Re: [PATCH 2/2] perf stat: Fix segfault when -r option is used

[Namhyung Kim]

On Wed, Feb 24, 2021 at 5:11 PM Namhyung Kim <namhyung@xxxxxxxxxx> wrote:
>
> I got a segfault when using -r option with event groups.  The option
> makes it run the workload multiple times and it will reuse the evlist
> and evsel for each run.

Well, it might not see a segfault because the freed memory region is
likely to be reused.  But you can see the bug clearly with asan.

Thanks,
Namhyung

>
> While most of resources are allocated and freed properly, the id hash
> in the evlist was not and it resulted in a crash.  You can see it with
> the address sanitizer like below:
>
>   $ perf stat -r 100 -e '{cycles,instructions}' true
>   =================================================================
>   ==693052==ERROR: AddressSanitizer: heap-use-after-free on
>       address 0x6080000003d0 at pc 0x558c57732835 bp 0x7fff1526adb0 sp 0x7fff1526ada8
>   WRITE of size 8 at 0x6080000003d0 thread T0
>     #0 0x558c57732834 in hlist_add_head /home/namhyung/project/linux/tools/include/linux/list.h:644
>     #1 0x558c57732834 in perf_evlist__id_hash /home/namhyung/project/linux/tools/lib/perf/evlist.c:237
>     #2 0x558c57732834 in perf_evlist__id_add /home/namhyung/project/linux/tools/lib/perf/evlist.c:244
>     #3 0x558c57732834 in perf_evlist__id_add_fd /home/namhyung/project/linux/tools/lib/perf/evlist.c:285
>     #4 0x558c5747733e in store_evsel_ids util/evsel.c:2765
>     #5 0x558c5747733e in evsel__store_ids util/evsel.c:2782
>     #6 0x558c5730b717 in __run_perf_stat /home/namhyung/project/linux/tools/perf/builtin-stat.c:895
>     #7 0x558c5730b717 in run_perf_stat /home/namhyung/project/linux/tools/perf/builtin-stat.c:1014
>     #8 0x558c5730b717 in cmd_stat /home/namhyung/project/linux/tools/perf/builtin-stat.c:2446
>     #9 0x558c57427c24 in run_builtin /home/namhyung/project/linux/tools/perf/perf.c:313
>     #10 0x558c572b1a48 in handle_internal_command /home/namhyung/project/linux/tools/perf/perf.c:365
>     #11 0x558c572b1a48 in run_argv /home/namhyung/project/linux/tools/perf/perf.c:409
>     #12 0x558c572b1a48 in main /home/namhyung/project/linux/tools/perf/perf.c:539
>     #13 0x7fcadb9f7d09 in __libc_start_main ../csu/libc-start.c:308
>     #14 0x558c572b60f9 in _start (/home/namhyung/project/linux/tools/perf/perf+0x45d0f9)
>
> Actually the nodes in the hash table are struct perf_stream_id and
> they were freed in the previous run.  Fix it by resetting the hash.
>
> Signed-off-by: Namhyung Kim <namhyung@xxxxxxxxxx>
> ---
>  tools/perf/util/evlist.c | 1 +
>  1 file changed, 1 insertion(+)
>
> diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
> index 5121b4db66fe..882cd1f721d9 100644
> --- a/tools/perf/util/evlist.c
> +++ b/tools/perf/util/evlist.c
> @@ -1306,6 +1306,7 @@ void evlist__close(struct evlist *evlist)
>                 perf_evsel__free_fd(&evsel->core);
>                 perf_evsel__free_id(&evsel->core);
>         }
> +       perf_evlist__reset_id_hash(&evlist->core);
>  }
>
>  static int evlist__create_syswide_maps(struct evlist *evlist)
> --
> 2.30.0.617.g56c4b15f3c-goog
>