Re: [RFC] perf tool: Fix memory corruption because of zero length symbols

From: Jiri Olsa
Date: Wed Oct 25 2017 - 09:56:33 EST


On Tue, Oct 24, 2017 at 07:50:06PM +0530, Ravi Bangoria wrote:
> Perf top is often crashing at very random locations on powerpc.
> After investigating, I found the crash only happens when sample
> is of zero length symbol. Powerpc kernel has many such symbols
> which does not contain length details in vmlinux binary and thus
> start and end addresses of such symbols are same.
>
> Structure
>
> struct sym_hist {
> u64 nr_samples;
> u64 period;
> struct sym_hist_entry addr[0];
> };
>
> has last member 'addr[]' of size zero. 'addr[]' is an array of
> addresses that belongs to one symbol (function). If function
> consist of 100 instructions, 'addr' points to an array of 100
> 'struct sym_hist_entry' elements. For zero length symbol, it
> points to the *empty* array, i.e. no members in the array and
> thus offset 0 is also invalid for such array.
>
> static int __symbol__inc_addr_samples(...)
> {
> ...
> offset = addr - sym->start;
> h = annotation__histogram(notes, evidx);
> h->nr_samples++;
> h->addr[offset].nr_samples++;
> h->period += sample->period;
> h->addr[offset].period += sample->period;
> ...
> }
>
> Here, when 'addr' is same as 'sym->start', 'offset' becomes 0,
> which is valid for normal symbols but *invalid* for zero length
> symbols and thus updating h->addr[offset] causes memory corruption.
>
> Fix this by adding one dummy element for zero length symbols.
>
> Fixes: edee44be5919 ("perf annotate: Don't throw error for zero length symbols")
> Signed-off-by: Ravi Bangoria <ravi.bangoria@xxxxxxxxxxxxxxxxxx>

Acked-by: Jiri Olsa <jolsa@xxxxxxxxxx>

thanks,
jirka