[PATCH v5 3/5] perf symbols: Fix map removal sequence inside dso__process_kernel_symbol()

[Ian Rogers]

When parsing vmlinux ELF binary symbols, dso__process_kernel_symbol()
mutates the map's start address key fields in place before executing
maps__remove(). This forces maps__by_address_index() to look up the
new mutated address range via strict binary search inside an array
interval that was ordered using the old unmutated boundaries, leading
to a bsearch() mismatch failure and leaking maps index errors.

Fix this natively by executing maps__remove() before mutating the
map fields in place, ensuring binary search maps queries always locate
and extract target elements flawlessly.

Fixes: 39b12f781271 ("perf tools: Make it possible to read object code from vmlinux")
Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
---
 tools/perf/util/symbol-elf.c | 21 ++++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

diff --git a/tools/perf/util/symbol-elf.c b/tools/perf/util/symbol-elf.c
index 7afa8a117139..f31d481a8627 100644
--- a/tools/perf/util/symbol-elf.c
+++ b/tools/perf/util/symbol-elf.c
@@ -1372,20 +1372,31 @@ static int dso__process_kernel_symbol(struct dso *dso, struct map *map,
 		 */
 		if (*remap_kernel && dso__kernel(dso) && !kmodule) {
 			*remap_kernel = false;
-			map__set_start(map, shdr->sh_addr + ref_reloc(kmap));
-			map__set_end(map, map__start(map) + shdr->sh_size);
-			map__set_pgoff(map, shdr->sh_offset);
-			map__set_mapping_type(map, MAPPING_TYPE__DSO);
-			/* Ensure maps are correctly ordered */
+			/*
+			 * If the map is tracking inside the kmaps cache list array, we
+			 * MUST remove it before mutating its virtual address key fields
+			 * in place. Otherwise, downstream binary search lookups (bsearch)
+			 * will search for mutated keys inside an array sorted under old
+			 * invariants, causing indexing desynchronization faults.
+			 */
 			if (kmaps) {
 				int err;
 				struct map *tmp = map__get(map);
 
 				maps__remove(kmaps, map);
+				map__set_start(map, shdr->sh_addr + ref_reloc(kmap));
+				map__set_end(map, map__start(map) + shdr->sh_size);
+				map__set_pgoff(map, shdr->sh_offset);
+				map__set_mapping_type(map, MAPPING_TYPE__DSO);
 				err = maps__insert(kmaps, map);
 				map__put(tmp);
 				if (err)
 					return err;
+			} else {
+				map__set_start(map, shdr->sh_addr + ref_reloc(kmap));
+				map__set_end(map, map__start(map) + shdr->sh_size);
+				map__set_pgoff(map, shdr->sh_offset);
+				map__set_mapping_type(map, MAPPING_TYPE__DSO);
 			}
 		}
 
-- 
2.54.0.545.g6539524ca2-goog