• John Garry's avatar
    perf metricgroup: Fix find_evsel_group() event selector · fc96ec4d
    John Garry authored
    The following command segfaults on my x86 broadwell:
    
      $ ./perf stat  -M frontend_bound,retiring,backend_bound,bad_speculation sleep 1
      WARNING: grouped events cpus do not match, disabling group:
        anon group { raw 0x10e }
        anon group { raw 0x10e }
      perf: util/evsel.c:1596: get_group_fd: Assertion `!(!leader->core.fd)' failed.
      Aborted (core dumped)
    
    The issue shows itself as a use-after-free in evlist__check_cpu_maps(),
    whereby the leader of an event selector (evsel) has been deleted (yet we
    still attempt to verify for an evsel).
    
    Fundamentally the problem comes from metricgroup__setup_events() ->
    find_evsel_group(), and has developed from the previous fix attempt in
    commit 9c880c24 ("perf metricgroup: Fix for metrics containing
    duration_time").
    
    The problem now is that the logic in checking if an evsel is in the same
    group is subtly broken for the "cycles" event. For the "cycles" event,
    the pmu_name is NULL; however the logic in find_evsel_group() may set an
    event matched against "cycles" as used, when it should not be.
    
    This leads to a condition where an evsel is set, yet its leader is not.
    
    Fix the check for evsel pmu_name by not matching evsels when either has a
    NULL pmu_name.
    
    There is still a pre-existing metric issue whereby the ordering of the
    metrics may break the 'stat' function, as discussed at:
    https://lore.kernel.org/lkml/49c6fccb-b716-1bf0-18a6-cace1cdb66b9@huawei.com/
    
    Fixes: 9c880c24 ("perf metricgroup: Fix for metrics containing duration_time")
    Signed-off-by: default avatarJohn Garry <john.garry@huawei.com>
    Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com> # On a Thinkpad T450S
    Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Cc: Ian Rogers <irogers@google.com>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Kajol Jain <kjain@linux.ibm.com>
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Link: http://lore.kernel.org/lkml/1623335580-187317-2-git-send-email-john.garry@huawei.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
    fc96ec4d
metricgroup.c 31.9 KB