[PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

[PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

[Wang Nan]

If feed perf a symbol filter in cmdline and the result is empty,
pressing 'Enter' in the hist browser causes crash:

 # ./perf report perf.data   <-- Common mistake for beginners

Then press 'Enter':

 perf: Segmentation fault
 -------- backtrace --------
 /home/wangnan/perf[0x53e578]
 /lib64/libc.so.6(+0x3545f)[0x7f76bafe045f]
 /home/wangnan/perf[0x539dd4]
 /home/wangnan/perf(perf_evlist__tui_browse_hists+0x96)[0x53d216]
 /home/wangnan/perf(cmd_report+0x1b9f)[0x442c7f]
 /home/wangnan/perf[0x47efa2]
 /home/wangnan/perf(main+0x5f5)[0x432fa5]
 /lib64/libc.so.6(__libc_start_main+0xf4)[0x7f76bafccbd4]
 /home/wangnan/perf[0x4330d4]

This is because 'perf.data' is interperted as a symbol filter, and the
result is empty, so selection is empty. However,
hist_browser__toggle_fold() forgets to check it.

This patch simply return faluse when selection is NULL.

Signed-off-by: Wang Nan <wangnan0@huawei.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
---
 tools/perf/ui/browsers/hists.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
index dcdcbaf..33da341 100644
--- a/tools/perf/ui/browsers/hists.c
+++ b/tools/perf/ui/browsers/hists.c
@@ -337,9 +337,12 @@ static bool hist_browser__toggle_fold(struct hist_browser *browser)
 {
 	struct hist_entry *he = browser->he_selection;
 	struct map_symbol *ms = browser->selection;
-	struct callchain_list *cl = container_of(ms, struct callchain_list, ms);
+	struct callchain_list *cl = ms ? container_of(ms, struct callchain_list, ms) : NULL;
 	bool has_children;
 
+	if (!ms)
+		return false;
+
 	if (ms == &he->ms)
 		has_children = hist_entry__toggle_fold(he);
 	else
-- 
1.8.3.4

Re: [PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

[Namhyung Kim]

Hi,

On Wed, Dec 02, 2015 at 11:28:52AM +0000, Wang Nan wrote:
> If feed perf a symbol filter in cmdline and the result is empty,
> pressing 'Enter' in the hist browser causes crash:
> 
>  # ./perf report perf.data   <-- Common mistake for beginners
> 
> Then press 'Enter':
> 
>  perf: Segmentation fault
>  -------- backtrace --------
>  /home/wangnan/perf[0x53e578]
>  /lib64/libc.so.6(+0x3545f)[0x7f76bafe045f]
>  /home/wangnan/perf[0x539dd4]
>  /home/wangnan/perf(perf_evlist__tui_browse_hists+0x96)[0x53d216]
>  /home/wangnan/perf(cmd_report+0x1b9f)[0x442c7f]
>  /home/wangnan/perf[0x47efa2]
>  /home/wangnan/perf(main+0x5f5)[0x432fa5]
>  /lib64/libc.so.6(__libc_start_main+0xf4)[0x7f76bafccbd4]
>  /home/wangnan/perf[0x4330d4]
> 
> This is because 'perf.data' is interperted as a symbol filter, and the
> result is empty, so selection is empty. However,
> hist_browser__toggle_fold() forgets to check it.
> 
> This patch simply return faluse when selection is NULL.

s/faluse/false/

> 
> Signed-off-by: Wang Nan <wangnan0@huawei.com>
> Cc: Arnaldo Carvalho de Melo <acme@redhat.com>

Acked-by: Namhyung Kim <namhyung@kernel.org>

One nitpick below..

> ---
>  tools/perf/ui/browsers/hists.c | 5 ++++-
>  1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
> index dcdcbaf..33da341 100644
> --- a/tools/perf/ui/browsers/hists.c
> +++ b/tools/perf/ui/browsers/hists.c
> @@ -337,9 +337,12 @@ static bool hist_browser__toggle_fold(struct hist_browser *browser)
>  {
>  	struct hist_entry *he = browser->he_selection;
>  	struct map_symbol *ms = browser->selection;
> -	struct callchain_list *cl = container_of(ms, struct callchain_list, ms);
> +	struct callchain_list *cl = ms ? container_of(ms, struct callchain_list, ms) : NULL;

I think this line is not needed as container_of doesn't make a pointer
dereference by itself.  Just checking below is enough IMHO.

Thanks,
Namhyung


>  	bool has_children;
>  
> +	if (!ms)
> +		return false;
> +
>  	if (ms == &he->ms)
>  		has_children = hist_entry__toggle_fold(he);
>  	else
> -- 
> 1.8.3.4
> 

Re: [PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

[Wangnan (F)]

On 2015/12/2 23:49, Namhyung Kim wrote:
> Hi,
>
> On Wed, Dec 02, 2015 at 11:28:52AM +0000, Wang Nan wrote:
>> If feed perf a symbol filter in cmdline and the result is empty,
>> pressing 'Enter' in the hist browser causes crash:
>>
>>   # ./perf report perf.data   <-- Common mistake for beginners
>>
>> Then press 'Enter':
>>
>>   perf: Segmentation fault
>>   -------- backtrace --------
>>   /home/wangnan/perf[0x53e578]
>>   /lib64/libc.so.6(+0x3545f)[0x7f76bafe045f]
>>   /home/wangnan/perf[0x539dd4]
>>   /home/wangnan/perf(perf_evlist__tui_browse_hists+0x96)[0x53d216]
>>   /home/wangnan/perf(cmd_report+0x1b9f)[0x442c7f]
>>   /home/wangnan/perf[0x47efa2]
>>   /home/wangnan/perf(main+0x5f5)[0x432fa5]
>>   /lib64/libc.so.6(__libc_start_main+0xf4)[0x7f76bafccbd4]
>>   /home/wangnan/perf[0x4330d4]
>>
>> This is because 'perf.data' is interperted as a symbol filter, and the
>> result is empty, so selection is empty. However,
>> hist_browser__toggle_fold() forgets to check it.
>>
>> This patch simply return faluse when selection is NULL.
> s/faluse/false/
>
>> Signed-off-by: Wang Nan <wangnan0@huawei.com>
>> Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
> Acked-by: Namhyung Kim <namhyung@kernel.org>
>
> One nitpick below..
>
>> ---
>>   tools/perf/ui/browsers/hists.c | 5 ++++-
>>   1 file changed, 4 insertions(+), 1 deletion(-)
>>
>> diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
>> index dcdcbaf..33da341 100644
>> --- a/tools/perf/ui/browsers/hists.c
>> +++ b/tools/perf/ui/browsers/hists.c
>> @@ -337,9 +337,12 @@ static bool hist_browser__toggle_fold(struct hist_browser *browser)
>>   {
>>   	struct hist_entry *he = browser->he_selection;
>>   	struct map_symbol *ms = browser->selection;
>> -	struct callchain_list *cl = container_of(ms, struct callchain_list, ms);
>> +	struct callchain_list *cl = ms ? container_of(ms, struct callchain_list, ms) : NULL;
> I think this line is not needed as container_of doesn't make a pointer
> dereference by itself.  Just checking below is enough IMHO.

I know it. Add it only for correctness.

Will be removed.

Thank you.

> Thanks,
> Namhyung
>
>
>>   	bool has_children;
>>   
>> +	if (!ms)
>> +		return false;
>> +
>>   	if (ms == &he->ms)
>>   		has_children = hist_entry__toggle_fold(he);
>>   	else
>> -- 
>> 1.8.3.4
>>

Re: [PATCH] perf hists browser: Fix segfault if use symbol filter in cmdline

[Arnaldo Carvalho de Melo]

Em Thu, Dec 03, 2015 at 12:49:42AM +0900, Namhyung Kim escreveu:
> Hi,
> 
> On Wed, Dec 02, 2015 at 11:28:52AM +0000, Wang Nan wrote:
> > If feed perf a symbol filter in cmdline and the result is empty,
> > pressing 'Enter' in the hist browser causes crash:
> > 
> >  # ./perf report perf.data   <-- Common mistake for beginners
> > 
> > Then press 'Enter':
> > 
> >  perf: Segmentation fault
> >  -------- backtrace --------
> >  /home/wangnan/perf[0x53e578]
> >  /lib64/libc.so.6(+0x3545f)[0x7f76bafe045f]
> >  /home/wangnan/perf[0x539dd4]
> >  /home/wangnan/perf(perf_evlist__tui_browse_hists+0x96)[0x53d216]
> >  /home/wangnan/perf(cmd_report+0x1b9f)[0x442c7f]
> >  /home/wangnan/perf[0x47efa2]
> >  /home/wangnan/perf(main+0x5f5)[0x432fa5]
> >  /lib64/libc.so.6(__libc_start_main+0xf4)[0x7f76bafccbd4]
> >  /home/wangnan/perf[0x4330d4]
> > 
> > This is because 'perf.data' is interperted as a symbol filter, and the
> > result is empty, so selection is empty. However,
> > hist_browser__toggle_fold() forgets to check it.
> > 
> > This patch simply return faluse when selection is NULL.
> 
> s/faluse/false/

Fixed this and the 'interperted' and some other text details, and also
the container_of usage as reported by you below.

Thanks!

- Arnaldo
 
> > 
> > Signed-off-by: Wang Nan <wangnan0@huawei.com>
> > Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
> 
> Acked-by: Namhyung Kim <namhyung@kernel.org>
> 
> One nitpick below..
> 
> > ---
> >  tools/perf/ui/browsers/hists.c | 5 ++++-
> >  1 file changed, 4 insertions(+), 1 deletion(-)
> > 
> > diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
> > index dcdcbaf..33da341 100644
> > --- a/tools/perf/ui/browsers/hists.c
> > +++ b/tools/perf/ui/browsers/hists.c
> > @@ -337,9 +337,12 @@ static bool hist_browser__toggle_fold(struct hist_browser *browser)
> >  {
> >  	struct hist_entry *he = browser->he_selection;
> >  	struct map_symbol *ms = browser->selection;
> > -	struct callchain_list *cl = container_of(ms, struct callchain_list, ms);
> > +	struct callchain_list *cl = ms ? container_of(ms, struct callchain_list, ms) : NULL;
> 
> I think this line is not needed as container_of doesn't make a pointer
> dereference by itself.  Just checking below is enough IMHO.

Agreed, changing this.
 
> Thanks,
> Namhyung
> 
> 
> >  	bool has_children;
> >  
> > +	if (!ms)
> > +		return false;
> > +
> >  	if (ms == &he->ms)
> >  		has_children = hist_entry__toggle_fold(he);
> >  	else
> > -- 
> > 1.8.3.4
> >