Commit 9c68ae98 authored by Krister Johansen's avatar Krister Johansen Committed by Arnaldo Carvalho de Melo

perf callchain: Reference count maps

If dso__load_kcore frees all of the existing maps, but one has already
been attached to a callchain cursor node, then we can get a SIGSEGV in
any function that happens to try to use this invalid cursor.  Use the
existing map refcount mechanism to forestall cleanup of a map until the
cursor iterates past the node.
Signed-off-by: default avatarKrister Johansen <kjlx@templeofstupid.com>
Tested-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: stable@kernel.org
Fixes: 84c2cafa ("perf tools: Reference count struct map")
Link: http://lkml.kernel.org/r/20170106062331.GB2707@templeofstupid.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
parent c0621acf
...@@ -449,7 +449,7 @@ fill_node(struct callchain_node *node, struct callchain_cursor *cursor) ...@@ -449,7 +449,7 @@ fill_node(struct callchain_node *node, struct callchain_cursor *cursor)
} }
call->ip = cursor_node->ip; call->ip = cursor_node->ip;
call->ms.sym = cursor_node->sym; call->ms.sym = cursor_node->sym;
call->ms.map = cursor_node->map; call->ms.map = map__get(cursor_node->map);
if (cursor_node->branch) { if (cursor_node->branch) {
call->branch_count = 1; call->branch_count = 1;
...@@ -489,6 +489,7 @@ add_child(struct callchain_node *parent, ...@@ -489,6 +489,7 @@ add_child(struct callchain_node *parent,
list_for_each_entry_safe(call, tmp, &new->val, list) { list_for_each_entry_safe(call, tmp, &new->val, list) {
list_del(&call->list); list_del(&call->list);
map__zput(call->ms.map);
free(call); free(call);
} }
free(new); free(new);
...@@ -773,6 +774,7 @@ merge_chain_branch(struct callchain_cursor *cursor, ...@@ -773,6 +774,7 @@ merge_chain_branch(struct callchain_cursor *cursor,
list->ms.map, list->ms.sym, list->ms.map, list->ms.sym,
false, NULL, 0, 0); false, NULL, 0, 0);
list_del(&list->list); list_del(&list->list);
map__zput(list->ms.map);
free(list); free(list);
} }
...@@ -823,7 +825,8 @@ int callchain_cursor_append(struct callchain_cursor *cursor, ...@@ -823,7 +825,8 @@ int callchain_cursor_append(struct callchain_cursor *cursor,
} }
node->ip = ip; node->ip = ip;
node->map = map; map__zput(node->map);
node->map = map__get(map);
node->sym = sym; node->sym = sym;
node->branch = branch; node->branch = branch;
node->nr_loop_iter = nr_loop_iter; node->nr_loop_iter = nr_loop_iter;
...@@ -1154,11 +1157,13 @@ static void free_callchain_node(struct callchain_node *node) ...@@ -1154,11 +1157,13 @@ static void free_callchain_node(struct callchain_node *node)
list_for_each_entry_safe(list, tmp, &node->parent_val, list) { list_for_each_entry_safe(list, tmp, &node->parent_val, list) {
list_del(&list->list); list_del(&list->list);
map__zput(list->ms.map);
free(list); free(list);
} }
list_for_each_entry_safe(list, tmp, &node->val, list) { list_for_each_entry_safe(list, tmp, &node->val, list) {
list_del(&list->list); list_del(&list->list);
map__zput(list->ms.map);
free(list); free(list);
} }
...@@ -1222,6 +1227,7 @@ int callchain_node__make_parent_list(struct callchain_node *node) ...@@ -1222,6 +1227,7 @@ int callchain_node__make_parent_list(struct callchain_node *node)
goto out; goto out;
*new = *chain; *new = *chain;
new->has_children = false; new->has_children = false;
map__get(new->ms.map);
list_add_tail(&new->list, &head); list_add_tail(&new->list, &head);
} }
parent = parent->parent; parent = parent->parent;
...@@ -1242,6 +1248,7 @@ int callchain_node__make_parent_list(struct callchain_node *node) ...@@ -1242,6 +1248,7 @@ int callchain_node__make_parent_list(struct callchain_node *node)
out: out:
list_for_each_entry_safe(chain, new, &head, list) { list_for_each_entry_safe(chain, new, &head, list) {
list_del(&chain->list); list_del(&chain->list);
map__zput(chain->ms.map);
free(chain); free(chain);
} }
return -ENOMEM; return -ENOMEM;
......
...@@ -5,6 +5,7 @@ ...@@ -5,6 +5,7 @@
#include <linux/list.h> #include <linux/list.h>
#include <linux/rbtree.h> #include <linux/rbtree.h>
#include "event.h" #include "event.h"
#include "map.h"
#include "symbol.h" #include "symbol.h"
#define HELP_PAD "\t\t\t\t" #define HELP_PAD "\t\t\t\t"
...@@ -184,8 +185,13 @@ int callchain_merge(struct callchain_cursor *cursor, ...@@ -184,8 +185,13 @@ int callchain_merge(struct callchain_cursor *cursor,
*/ */
static inline void callchain_cursor_reset(struct callchain_cursor *cursor) static inline void callchain_cursor_reset(struct callchain_cursor *cursor)
{ {
struct callchain_cursor_node *node;
cursor->nr = 0; cursor->nr = 0;
cursor->last = &cursor->first; cursor->last = &cursor->first;
for (node = cursor->first; node != NULL; node = node->next)
map__zput(node->map);
} }
int callchain_cursor_append(struct callchain_cursor *cursor, u64 ip, int callchain_cursor_append(struct callchain_cursor *cursor, u64 ip,
......
#include "util.h" #include "util.h"
#include "build-id.h" #include "build-id.h"
#include "hist.h" #include "hist.h"
#include "map.h"
#include "session.h" #include "session.h"
#include "sort.h" #include "sort.h"
#include "evlist.h" #include "evlist.h"
...@@ -1019,6 +1020,10 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, ...@@ -1019,6 +1020,10 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al,
int max_stack_depth, void *arg) int max_stack_depth, void *arg)
{ {
int err, err2; int err, err2;
struct map *alm = NULL;
if (al && al->map)
alm = map__get(al->map);
err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent, err = sample__resolve_callchain(iter->sample, &callchain_cursor, &iter->parent,
iter->evsel, al, max_stack_depth); iter->evsel, al, max_stack_depth);
...@@ -1058,6 +1063,8 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al, ...@@ -1058,6 +1063,8 @@ int hist_entry_iter__add(struct hist_entry_iter *iter, struct addr_location *al,
if (!err) if (!err)
err = err2; err = err2;
map__put(alm);
return err; return err;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment