From: Andi Kleen <ak@linux.intel.com>
To: Barry Song <song.bao.hua@hisilicon.com>
Cc: linux-kernel@vger.kernel.org, linuxarm@huawei.com,
Peter Zijlstra <peterz@infradead.org>,
Ingo Molnar <mingo@redhat.com>,
Arnaldo Carvalho de Melo <acme@kernel.org>,
Mark Rutland <mark.rutland@arm.com>,
Alexander Shishkin <alexander.shishkin@linux.intel.com>,
Jiri Olsa <jolsa@redhat.com>, Namhyung Kim <namhyung@kernel.org>,
Adrian Hunter <adrian.hunter@intel.com>,
Alexey Budankov <alexey.budankov@linux.intel.com>
Subject: Re: [PATCH] perf evlist: fix memory corruption for Kernel PMU event
Date: Thu, 1 Oct 2020 16:06:53 -0700 [thread overview]
Message-ID: <20201001230653.GM50079@tassilo.jf.intel.com> (raw)
In-Reply-To: <20201001115729.27116-1-song.bao.hua@hisilicon.com>
On Fri, Oct 02, 2020 at 12:57:29AM +1300, Barry Song wrote:
> Commit 7736627b865d ("perf stat: Use affinity for closing file
> descriptors") will use FD(evsel, cpu, thread) to read and write
> file descriptors xyarray. For a kernel PMU event, this leads to
> serious memory corruption and perf crash.
> I have seen evlist->core.cpus->nr is 1 while evsel has cpus->nr
> with the total number of CPUs. so xyarray which is allocated by
> evlist->core.cpus->nr will get overflow. This leads to various
> segmentation faults in perf tool for kernel PMU events, eg:
> ./perf stat -e bus_cycles sleep 1
> *** Error in `./perf': free(): invalid next size (fast): 0x00000000401e6370 ***
> Aborted (core dumped)
Thanks.
I believe there is already a patch queued for this.
The problem seems to only happen on ARM64.
-Andi
next prev parent reply other threads:[~2020-10-01 23:06 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-01 11:57 [PATCH] perf evlist: fix memory corruption for Kernel PMU event Barry Song
2020-10-01 23:06 ` Andi Kleen [this message]
2020-10-02 3:02 ` Song Bao Hua (Barry Song)
2020-10-06 1:25 ` Namhyung Kim
2020-10-06 6:39 ` Song Bao Hua (Barry Song)
2020-10-06 11:11 ` Jiri Olsa
2020-10-07 7:23 ` Namhyung Kim
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201001230653.GM50079@tassilo.jf.intel.com \
--to=ak@linux.intel.com \
--cc=acme@kernel.org \
--cc=adrian.hunter@intel.com \
--cc=alexander.shishkin@linux.intel.com \
--cc=alexey.budankov@linux.intel.com \
--cc=jolsa@redhat.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linuxarm@huawei.com \
--cc=mark.rutland@arm.com \
--cc=mingo@redhat.com \
--cc=namhyung@kernel.org \
--cc=peterz@infradead.org \
--cc=song.bao.hua@hisilicon.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox