[PATCH v2] perf trace: Fix SIGSEGV when processing syscall args

[PATCH v2] perf trace: Fix SIGSEGV when processing syscall args

[Naveen N. Rao]

On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to
process a perf.data file created with 'perf trace record -p':

  #0  0x00000001225b8988 in syscall_arg__scnprintf_augmented_string <snip> at builtin-trace.c:1492
  #1  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1492
  #2  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1486
  #3  0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val <snip> at builtin-trace.c:1973
  #4  syscall__scnprintf_args <snip> at builtin-trace.c:2041
  #5  0x00000001225bff04 in trace__sys_enter <snip> at builtin-trace.c:2319

That points to the below code in tools/perf/builtin-trace.c:
	/*
	 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
	 * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
	 * this breaks syscall__augmented_args() check for augmented args, as we calculate
	 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
	 * so when handling, say the openat syscall, we end up getting 6 args for the
	 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
	 * thinking that the extra 2 u64 args are the augmented filename, so just check
	 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
	 */
	if (evsel != trace->syscalls.events.sys_enter)
		augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);

As the comment points out, we should not be trying to augment the args
for raw_syscalls. However, when processing a perf.data file, we are not
initializing those properly. Fix the same.

Reported-by: Claudio Carvalho <cclaudio@linux.ibm.com>
Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
---
 tools/perf/builtin-trace.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 897fc504918b91..f075cf37a65ef8 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -4280,6 +4280,7 @@ static int trace__replay(struct trace *trace)
 		goto out;
 
 	evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter");
+	trace->syscalls.events.sys_enter = evsel;
 	/* older kernels have syscalls tp versus raw_syscalls */
 	if (evsel == NULL)
 		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter");
@@ -4292,6 +4293,7 @@ static int trace__replay(struct trace *trace)
 	}
 
 	evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_exit");
+	trace->syscalls.events.sys_exit = evsel;
 	if (evsel == NULL)
 		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_exit");
 	if (evsel &&

base-commit: 52f28b7bac75da9b8508f17438c9a8d83ab48e5d
-- 
2.36.1

Re: [PATCH v2] perf trace: Fix SIGSEGV when processing syscall args

[Namhyung Kim]

Hello,

On Thu, Jul 7, 2022 at 2:09 AM Naveen N. Rao
<naveen.n.rao@linux.vnet.ibm.com> wrote:
>
> On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to
> process a perf.data file created with 'perf trace record -p':
>
>   #0  0x00000001225b8988 in syscall_arg__scnprintf_augmented_string <snip> at builtin-trace.c:1492
>   #1  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1492
>   #2  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1486
>   #3  0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val <snip> at builtin-trace.c:1973
>   #4  syscall__scnprintf_args <snip> at builtin-trace.c:2041
>   #5  0x00000001225bff04 in trace__sys_enter <snip> at builtin-trace.c:2319
>
> That points to the below code in tools/perf/builtin-trace.c:
>         /*
>          * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
>          * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
>          * this breaks syscall__augmented_args() check for augmented args, as we calculate
>          * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
>          * so when handling, say the openat syscall, we end up getting 6 args for the
>          * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
>          * thinking that the extra 2 u64 args are the augmented filename, so just check
>          * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
>          */
>         if (evsel != trace->syscalls.events.sys_enter)
>                 augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
>
> As the comment points out, we should not be trying to augment the args
> for raw_syscalls. However, when processing a perf.data file, we are not
> initializing those properly. Fix the same.
>
> Reported-by: Claudio Carvalho <cclaudio@linux.ibm.com>
> Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
> ---
>  tools/perf/builtin-trace.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> index 897fc504918b91..f075cf37a65ef8 100644
> --- a/tools/perf/builtin-trace.c
> +++ b/tools/perf/builtin-trace.c
> @@ -4280,6 +4280,7 @@ static int trace__replay(struct trace *trace)
>                 goto out;
>
>         evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter");
> +       trace->syscalls.events.sys_enter = evsel;
>         /* older kernels have syscalls tp versus raw_syscalls */

Isn't it better to set it after the NULL check below?

>         if (evsel == NULL)
>                 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter");
> @@ -4292,6 +4293,7 @@ static int trace__replay(struct trace *trace)
>         }
>
>         evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_exit");
> +       trace->syscalls.events.sys_exit = evsel;

Ditto.

Thanks,
Namhyung


>         if (evsel == NULL)
>                 evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_exit");
>         if (evsel &&
>
> base-commit: 52f28b7bac75da9b8508f17438c9a8d83ab48e5d
> --
> 2.36.1
>

Re: [PATCH v2] perf trace: Fix SIGSEGV when processing syscall args

[Naveen N. Rao]

Hi Namhyung,

Namhyung Kim wrote:
> Hello,
> 
> On Thu, Jul 7, 2022 at 2:09 AM Naveen N. Rao
> <naveen.n.rao@linux.vnet.ibm.com> wrote:
>>
>> On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to
>> process a perf.data file created with 'perf trace record -p':
>>
>>   #0  0x00000001225b8988 in syscall_arg__scnprintf_augmented_string <snip> at builtin-trace.c:1492
>>   #1  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1492
>>   #2  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1486
>>   #3  0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val <snip> at builtin-trace.c:1973
>>   #4  syscall__scnprintf_args <snip> at builtin-trace.c:2041
>>   #5  0x00000001225bff04 in trace__sys_enter <snip> at builtin-trace.c:2319
>>
>> That points to the below code in tools/perf/builtin-trace.c:
>>         /*
>>          * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
>>          * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
>>          * this breaks syscall__augmented_args() check for augmented args, as we calculate
>>          * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
>>          * so when handling, say the openat syscall, we end up getting 6 args for the
>>          * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
>>          * thinking that the extra 2 u64 args are the augmented filename, so just check
>>          * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
>>          */
>>         if (evsel != trace->syscalls.events.sys_enter)
>>                 augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
>>
>> As the comment points out, we should not be trying to augment the args
>> for raw_syscalls. However, when processing a perf.data file, we are not
>> initializing those properly. Fix the same.
>>
>> Reported-by: Claudio Carvalho <cclaudio@linux.ibm.com>
>> Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
>> ---
>>  tools/perf/builtin-trace.c | 2 ++
>>  1 file changed, 2 insertions(+)
>>
>> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
>> index 897fc504918b91..f075cf37a65ef8 100644
>> --- a/tools/perf/builtin-trace.c
>> +++ b/tools/perf/builtin-trace.c
>> @@ -4280,6 +4280,7 @@ static int trace__replay(struct trace *trace)
>>                 goto out;
>>
>>         evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter");
>> +       trace->syscalls.events.sys_enter = evsel;
>>         /* older kernels have syscalls tp versus raw_syscalls */
> 
> Isn't it better to set it after the NULL check below?

From trace__sys_enter():
	/*
	 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
	 * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
	 * this breaks syscall__augmented_args() check for augmented args, as we calculate
	 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
	 * so when handling, say the openat syscall, we end up getting 6 args for the
	 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
	 * thinking that the extra 2 u64 args are the augmented filename, so just check
	 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
	 */
	if (evsel != trace->syscalls.events.sys_enter)
		augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);

From the previous discussion [1], it looks like the assumption above is 
that sys_enter would be set to raw_syscalls.

As such, I set it before the NULL check below, which ends up falling 
back to the non-raw syscalls tracepoint.


Thanks,
Naveen

[1] https://lore.kernel.org/all/YjDSRb1wwswKpJNJ@kernel.org/

Re: [PATCH v2] perf trace: Fix SIGSEGV when processing syscall args

[Arnaldo Carvalho de Melo]

Em Thu, Jul 07, 2022 at 02:39:00PM +0530, Naveen N. Rao escreveu:
> On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to
> process a perf.data file created with 'perf trace record -p':
> 
>   #0  0x00000001225b8988 in syscall_arg__scnprintf_augmented_string <snip> at builtin-trace.c:1492
>   #1  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1492
>   #2  syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1486
>   #3  0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val <snip> at builtin-trace.c:1973
>   #4  syscall__scnprintf_args <snip> at builtin-trace.c:2041
>   #5  0x00000001225bff04 in trace__sys_enter <snip> at builtin-trace.c:2319
> 
> That points to the below code in tools/perf/builtin-trace.c:
> 	/*
> 	 * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible
> 	 * arguments, even if the syscall being handled, say "openat", uses only 4 arguments
> 	 * this breaks syscall__augmented_args() check for augmented args, as we calculate
> 	 * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file,
> 	 * so when handling, say the openat syscall, we end up getting 6 args for the
> 	 * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly
> 	 * thinking that the extra 2 u64 args are the augmented filename, so just check
> 	 * here and avoid using augmented syscalls when the evsel is the raw_syscalls one.
> 	 */
> 	if (evsel != trace->syscalls.events.sys_enter)
> 		augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
> 
> As the comment points out, we should not be trying to augment the args
> for raw_syscalls. However, when processing a perf.data file, we are not
> initializing those properly. Fix the same.

Thanks, applied.

- Arnaldo

 
> Reported-by: Claudio Carvalho <cclaudio@linux.ibm.com>
> Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
> ---
>  tools/perf/builtin-trace.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> index 897fc504918b91..f075cf37a65ef8 100644
> --- a/tools/perf/builtin-trace.c
> +++ b/tools/perf/builtin-trace.c
> @@ -4280,6 +4280,7 @@ static int trace__replay(struct trace *trace)
>  		goto out;
>  
>  	evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter");
> +	trace->syscalls.events.sys_enter = evsel;
>  	/* older kernels have syscalls tp versus raw_syscalls */
>  	if (evsel == NULL)
>  		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_enter");
> @@ -4292,6 +4293,7 @@ static int trace__replay(struct trace *trace)
>  	}
>  
>  	evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_exit");
> +	trace->syscalls.events.sys_exit = evsel;
>  	if (evsel == NULL)
>  		evsel = evlist__find_tracepoint_by_name(session->evlist, "syscalls:sys_exit");
>  	if (evsel &&
> 
> base-commit: 52f28b7bac75da9b8508f17438c9a8d83ab48e5d
> -- 
> 2.36.1

-- 

- Arnaldo