From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751994AbdJYOtf (ORCPT ); Wed, 25 Oct 2017 10:49:35 -0400 Received: from mail.kernel.org ([198.145.29.99]:49958 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751931AbdJYOtd (ORCPT ); Wed, 25 Oct 2017 10:49:33 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 1C85321871 Authentication-Results: mail.kernel.org; dmarc=none (p=none dis=none) header.from=kernel.org Authentication-Results: mail.kernel.org; spf=none smtp.mailfrom=acme@kernel.org Date: Wed, 25 Oct 2017 11:49:29 -0300 From: Arnaldo Carvalho de Melo To: "Naveen N. Rao" Cc: Jiri Olsa , Ravi Bangoria , linux-kernel@vger.kernel.org, peterz@infradead.org, mingo@redhat.com, alexander.shishkin@linux.intel.com, namhyung@kernel.org, treeze.taeung@gmail.com, yao.jin@linux.intel.com, kim.phillips@arm.com Subject: Re: [RFC] perf tool: Fix memory corruption because of zero length symbols Message-ID: <20171025144929.GG7045@kernel.org> References: <1508854806-10542-1-git-send-email-ravi.bangoria@linux.vnet.ibm.com> <20171025082820.GD22394@krava> <20171025092033.qfq7ksgtfzuzu4cp@naverao1-tp.localdomain> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20171025092033.qfq7ksgtfzuzu4cp@naverao1-tp.localdomain> X-Url: http://acmel.wordpress.com User-Agent: Mutt/1.9.1 (2017-09-22) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Em Wed, Oct 25, 2017 at 02:50:33PM +0530, Naveen N. Rao escreveu: > On 2017/10/25 08:28AM, Jiri Olsa wrote: > > On Tue, Oct 24, 2017 at 07:50:06PM +0530, Ravi Bangoria wrote: > > > Perf top is often crashing at very random locations on powerpc. > > > After investigating, I found the crash only happens when sample > > > is of zero length symbol. Powerpc kernel has many such symbols > > > which does not contain length details in vmlinux binary and thus > > > start and end addresses of such symbols are same. > > > > > > Structure > > > > > > struct sym_hist { > > > u64 nr_samples; > > > u64 period; > > > struct sym_hist_entry addr[0]; > > > }; > > > > > > has last member 'addr[]' of size zero. 'addr[]' is an array of > > > addresses that belongs to one symbol (function). If function > > > consist of 100 instructions, 'addr' points to an array of 100 > > > 'struct sym_hist_entry' elements. For zero length symbol, it > > > points to the *empty* array, i.e. no members in the array and > > > thus offset 0 is also invalid for such array. > > > > > > static int __symbol__inc_addr_samples(...) > > > { > > > ... > > > offset = addr - sym->start; > > > h = annotation__histogram(notes, evidx); > > > h->nr_samples++; > > > h->addr[offset].nr_samples++; > > > h->period += sample->period; > > > h->addr[offset].period += sample->period; > > > ... > > > } > > > > > > Here, when 'addr' is same as 'sym->start', 'offset' becomes 0, > > > which is valid for normal symbols but *invalid* for zero length > > > symbols and thus updating h->addr[offset] causes memory corruption. > > > > I think this will work, however what's the idea behind > > zero sized symbols? I mean when we get samples for it, > > what are they for.. is it like alias, whats the purpose? > > This was discussed here: > https://lkml.org/lkml/2016/10/10/148 > > We aren't setting the size for our assembly routines. Applying, after adding this as a Link: tag and Namhyung's and Jiri's acked-by, will try to have it in perf/urgent soon, i.e. for 4.14, if still possible. - Arnaldo