 0x0000000000440313 in cmd_probe (argc=5, argv=0x7fffffffe2f0,
> prefix=<optimized out>) at builtin-probe.c:506
> #11 0x000000000041d133 in run_builtin (p=0x805680, argc=5,
> argv=0x7fffffffe2f0) at perf.c:341
> #12 0x000000000041c8b2 in handle_internal_command (argv=<optimized out>,
> argc=<optimized out>) at perf.c:400
> #13 run_argv (argv=<optimized out>, argcp=<optimized out>) at perf.c:444
> #14 main (argc=5, argv=0x7fffffffe2f0) at perf.c:559
>
> David
> --
> To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
> Please read the FAQ at http://www.tux.org/lkml/
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: perf-probe crash in dwarf_getcfi_elf
2014-12-30 8:47 ` Namhyung Kim
@ 2014-12-30 9:05 ` Namhyung Kim
2014-12-30 17:13 ` David Ahern
` (3 more replies)
0 siblings, 4 replies; 8+ messages in thread
From: Namhyung Kim @ 2014-12-30 9:05 UTC (permalink / raw)
To: David Ahern
Cc: Masami Hiramatsu, Arnaldo Carvalho de Melo, LKML, Mark Wielaard
On Tue, Dec 30, 2014 at 05:47:08PM +0900, Namhyung Kim wrote:
> On Mon, Dec 29, 2014 at 09:39:18PM -0700, David Ahern wrote:
> > Hi Namhyung:
> >
> > Using perf-probe from top of Linus' tree I get a segfault on both Fedora 16
> > and 18 (does not crash on Fedora 20). Command used is:
> >
> > perf probe -x /lib64/libc-2.14.90.so -a 'malloc size=%di'
> >
> > git bisect points to:
> >
> > commit 03d89412981a7681971bc77edba1669595763030
> > Author: Namhyung Kim <namhyung@kernel.org>
> > Date: Mon Apr 7 16:05:48 2014 +0900
> >
> > perf probe: Use dwarf_getcfi_elf() instead of dwarf_getcfi()
> >
>
> It seems to be related to below commit in elfutils. We might need to
> check .eh_frame section has SHT_PROGBITS. Will send a patch soon.
>From f56964e74d60a9921214d0e2e5c3d082f5a910c1 Mon Sep 17 00:00:00 2001
From: Namhyung Kim <namhyung@kernel.org>
Date: Tue, 30 Dec 2014 17:47:47 +0900
Subject: [PATCH] perf probe: Fix a segfault on old libdw
David reported that perf can segfault when adding an uprobe event like
this:
$ perf probe -x /lib64/libc-2.14.90.so -a 'malloc size=%di'
(gdb) bt
#0 parse_eh_frame_hdr (hdr=0x0, hdr_size=2596, hdr_vaddr=71788,
ehdr=0x7fffffffd390, eh_frame_vaddr=
0x7fffffffd378, table_entries=0x8808d8, table_encoding=0x8808e0 "") at
dwarf_getcfi_elf.c:79
#1 0x000000385f81615a in getcfi_scn_eh_frame (hdr_vaddr=71788,
hdr_scn=0x8839b0, shdr=0x7fffffffd2f0, scn=<optimized out>,
ehdr=0x7fffffffd390, elf=0x882b30) at dwarf_getcfi_elf.c:231
#2 getcfi_shdr (ehdr=0x7fffffffd390, elf=0x882b30) at dwarf_getcfi_elf.c:283
#3 dwarf_getcfi_elf (elf=0x882b30) at dwarf_getcfi_elf.c:309
#4 0x00000000004d5bac in debuginfo__find_probes (pf=0x7fffffffd4f0,
dbg=Unhandled dwarf expression opcode 0xfa) at util/probe-finder.c:993
#5 0x00000000004d634a in debuginfo__find_trace_events (dbg=0x880840,
pev=<optimized out>, tevs=0x880f88, max_tevs=<optimized out>) at
util/probe-finder.c:1200
#6 0x00000000004aed6b in try_to_find_probe_trace_events (target=0x881b20
"/lib64/libpthread-2.14.90.so",
max_tevs=128, tevs=0x880f88, pev=0x859b30) at util/probe-event.c:482
#7 convert_to_probe_trace_events (target=0x881b20
"/lib64/libpthread-2.14.90.so", max_tevs=128, tevs=0x880f88,
pev=0x859b30) at util/probe-event.c:2356
#8 add_perf_probe_events (pevs=<optimized out>, npevs=1, max_tevs=128,
target=0x881b20 "/lib64/libpthread-2.14.90.so", force_add=false) at
util/probe-event.c:2391
#9 0x000000000044014f in __cmd_probe (argc=<optimized out>,
argv=0x7fffffffe2f0, prefix=Unhandled dwarf expression opcode 0xfa) at
at builtin-probe.c:488
#10 0x0000000000440313 in cmd_probe (argc=5, argv=0x7fffffffe2f0,
prefix=<optimized out>) at builtin-probe.c:506
#11 0x000000000041d133 in run_builtin (p=0x805680, argc=5,
argv=0x7fffffffe2f0) at perf.c:341
#12 0x000000000041c8b2 in handle_internal_command (argv=<optimized out>,
argc=<optimized out>) at perf.c:400
#13 run_argv (argv=<optimized out>, argcp=<optimized out>) at perf.c:444
#14 main (argc=5, argv=0x7fffffffe2f0) at perf.c:559
And I found a related commit (5704c8c4fa71 "getcfi_scn_eh_frame: Don't
crash and burn when .eh_frame bits aren't there.") in elfutils that
can lead to a unexpected crash like this. To safely use the function,
it needs to check the .eh_frame section is a PROGBITS type.
Reported-by: David Ahern <dsahern@gmail.com>
Cc: Mark Wielaard <mjw@redhat.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
---
tools/perf/util/probe-finder.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index c7918f83b300..b5247d777f0e 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -989,8 +989,24 @@ static int debuginfo__find_probes(struct debuginfo *dbg,
int ret = 0;
#if _ELFUTILS_PREREQ(0, 142)
+ Elf *elf;
+ GElf_Ehdr ehdr;
+ GElf_Shdr shdr;
+
/* Get the call frame information from this dwarf */
- pf->cfi = dwarf_getcfi_elf(dwarf_getelf(dbg->dbg));
+ elf = dwarf_getelf(dbg->dbg);
+ if (elf == NULL)
+ return -EINVAL;
+
+ if (gelf_getehdr(elf, &ehdr) == NULL)
+ return -EINVAL;
+
+ if (elf_section_by_name(elf, &ehdr, &shdr, ".eh_frame", NULL) &&
+ shdr.sh_type == SHT_PROGBITS) {
+ pf->cfi = dwarf_getcfi_elf(elf);
+ } else {
+ pf->cfi = dwarf_getcfi(dbg->dbg);
+ }
#endif
off = 0;
--
2.1.3
^ permalink raw reply related [flat|nested] 8+ messages in thread
* Re: perf-probe crash in dwarf_getcfi_elf
2014-12-30 9:05 ` Namhyung Kim
@ 2014-12-30 17:13 ` David Ahern
2014-12-30 22:13 ` Masami Hiramatsu
` (2 subsequent siblings)
3 siblings, 0 replies; 8+ messages in thread
From: David Ahern @ 2014-12-30 17:13 UTC (permalink / raw)
To: Namhyung Kim
Cc: Masami Hiramatsu, Arnaldo Carvalho de Melo, LKML, Mark Wielaard
On 12/30/14 2:05 AM, Namhyung Kim wrote:
> From f56964e74d60a9921214d0e2e5c3d082f5a910c1 Mon Sep 17 00:00:00 2001
> From: Namhyung Kim <namhyung@kernel.org>
> Date: Tue, 30 Dec 2014 17:47:47 +0900
> Subject: [PATCH] perf probe: Fix a segfault on old libdw
>
> David reported that perf can segfault when adding an uprobe event like
> this:
>
> $ perf probe -x /lib64/libc-2.14.90.so -a 'malloc size=%di'
>
> (gdb) bt
> #0 parse_eh_frame_hdr (hdr=0x0, hdr_size=2596, hdr_vaddr=71788,
> ehdr=0x7fffffffd390, eh_frame_vaddr=
> 0x7fffffffd378, table_entries=0x8808d8, table_encoding=0x8808e0 "") at
> dwarf_getcfi_elf.c:79
> #1 0x000000385f81615a in getcfi_scn_eh_frame (hdr_vaddr=71788,
> hdr_scn=0x8839b0, shdr=0x7fffffffd2f0, scn=<optimized out>,
> ehdr=0x7fffffffd390, elf=0x882b30) at dwarf_getcfi_elf.c:231
> #2 getcfi_shdr (ehdr=0x7fffffffd390, elf=0x882b30) at dwarf_getcfi_elf.c:283
> #3 dwarf_getcfi_elf (elf=0x882b30) at dwarf_getcfi_elf.c:309
> #4 0x00000000004d5bac in debuginfo__find_probes (pf=0x7fffffffd4f0,
> dbg=Unhandled dwarf expression opcode 0xfa) at util/probe-finder.c:993
> #5 0x00000000004d634a in debuginfo__find_trace_events (dbg=0x880840,
> pev=<optimized out>, tevs=0x880f88, max_tevs=<optimized out>) at
> util/probe-finder.c:1200
> #6 0x00000000004aed6b in try_to_find_probe_trace_events (target=0x881b20
> "/lib64/libpthread-2.14.90.so",
> max_tevs=128, tevs=0x880f88, pev=0x859b30) at util/probe-event.c:482
> #7 convert_to_probe_trace_events (target=0x881b20
> "/lib64/libpthread-2.14.90.so", max_tevs=128, tevs=0x880f88,
> pev=0x859b30) at util/probe-event.c:2356
> #8 add_perf_probe_events (pevs=<optimized out>, npevs=1, max_tevs=128,
> target=0x881b20 "/lib64/libpthread-2.14.90.so", force_add=false) at
> util/probe-event.c:2391
> #9 0x000000000044014f in __cmd_probe (argc=<optimized out>,
> argv=0x7fffffffe2f0, prefix=Unhandled dwarf expression opcode 0xfa) at
> at builtin-probe.c:488
> #10 0x0000000000440313 in cmd_probe (argc=5, argv=0x7fffffffe2f0,
> prefix=<optimized out>) at builtin-probe.c:506
> #11 0x000000000041d133 in run_builtin (p=0x805680, argc=5,
> argv=0x7fffffffe2f0) at perf.c:341
> #12 0x000000000041c8b2 in handle_internal_command (argv=<optimized out>,
> argc=<optimized out>) at perf.c:400
> #13 run_argv (argv=<optimized out>, argcp=<optimized out>) at perf.c:444
> #14 main (argc=5, argv=0x7fffffffe2f0) at perf.c:559
>
> And I found a related commit (5704c8c4fa71 "getcfi_scn_eh_frame: Don't
> crash and burn when .eh_frame bits aren't there.") in elfutils that
> can lead to a unexpected crash like this. To safely use the function,
> it needs to check the .eh_frame section is a PROGBITS type.
>
> Reported-by: David Ahern <dsahern@gmail.com>
> Cc: Mark Wielaard <mjw@redhat.com>
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Solves the crash for me.
Tested-by: David Ahern <dsahern@gmail.com>
Thanks for the quick response, Namhyung.
David
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: Re: perf-probe crash in dwarf_getcfi_elf
2014-12-30 9:05 ` Namhyung Kim
2014-12-30 17:13 ` David Ahern
@ 2014-12-30 22:13 ` Masami Hiramatsu
2014-12-31 19:42 ` Mark Wielaard
2015-01-08 9:52 ` [tip:perf/urgent] perf probe: Fix " tip-bot for Namhyung Kim
3 siblings, 0 replies; 8+ messages in thread
From: Masami Hiramatsu @ 2014-12-30 22:13 UTC (permalink / raw)
To: Namhyung Kim; +Cc: David Ahern, Arnaldo Carvalho de Melo, LKML, Mark Wielaard
(2014/12/30 18:05), Namhyung Kim wrote:
> On Tue, Dec 30, 2014 at 05:47:08PM +0900, Namhyung Kim wrote:
>> On Mon, Dec 29, 2014 at 09:39:18PM -0700, David Ahern wrote:
>>> Hi Namhyung:
>>>
>>> Using perf-probe from top of Linus' tree I get a segfault on both Fedora 16
>>> and 18 (does not crash on Fedora 20). Command used is:
>>>
>>> perf probe -x /lib64/libc-2.14.90.so -a 'malloc size=%di'
>>>
>>> git bisect points to:
>>>
>>> commit 03d89412981a7681971bc77edba1669595763030
>>> Author: Namhyung Kim <namhyung@kernel.org>
>>> Date: Mon Apr 7 16:05:48 2014 +0900
>>>
>>> perf probe: Use dwarf_getcfi_elf() instead of dwarf_getcfi()
>>>
>>
>> It seems to be related to below commit in elfutils. We might need to
>> check .eh_frame section has SHT_PROGBITS. Will send a patch soon.
>
>
>>From f56964e74d60a9921214d0e2e5c3d082f5a910c1 Mon Sep 17 00:00:00 2001
> From: Namhyung Kim <namhyung@kernel.org>
> Date: Tue, 30 Dec 2014 17:47:47 +0900
> Subject: [PATCH] perf probe: Fix a segfault on old libdw
>
> David reported that perf can segfault when adding an uprobe event like
> this:
>
> $ perf probe -x /lib64/libc-2.14.90.so -a 'malloc size=%di'
>
> (gdb) bt
> #0 parse_eh_frame_hdr (hdr=0x0, hdr_size=2596, hdr_vaddr=71788,
> ehdr=0x7fffffffd390, eh_frame_vaddr=
> 0x7fffffffd378, table_entries=0x8808d8, table_encoding=0x8808e0 "") at
> dwarf_getcfi_elf.c:79
> #1 0x000000385f81615a in getcfi_scn_eh_frame (hdr_vaddr=71788,
> hdr_scn=0x8839b0, shdr=0x7fffffffd2f0, scn=<optimized out>,
> ehdr=0x7fffffffd390, elf=0x882b30) at dwarf_getcfi_elf.c:231
> #2 getcfi_shdr (ehdr=0x7fffffffd390, elf=0x882b30) at dwarf_getcfi_elf.c:283
> #3 dwarf_getcfi_elf (elf=0x882b30) at dwarf_getcfi_elf.c:309
> #4 0x00000000004d5bac in debuginfo__find_probes (pf=0x7fffffffd4f0,
> dbg=Unhandled dwarf expression opcode 0xfa) at util/probe-finder.c:993
> #5 0x00000000004d634a in debuginfo__find_trace_events (dbg=0x880840,
> pev=<optimized out>, tevs=0x880f88, max_tevs=<optimized out>) at
> util/probe-finder.c:1200
> #6 0x00000000004aed6b in try_to_find_probe_trace_events (target=0x881b20
> "/lib64/libpthread-2.14.90.so",
> max_tevs=128, tevs=0x880f88, pev=0x859b30) at util/probe-event.c:482
> #7 convert_to_probe_trace_events (target=0x881b20
> "/lib64/libpthread-2.14.90.so", max_tevs=128, tevs=0x880f88,
> pev=0x859b30) at util/probe-event.c:2356
> #8 add_perf_probe_events (pevs=<optimized out>, npevs=1, max_tevs=128,
> target=0x881b20 "/lib64/libpthread-2.14.90.so", force_add=false) at
> util/probe-event.c:2391
> #9 0x000000000044014f in __cmd_probe (argc=<optimized out>,
> argv=0x7fffffffe2f0, prefix=Unhandled dwarf expression opcode 0xfa) at
> at builtin-probe.c:488
> #10 0x0000000000440313 in cmd_probe (argc=5, argv=0x7fffffffe2f0,
> prefix=<optimized out>) at builtin-probe.c:506
> #11 0x000000000041d133 in run_builtin (p=0x805680, argc=5,
> argv=0x7fffffffe2f0) at perf.c:341
> #12 0x000000000041c8b2 in handle_internal_command (argv=<optimized out>,
> argc=<optimized out>) at perf.c:400
> #13 run_argv (argv=<optimized out>, argcp=<optimized out>) at perf.c:444
> #14 main (argc=5, argv=0x7fffffffe2f0) at perf.c:559
>
> And I found a related commit (5704c8c4fa71 "getcfi_scn_eh_frame: Don't
> crash and burn when .eh_frame bits aren't there.") in elfutils that
> can lead to a unexpected crash like this. To safely use the function,
> it needs to check the .eh_frame section is a PROGBITS type.
>
Looks good to me :)
> Reported-by: David Ahern <dsahern@gmail.com>
> Cc: Mark Wielaard <mjw@redhat.com>
> Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Thank you!
> ---
> tools/perf/util/probe-finder.c | 18 +++++++++++++++++-
> 1 file changed, 17 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
> index c7918f83b300..b5247d777f0e 100644
> --- a/tools/perf/util/probe-finder.c
> +++ b/tools/perf/util/probe-finder.c
> @@ -989,8 +989,24 @@ static int debuginfo__find_probes(struct debuginfo *dbg,
> int ret = 0;
>
> #if _ELFUTILS_PREREQ(0, 142)
> + Elf *elf;
> + GElf_Ehdr ehdr;
> + GElf_Shdr shdr;
> +
> /* Get the call frame information from this dwarf */
> - pf->cfi = dwarf_getcfi_elf(dwarf_getelf(dbg->dbg));
> + elf = dwarf_getelf(dbg->dbg);
> + if (elf == NULL)
> + return -EINVAL;
> +
> + if (gelf_getehdr(elf, &ehdr) == NULL)
> + return -EINVAL;
> +
> + if (elf_section_by_name(elf, &ehdr, &shdr, ".eh_frame", NULL) &&
> + shdr.sh_type == SHT_PROGBITS) {
> + pf->cfi = dwarf_getcfi_elf(elf);
> + } else {
> + pf->cfi = dwarf_getcfi(dbg->dbg);
> + }
> #endif
>
> off = 0;
>
--
Masami HIRAMATSU
Software Platform Research Dept. Linux Technology Research Center
Hitachi, Ltd., Yokohama Research Laboratory
E-mail: masami.hiramatsu.pt@hitachi.com
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: perf-probe crash in dwarf_getcfi_elf
2014-12-30 9:05 ` Namhyung Kim
2014-12-30 17:13 ` David Ahern
2014-12-30 22:13 ` Masami Hiramatsu
@ 2014-12-31 19:42 ` Mark Wielaard
2015-01-03 15:07 ` Namhyung Kim
2015-01-08 9:52 ` [tip:perf/urgent] perf probe: Fix " tip-bot for Namhyung Kim
3 siblings, 1 reply; 8+ messages in thread
From: Mark Wielaard @ 2014-12-31 19:42 UTC (permalink / raw)
To: Namhyung Kim
Cc: David Ahern, Masami Hiramatsu, Arnaldo Carvalho de Melo, LKML
On Tue, Dec 30, 2014 at 06:05:33PM +0900, Namhyung Kim wrote:
> And I found a related commit (5704c8c4fa71 "getcfi_scn_eh_frame: Don't
> crash and burn when .eh_frame bits aren't there.") in elfutils that
> can lead to a unexpected crash like this. To safely use the function,
> it needs to check the .eh_frame section is a PROGBITS type.
Sorry about that bug. It was fixed in elfutils 0.156, released July 2013.
Latest elfutils release is 0.161.
Checking .eh_frame is SHT_PROGBITS (and not SHT_NOBITS) looks like the
correct workaround if you have to deal with older elfutils releases.
Note that dwarf_getcfi_elf gets the CFI information from the .eh_frame
section associated with the ELF file underlying the Dwarf dbg and needs
to be released with a call to dwarf_cfi_end (). dwarf_getcfi () gets the
CFI information from the .debug_frame section data of the Dwarf dbg
and gets automatically releassed when dwarf_end () is called (you should
not call dwarf_cfi_end () on the result).
If the Dwarf dbg handle is associated with a separate debuginfo file,
then the .eh_frame section data will not be available (has SHT_NOBITS)
and you can get the .eh_frame section (and call dwarf_getcfi_elf ()) on
the original ELF file from which the Dwarf debuginfo file was split off.
In your patch you call dwarf_getcfi () as backup to get some CFI
information when you cannot call dwarf_getcfi_elf (). In general it
might make sense to also do this when dwarf_getcfi_elf fails. Or try
to get the CFI through both .eh_frame (from the executable ELF file)
with dwarf_getcfi_elf () and .debug_frame (from the Dwarf dbg file)
with dwarf_getcfi () and try to match an address in both tables
if one or the other fails.
Cheers,
Mark
^ permalink raw reply [flat|nested] 8+ messages in thread
* Re: perf-probe crash in dwarf_getcfi_elf
2014-12-31 19:42 ` Mark Wielaard
@ 2015-01-03 15:07 ` Namhyung Kim
0 siblings, 0 replies; 8+ messages in thread
From: Namhyung Kim @ 2015-01-03 15:07 UTC (permalink / raw)
To: Mark Wielaard
Cc: David Ahern, Masami Hiramatsu, Arnaldo Carvalho de Melo, LKML
Hi Mark,
On Thu, Jan 1, 2015 at 4:42 AM, Mark Wielaard <mjw@redhat.com> wrote:
> On Tue, Dec 30, 2014 at 06:05:33PM +0900, Namhyung Kim wrote:
>> And I found a related commit (5704c8c4fa71 "getcfi_scn_eh_frame: Don't
>> crash and burn when .eh_frame bits aren't there.") in elfutils that
>> can lead to a unexpected crash like this. To safely use the function,
>> it needs to check the .eh_frame section is a PROGBITS type.
>
> Sorry about that bug. It was fixed in elfutils 0.156, released July 2013.
> Latest elfutils release is 0.161.
>
> Checking .eh_frame is SHT_PROGBITS (and not SHT_NOBITS) looks like the
> correct workaround if you have to deal with older elfutils releases.
Thanks for confirming this.
>
> Note that dwarf_getcfi_elf gets the CFI information from the .eh_frame
> section associated with the ELF file underlying the Dwarf dbg and needs
> to be released with a call to dwarf_cfi_end (). dwarf_getcfi () gets the
> CFI information from the .debug_frame section data of the Dwarf dbg
> and gets automatically releassed when dwarf_end () is called (you should
> not call dwarf_cfi_end () on the result).
Ah, it's good to know. I have to check the code..
>
> If the Dwarf dbg handle is associated with a separate debuginfo file,
> then the .eh_frame section data will not be available (has SHT_NOBITS)
> and you can get the .eh_frame section (and call dwarf_getcfi_elf ()) on
> the original ELF file from which the Dwarf debuginfo file was split off.
>
> In your patch you call dwarf_getcfi () as backup to get some CFI
> information when you cannot call dwarf_getcfi_elf (). In general it
> might make sense to also do this when dwarf_getcfi_elf fails. Or try
> to get the CFI through both .eh_frame (from the executable ELF file)
> with dwarf_getcfi_elf () and .debug_frame (from the Dwarf dbg file)
> with dwarf_getcfi () and try to match an address in both tables
> if one or the other fails.
Thanks for your advice, I'll make a follow-up patch to address your comments.
Thanks,
Namhyung
^ permalink raw reply [flat|nested] 8+ messages in thread
* [tip:perf/urgent] perf probe: Fix crash in dwarf_getcfi_elf
2014-12-30 9:05 ` Namhyung Kim
` (2 preceding siblings ...)
2014-12-31 19:42 ` Mark Wielaard
@ 2015-01-08 9:52 ` tip-bot for Namhyung Kim
3 siblings, 0 replies; 8+ messages in thread
From: tip-bot for Namhyung Kim @ 2015-01-08 9:52 UTC (permalink / raw)
To: linux-tip-commits
Cc: masami.hiramatsu.pt, mingo, dsahern, tglx, linux-kernel, mjw,
acme, namhyung, hpa
Commit-ID: 4093325f829746b88eaf02a5ae3b88a325ea8b75
Gitweb: http://git.kernel.org/tip/4093325f829746b88eaf02a5ae3b88a325ea8b75
Author: Namhyung Kim <namhyung@kernel.org>
AuthorDate: Tue, 30 Dec 2014 17:47:47 +0900
Committer: Arnaldo Carvalho de Melo <acme@redhat.com>
CommitDate: Fri, 2 Jan 2015 12:44:01 -0300
perf probe: Fix crash in dwarf_getcfi_elf
David reported that perf can segfault when adding an uprobe event like
this:
$ perf probe -x /lib64/libc-2.14.90.so -a 'malloc size=%di'
(gdb) bt
#0 parse_eh_frame_hdr (hdr=0x0, hdr_size=2596, hdr_vaddr=71788,
ehdr=0x7fffffffd390, eh_frame_vaddr=
0x7fffffffd378, table_entries=0x8808d8, table_encoding=0x8808e0 "") at
dwarf_getcfi_elf.c:79
#1 0x000000385f81615a in getcfi_scn_eh_frame (hdr_vaddr=71788,
hdr_scn=0x8839b0, shdr=0x7fffffffd2f0, scn=<optimized out>,
ehdr=0x7fffffffd390, elf=0x882b30) at dwarf_getcfi_elf.c:231
#2 getcfi_shdr (ehdr=0x7fffffffd390, elf=0x882b30) at dwarf_getcfi_elf.c:283
#3 dwarf_getcfi_elf (elf=0x882b30) at dwarf_getcfi_elf.c:309
#4 0x00000000004d5bac in debuginfo__find_probes (pf=0x7fffffffd4f0,
dbg=Unhandled dwarf expression opcode 0xfa) at util/probe-finder.c:993
#5 0x00000000004d634a in debuginfo__find_trace_events (dbg=0x880840,
pev=<optimized out>, tevs=0x880f88, max_tevs=<optimized out>) at
util/probe-finder.c:1200
#6 0x00000000004aed6b in try_to_find_probe_trace_events (target=0x881b20
"/lib64/libpthread-2.14.90.so",
max_tevs=128, tevs=0x880f88, pev=0x859b30) at util/probe-event.c:482
#7 convert_to_probe_trace_events (target=0x881b20
"/lib64/libpthread-2.14.90.so", max_tevs=128, tevs=0x880f88,
pev=0x859b30) at util/probe-event.c:2356
#8 add_perf_probe_events (pevs=<optimized out>, npevs=1, max_tevs=128,
target=0x881b20 "/lib64/libpthread-2.14.90.so", force_add=false) at
util/probe-event.c:2391
#9 0x000000000044014f in __cmd_probe (argc=<optimized out>,
argv=0x7fffffffe2f0, prefix=Unhandled dwarf expression opcode 0xfa) at
at builtin-probe.c:488
#10 0x0000000000440313 in cmd_probe (argc=5, argv=0x7fffffffe2f0,
prefix=<optimized out>) at builtin-probe.c:506
#11 0x000000000041d133 in run_builtin (p=0x805680, argc=5,
argv=0x7fffffffe2f0) at perf.c:341
#12 0x000000000041c8b2 in handle_internal_command (argv=<optimized out>,
argc=<optimized out>) at perf.c:400
#13 run_argv (argv=<optimized out>, argcp=<optimized out>) at perf.c:444
#14 main (argc=5, argv=0x7fffffffe2f0) at perf.c:559
And I found a related commit (5704c8c4fa71 "getcfi_scn_eh_frame: Don't
crash and burn when .eh_frame bits aren't there.") in elfutils that can
lead to a unexpected crash like this. To safely use the function, it
needs to check the .eh_frame section is a PROGBITS type.
Reported-by: David Ahern <dsahern@gmail.com>
Tested-by: David Ahern <dsahern@gmail.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Mark Wielaard <mjw@redhat.com>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Link: http://lkml.kernel.org/r/20141230090533.GH6081@sejong
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/util/probe-finder.c | 18 +++++++++++++++++-
1 file changed, 17 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c
index c7918f8..b5247d7 100644
--- a/tools/perf/util/probe-finder.c
+++ b/tools/perf/util/probe-finder.c
@@ -989,8 +989,24 @@ static int debuginfo__find_probes(struct debuginfo *dbg,
int ret = 0;
#if _ELFUTILS_PREREQ(0, 142)
+ Elf *elf;
+ GElf_Ehdr ehdr;
+ GElf_Shdr shdr;
+
/* Get the call frame information from this dwarf */
- pf->cfi = dwarf_getcfi_elf(dwarf_getelf(dbg->dbg));
+ elf = dwarf_getelf(dbg->dbg);
+ if (elf == NULL)
+ return -EINVAL;
+
+ if (gelf_getehdr(elf, &ehdr) == NULL)
+ return -EINVAL;
+
+ if (elf_section_by_name(elf, &ehdr, &shdr, ".eh_frame", NULL) &&
+ shdr.sh_type == SHT_PROGBITS) {
+ pf->cfi = dwarf_getcfi_elf(elf);
+ } else {
+ pf->cfi = dwarf_getcfi(dbg->dbg);
+ }
#endif
off = 0;
^ permalink raw reply related [flat|nested] 8+ messages in thread
end of thread, other threads:[~2015-01-08 9:52 UTC | newest]
Thread overview: 8+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-30 4:39 perf-probe crash in dwarf_getcfi_elf David Ahern
2014-12-30 8:47 ` Namhyung Kim
2014-12-30 9:05 ` Namhyung Kim
2014-12-30 17:13 ` David Ahern
2014-12-30 22:13 ` Masami Hiramatsu
2014-12-31 19:42 ` Mark Wielaard
2015-01-03 15:07 ` Namhyung Kim
2015-01-08 9:52 ` [tip:perf/urgent] perf probe: Fix " tip-bot for Namhyung Kim
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.