From: Andi Kleen <andi@firstfloor.org>
To: acme@kernel.org
Cc: jolsa@kernel.org, linux-kernel@vger.kernel.org,
Andi Kleen <ak@linux.intel.com>
Subject: [PATCH 2/2] perf, tools, stat: Reset ids counter when retrying events
Date: Thu, 5 Oct 2017 19:00:29 -0700 [thread overview]
Message-ID: <20171006020029.13339-2-andi@firstfloor.org> (raw)
In-Reply-To: <20171006020029.13339-1-andi@firstfloor.org>
From: Andi Kleen <ak@linux.intel.com>
perf stat can retry opening events. After opening an file descriptor
it adds the ids to the ecsel. Each event keeps a running
count of ids. When we decide to close an evsel and retry
with a different configuration this count needs to be reset,
otherwise it can overflow the buffer.
Always reset the ids count.
This fixes the following problem, triggered by a complex perf
stat configuration.
==666== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x600600001500 at pc 0x59dfd7 bp 0x7ffc6b397000 sp 0x7ffc6b396ff8
WRITE of size 8 at 0x600600001500 thread T0
#0 0x59dfd6 in perf_evlist__id_add /home/ak/hle/linux-hle-2.6/tools/perf/util/evlist.c:515
#1 0x59e291 in perf_evlist__id_add_fd /home/ak/hle/linux-hle-2.6/tools/perf/util/evlist.c:555
#2 0x4865c6 in __store_counter_ids /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:570
#3 0x4867d0 in store_counter_ids /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:587
#4 0x487521 in __run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:703
#5 0x487d6d in run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:805
#6 0x492914 in cmd_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:2839
#7 0x57479a in run_builtin /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:296
#8 0x574b5f in handle_internal_command /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:348
#9 0x574e3c in run_argv /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:392
#10 0x575401 in main /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:536
#11 0x7f7597af96e4 in __libc_start_main (/lib64/libc.so.6+0x206e4)
#12 0x444598 in _start /home/abuild/rpmbuild/BUILD/glibc-2.22/csu/../sysdeps/x86_64/start.S:118
0x600600001500 is located 0 bytes to the right of 32-byte region [0x6006000014e0,0x600600001500)
allocated by thread T0 here:
#0 0x7f759a698ab5 in calloc (/usr/lib64/libasan.so.0+0x15ab5)
#1 0x5a6045 in zalloc /home/ak/hle/linux-hle-2.6/tools/perf/util/util.h:22
#2 0x5ab51a in perf_evsel__alloc_id /home/ak/hle/linux-hle-2.6/tools/perf/util/evsel.c:1158
#3 0x4867ae in store_counter_ids /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:584
#4 0x487521 in __run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:703
#5 0x487d6d in run_perf_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:805
#6 0x492914 in cmd_stat /home/ak/hle/linux-hle-2.6/tools/perf/builtin-stat.c:2839
#7 0x57479a in run_builtin /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:296
#8 0x574b5f in handle_internal_command /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:348
#9 0x574e3c in run_argv /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:392
#10 0x575401 in main /home/ak/hle/linux-hle-2.6/tools/perf/perf.c:536
#11 0x7f7597af96e4 in __libc_start_main (/lib64/libc.so.6+0x206e4)
SUMMARY: AddressSanitizer: heap-buffer-overflow /home/ak/hle/linux-hle-2.6/tools/perf/util/evlist.c:515 perf_evlist__id_add
Shadow bytes around the buggy address:
0x0c013fff8250: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c013fff8260: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c013fff8270: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c013fff8280: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x0c013fff8290: fa fa fa fa fa fa fa fa fa fa fa fa 00 00 00 00
=>0x0c013fff82a0:[fa]fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
0x0c013fff82b0: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
0x0c013fff82c0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
0x0c013fff82d0: fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00
0x0c013fff82e0: 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00 fa fa
0x0c013fff82f0: 00 00 00 00 fa fa 00 00 00 00 fa fa 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Heap righ redzone: fb
Freed Heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack partial redzone: f4
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
ASan internal: fe
Signed-off-by: Andi Kleen <ak@linux.intel.com>
---
tools/perf/builtin-stat.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index 3c697118e44b..b54ec8497f97 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -652,6 +652,7 @@ static int __run_perf_stat(int argc, const char **argv)
evlist__for_each_entry(evsel_list, counter) {
try_again:
+ counter->ids = 0;
if (create_perf_stat_counter(counter) < 0) {
/* Weak group failed. Reset the group. */
--
2.13.6
next prev parent reply other threads:[~2017-10-06 2:00 UTC|newest]
Thread overview: 11+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-06 2:00 [PATCH 1/2] perf, tools, stat: Use xyarray dimensions to iterate fds Andi Kleen
2017-10-06 2:00 ` Andi Kleen [this message]
2017-10-06 3:36 ` [PATCH 2/2] perf, tools, stat: Reset ids counter when retrying events Andi Kleen
2018-02-21 14:00 ` Arnaldo Carvalho de Melo
2018-02-21 14:39 ` Jiri Olsa
2018-02-21 14:31 ` Jiri Olsa
2018-02-21 14:33 ` Arnaldo Carvalho de Melo
2018-02-21 14:37 ` Jiri Olsa
2018-02-21 14:33 ` [PATCH 1/2] perf, tools, stat: Use xyarray dimensions to iterate fds Jiri Olsa
2018-02-21 14:37 ` Arnaldo Carvalho de Melo
2018-03-06 6:41 ` [tip:perf/core] perf " tip-bot for Andi Kleen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20171006020029.13339-2-andi@firstfloor.org \
--to=andi@firstfloor.org \
--cc=acme@kernel.org \
--cc=ak@linux.intel.com \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox