From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752845AbcBAIzS (ORCPT ); Mon, 1 Feb 2016 03:55:18 -0500 Received: from mga03.intel.com ([134.134.136.65]:9478 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751787AbcBAIzQ (ORCPT ); Mon, 1 Feb 2016 03:55:16 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.22,379,1449561600"; d="scan'208";a="893627375" Subject: Re: [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info() To: Wang Nan , acme@kernel.org References: <1454296865-19749-1-git-send-email-wangnan0@huawei.com> Cc: linux-kernel@vger.kernel.org, Arnaldo Carvalho de Melo , Josh Poimboeuf From: Adrian Hunter Organization: Intel Finland Oy, Registered Address: PL 281, 00181 Helsinki, Business Identity Code: 0357606 - 4, Domiciled in Helsinki Message-ID: <56AF1C97.3080506@intel.com> Date: Mon, 1 Feb 2016 10:51:35 +0200 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:38.0) Gecko/20100101 Thunderbird/38.5.1 MIME-Version: 1.0 In-Reply-To: <1454296865-19749-1-git-send-email-wangnan0@huawei.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 01/02/16 05:21, Wang Nan wrote: > In error processing path of intel_pt_process_auxtrace_info() it calls > thread__zput() to clean and free pt->unknown_thread which is created by > thread__new(). However, when error raise, a segfault happen: > > # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs > Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. > intel_pt_synth_events: failed to synthesize 'instructions' event type > Segmentation fault (core dumped) > > The problem is: there's a union in 'struct thread' combines a list_head > and a rb_node. The standard life cycle of a thread is: init rb_node during > creating, inserted into machine->threads rbtree uses rb_node, move to > machine->dead_threads using list_head, clean by thread__put: > list_del_init(&thread->node). I sent a different patch for this: http://marc.info/?l=linux-kernel&m=145381014011697 > > In the above command, it clean a thread before adding it into list, > causes the above segfault. > > This patch gives a fake list_head and link the thread into it before > calling thread__zput(), get rid of the segfault. > > After this patch: > # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs > Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field. > intel_pt_synth_events: failed to synthesize 'instructions' event type > 0x248 [0x88]: failed to process type: 70 > > Reported-by: Tong Zhang > Signed-off-by: Wang Nan > Cc: Adrian Hunter > Cc: Arnaldo Carvalho de Melo > Cc: Josh Poimboeuf > --- > tools/perf/util/intel-pt.c | 4 ++++ > 1 file changed, 4 insertions(+) > > diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c > index 81a2eb7..e2add63 100644 > --- a/tools/perf/util/intel-pt.c > +++ b/tools/perf/util/intel-pt.c > @@ -2013,6 +2013,7 @@ int intel_pt_process_auxtrace_info(union perf_event *event, > struct auxtrace_info_event *auxtrace_info = &event->auxtrace_info; > size_t min_sz = sizeof(u64) * INTEL_PT_PER_CPU_MMAPS; > struct intel_pt *pt; > + struct list_head dead_thread; > int err; > > if (auxtrace_info->header.size < sizeof(struct auxtrace_info_event) + > @@ -2153,6 +2154,9 @@ int intel_pt_process_auxtrace_info(union perf_event *event, > return 0; > > err_delete_thread: > + RB_CLEAR_NODE(&pt->unknown_thread->rb_node); > + INIT_LIST_HEAD(&dead_thread); > + list_add(&pt->unknown_thread->node, &dead_thread); > thread__zput(pt->unknown_thread); > err_free_queues: > intel_pt_log_disable(); >