perf inject --sched-stat can produce invalid perf.data files

perf inject --sched-stat can produce invalid perf.data files

[Milian Wolff]

[-- Attachment #1: Type: text/plain, Size: 2209 bytes --]

Hey all,

I've hit another issue that I have trouble understanding and fixing:

~~~~~~~~~~~~
echo 1 | sudo tee /proc/sys/kernel/sched_schedstats

perf record \
    --event sched:sched_stat_sleep/call-graph=no/ \
    --event sched:sched_switch/call-graph=fp/ \
    --output perf.data.raw \
    sleep 1

echo 0 | sudo tee /proc/sys/kernel/sched_schedstats

perf inject --sched-stat --input perf.data.raw --output perf.data
perf script # or perf report
0x4e18 [0xd8]: failed to process type: 9
~~~~~~~~~~~~

This happens only for the perf.data produced by perf-inject when at least one 
of the sched events has no call graph.

Looking at the code, I see that the issue is triggered in evsel.c:

~~~~~~~~~~~~
	if (type & PERF_SAMPLE_CALLCHAIN) {
		const u64 max_callchain_nr = UINT64_MAX / sizeof(u64);

		OVERFLOW_CHECK_u64(array);
		data->callchain = (struct ip_callchain *)array++;
		if (data->callchain->nr > max_callchain_nr)
			return -EFAULT;
		sz = data->callchain->nr * sizeof(u64);
		OVERFLOW_CHECK(array, sz, max_size);
		array = (void *)array + sz;
	}
~~~~~~~~~~~~

In GDB:

~~~~~~~~~~~~
(gdb) break evsel.c:1859
Breakpoint 1 at 0x5555556704d9: file util/evsel.c, line 1859.
(gdb) run
Starting program: /home/milian/.bin/perf script
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/usr/lib/libthread_db.so.1".

Breakpoint 1, perf_evsel__parse_sample (evsel=0x5555571c1d50, 
event=0x7ffff7ff4e18, data=0x7fffffffb3e0) at util/evsel.c:1861
1861                    data->callchain = (struct ip_callchain *)array++;
(gdb) next
1862                    if (data->callchain->nr > max_callchain_nr)
(gdb) print *data->callchain
$1 = {nr = 61654255534090, ips = 0x7ffff7ff4e58}
(gdb) next
1864                    sz = data->callchain->nr * sizeof(u64);
(gdb) 
1865                    OVERFLOW_CHECK(array, sz, max_size);
(gdb) print sz
$2 = 493234044272720
(gdb) next
1934                                    return -EFAULT;
~~~~~~~~~~~~

Can someone please look into this issue and find a way to fix perf-inject? 

Thanks

-- 
Milian Wolff | milian.wolff@kdab.com | Software Engineer
KDAB (Deutschland) GmbH&Co KG, a KDAB Group company
Tel: +49-30-521325470
KDAB - The Qt Experts

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5903 bytes --]

Re: perf inject --sched-stat can produce invalid perf.data files

[Milian Wolff]

[-- Attachment #1: Type: text/plain, Size: 2399 bytes --]

On Dienstag, 16. August 2016 17:56:10 CEST Milian Wolff wrote:
> Hey all,

ping?

> I've hit another issue that I have trouble understanding and fixing:
> 
> ~~~~~~~~~~~~
> echo 1 | sudo tee /proc/sys/kernel/sched_schedstats
> 
> perf record \
>     --event sched:sched_stat_sleep/call-graph=no/ \
>     --event sched:sched_switch/call-graph=fp/ \
>     --output perf.data.raw \
>     sleep 1
> 
> echo 0 | sudo tee /proc/sys/kernel/sched_schedstats
> 
> perf inject --sched-stat --input perf.data.raw --output perf.data
> perf script # or perf report
> 0x4e18 [0xd8]: failed to process type: 9
> ~~~~~~~~~~~~
> 
> This happens only for the perf.data produced by perf-inject when at least
> one of the sched events has no call graph.
> 
> Looking at the code, I see that the issue is triggered in evsel.c:
> 
> ~~~~~~~~~~~~
> 	if (type & PERF_SAMPLE_CALLCHAIN) {
> 		const u64 max_callchain_nr = UINT64_MAX / sizeof(u64);
> 
> 		OVERFLOW_CHECK_u64(array);
> 		data->callchain = (struct ip_callchain *)array++;
> 		if (data->callchain->nr > max_callchain_nr)
> 			return -EFAULT;
> 		sz = data->callchain->nr * sizeof(u64);
> 		OVERFLOW_CHECK(array, sz, max_size);
> 		array = (void *)array + sz;
> 	}
> ~~~~~~~~~~~~
> 
> In GDB:
> 
> ~~~~~~~~~~~~
> (gdb) break evsel.c:1859
> Breakpoint 1 at 0x5555556704d9: file util/evsel.c, line 1859.
> (gdb) run
> Starting program: /home/milian/.bin/perf script
> [Thread debugging using libthread_db enabled]
> Using host libthread_db library "/usr/lib/libthread_db.so.1".
> 
> Breakpoint 1, perf_evsel__parse_sample (evsel=0x5555571c1d50,
> event=0x7ffff7ff4e18, data=0x7fffffffb3e0) at util/evsel.c:1861
> 1861                    data->callchain = (struct ip_callchain *)array++;
> (gdb) next
> 1862                    if (data->callchain->nr > max_callchain_nr)
> (gdb) print *data->callchain
> $1 = {nr = 61654255534090, ips = 0x7ffff7ff4e58}
> (gdb) next
> 1864                    sz = data->callchain->nr * sizeof(u64);
> (gdb)
> 1865                    OVERFLOW_CHECK(array, sz, max_size);
> (gdb) print sz
> $2 = 493234044272720
> (gdb) next
> 1934                                    return -EFAULT;
> ~~~~~~~~~~~~
> 
> Can someone please look into this issue and find a way to fix perf-inject?

-- 
Milian Wolff | milian.wolff@kdab.com | Software Engineer
KDAB (Deutschland) GmbH&Co KG, a KDAB Group company
Tel: +49-30-521325470
KDAB - The Qt Experts

[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5903 bytes --]