• Ravi Bangoria's avatar
    perf symbols: Fix memory corruption because of zero length symbols · 331c7cb3
    Ravi Bangoria authored
    Perf top is often crashing at very random locations on powerpc.  After
    investigating, I found the crash only happens when sample is of zero
    length symbol. Powerpc kernel has many such symbols which does not
    contain length details in vmlinux binary and thus start and end
    addresses of such symbols are same.
    
    Structure
    
      struct sym_hist {
            u64                   nr_samples;
            u64                   period;
            struct sym_hist_entry addr[0];
      };
    
    has last member 'addr[]' of size zero. 'addr[]' is an array of addresses
    that belongs to one symbol (function). If function consist of 100
    instructions, 'addr' points to an array of 100 'struct sym_hist_entry'
    elements. For zero length symbol, it points to the *empty* array, i.e.
    no members in the array and thus offset 0 is also invalid for such
    array.
    
      static int __symbol__inc_addr_samples(...)
      {
            ...
            offset = addr - sym->start;
            h = annotation__histogram(notes, evidx);
            h->nr_samples++;
            h->addr[offset].nr_samples++;
            h->period += sample->period;
            h->addr[offset].period += sample->period;
            ...
      }
    
    Here, when 'addr' is same as 'sym->start', 'offset' becomes 0, which is
    valid for normal symbols but *invalid* for zero length symbols and thus
    updating h->addr[offset] causes memory corruption.
    
    Fix this by adding one dummy element for zero length symbols.
    
    Link: https://lkml.org/lkml/2016/10/10/148
    Fixes: edee44be ("perf annotate: Don't throw error for zero length symbols")
    Signed-off-by: default avatarRavi Bangoria <ravi.bangoria@linux.vnet.ibm.com>
    Acked-by: default avatarJiri Olsa <jolsa@kernel.org>
    Acked-by: default avatarNamhyung Kim <namhyung@kernel.org>
    Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Cc: Jin Yao <yao.jin@linux.intel.com>
    Cc: Kim Phillips <kim.phillips@arm.com>
    Cc: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Taeung Song <treeze.taeung@gmail.com>
    Link: http://lkml.kernel.org/r/1508854806-10542-1-git-send-email-ravi.bangoria@linux.vnet.ibm.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
    331c7cb3
annotate.c 46.2 KB