linux-stable.git/tools/perf/util/thread.c, branch v6.5.2

perf thread: Add reference count checking

2023-06-12T18:57:53+00:00

Modify struct declaration and accessor functions for the reference
count checkers additional layer of indirection. Make sure pid_cmp in
builtin-sched.c uses the underlying/original struct in pointer
arithmetic, and not the temporary get/put indirection.

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ali Saidi 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Brian Robbins 
Cc: Changbin Du 
Cc: Dmitrii Dolgov <9erthalion6@gmail.com>
Cc: Fangrui Song 
Cc: German Gomez 
Cc: Ingo Molnar 
Cc: Ivan Babrou 
Cc: James Clark 
Cc: Jing Zhang 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Liam Howlett 
Cc: Mark Rutland 
Cc: Miguel Ojeda 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Naveen N. Rao 
Cc: Peter Zijlstra 
Cc: Ravi Bangoria 
Cc: Sean Christopherson 
Cc: Steinar H. Gunderson 
Cc: Suzuki Poulouse 
Cc: Wenyu Liu 
Cc: Will Deacon 
Cc: Yang Jihong 
Cc: Ye Xingchen 
Cc: Yuan Can 
Cc: coresight@lists.linaro.org
Cc: linux-arm-kernel@lists.infradead.org
Link: https://lore.kernel.org/r/20230608232823.4027869-8-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf addr_location: Add init/exit/copy functions

2023-06-12T18:57:53+00:00

struct addr_location holds references to multiple reference counted
objects. Add init/exit functions to make maintenance of those more
consistent with the rest of the code and to try to avoid
leaks. Modification of thread reference counts isn't included in this
change.

Committer notes:

I needed to initialize result to sample->ip to make sure is set to
something, fixing a compile time error, mostly keeping the previous
logic as build_alloc_func_list() already does debugging/error prints
about what went wrong if it takes the 'goto out'.

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ali Saidi 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Brian Robbins 
Cc: Changbin Du 
Cc: Dmitrii Dolgov <9erthalion6@gmail.com>
Cc: Fangrui Song 
Cc: German Gomez 
Cc: Ingo Molnar 
Cc: Ivan Babrou 
Cc: James Clark 
Cc: Jing Zhang 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Liam Howlett 
Cc: Mark Rutland 
Cc: Miguel Ojeda 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Naveen N. Rao 
Cc: Peter Zijlstra 
Cc: Ravi Bangoria 
Cc: Sean Christopherson 
Cc: Steinar H. Gunderson 
Cc: Suzuki Poulouse 
Cc: Wenyu Liu 
Cc: Will Deacon 
Cc: Yang Jihong 
Cc: Ye Xingchen 
Cc: Yuan Can 
Cc: coresight@lists.linaro.org
Cc: linux-arm-kernel@lists.infradead.org
Link: https://lore.kernel.org/r/20230608232823.4027869-7-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf thread: Add accessor functions for thread

2023-06-12T18:57:53+00:00

Using accessors will make it easier to add reference count checking in
later patches.

Committer notes:

thread->nsinfo wasn't wrapped as it is used together with
nsinfo__zput(), where does a trick to set the field with a refcount
being dropped to NULL, and that doesn't work well with using
thread__nsinfo(thread), that loses the &thread->nsinfo pointer.

When refcount checking is added to 'struct thread', later in this
series, nsinfo__zput(RC_CHK_ACCESS(thread)->nsinfo) will be used to
check the thread pointer.

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ali Saidi 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Brian Robbins 
Cc: Changbin Du 
Cc: Dmitrii Dolgov <9erthalion6@gmail.com>
Cc: Fangrui Song 
Cc: German Gomez 
Cc: Ingo Molnar 
Cc: Ivan Babrou 
Cc: James Clark 
Cc: Jing Zhang 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Liam Howlett 
Cc: Mark Rutland 
Cc: Miguel Ojeda 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Naveen N. Rao 
Cc: Peter Zijlstra 
Cc: Ravi Bangoria 
Cc: Sean Christopherson 
Cc: Steinar H. Gunderson 
Cc: Suzuki Poulouse 
Cc: Wenyu Liu 
Cc: Will Deacon 
Cc: Yang Jihong 
Cc: Ye Xingchen 
Cc: Yuan Can 
Cc: coresight@lists.linaro.org
Cc: linux-arm-kernel@lists.infradead.org
Link: https://lore.kernel.org/r/20230608232823.4027869-4-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf thread: Make threads rbtree non-invasive

2023-06-12T18:57:53+00:00

Separate the rbtree out of thread and into a new struct
thread_rb_node. The refcnt is in thread and the rbtree is responsible
for a single count.

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ali Saidi 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Brian Robbins 
Cc: Changbin Du 
Cc: Dmitrii Dolgov <9erthalion6@gmail.com>
Cc: Fangrui Song 
Cc: German Gomez 
Cc: Ingo Molnar 
Cc: Ivan Babrou 
Cc: James Clark 
Cc: Jing Zhang 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Liam Howlett 
Cc: Mark Rutland 
Cc: Miguel Ojeda 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Naveen N. Rao 
Cc: Peter Zijlstra 
Cc: Ravi Bangoria 
Cc: Sean Christopherson 
Cc: Steinar H. Gunderson 
Cc: Suzuki Poulouse 
Cc: Wenyu Liu 
Cc: Will Deacon 
Cc: Yang Jihong 
Cc: Ye Xingchen 
Cc: Yuan Can 
Cc: coresight@lists.linaro.org
Cc: linux-arm-kernel@lists.infradead.org
Link: https://lore.kernel.org/r/20230608232823.4027869-3-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf thread: Remove notion of dead threads

2023-06-12T18:57:53+00:00

The dead thread list is best effort. Threads live on it until the
reference count hits zero and they are removed. With correct reference
counting this should never happen. It is, however, part of the 'perf
sched' output that is now removed. If this is an issue we should
implement tracking of dead threads in a robust not best-effort way.

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Ali Saidi 
Cc: Andi Kleen 
Cc: Athira Rajeev 
Cc: Brian Robbins 
Cc: Changbin Du 
Cc: Dmitrii Dolgov <9erthalion6@gmail.com>
Cc: Fangrui Song 
Cc: German Gomez 
Cc: Ingo Molnar 
Cc: Ivan Babrou 
Cc: James Clark 
Cc: Jing Zhang 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: K Prateek Nayak 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Liam Howlett 
Cc: Mark Rutland 
Cc: Miguel Ojeda 
Cc: Mike Leach 
Cc: Namhyung Kim 
Cc: Naveen N. Rao 
Cc: Peter Zijlstra 
Cc: Ravi Bangoria 
Cc: Sean Christopherson 
Cc: Steinar H. Gunderson 
Cc: Suzuki Poulouse 
Cc: Wenyu Liu 
Cc: Will Deacon 
Cc: Yang Jihong 
Cc: Ye Xingchen 
Cc: Yuan Can 
Cc: coresight@lists.linaro.org
Cc: linux-arm-kernel@lists.infradead.org
Link: https://lore.kernel.org/r/20230608232823.4027869-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf map: Add helper for ->map_ip() and ->unmap_ip()

2023-04-07T01:10:17+00:00

Later changes will add reference count checking for struct map, add a
helper function to invoke the map_ip and unmap_ip function pointers. The
helper allows the reference count check to be in fewer places.

Committer notes:

Add missing conversions to:

  tools/perf/util/map.c
  tools/perf/util/cs-etm.c
  tools/perf/util/annotate.c
  tools/perf/arch/powerpc/util/sym-handling.c
  tools/perf/arch/s390/annotate/instructions.c

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Alexey Bayduraev 
Cc: Andi Kleen 
Cc: Andrew Morton 
Cc: Andy Shevchenko 
Cc: Darren Hart 
Cc: Davidlohr Bueso 
Cc: Dmitriy Vyukov 
Cc: Eric Dumazet 
Cc: German Gomez 
Cc: Hao Luo 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Kajol Jain 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Madhavan Srinivasan 
Cc: Mark Rutland 
Cc: Masami Hiramatsu 
Cc: Miaoqian Lin 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Riccardo Mancini 
Cc: Shunsuke Nakamura 
Cc: Song Liu 
Cc: Stephane Eranian 
Cc: Stephen Brennan 
Cc: Steven Rostedt (VMware) 
Cc: Thomas Gleixner 
Cc: Thomas Richter 
Cc: Yury Norov 
Link: https://lore.kernel.org/r/20230404205954.2245628-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf map: Add accessor for dso

2023-04-04T19:41:57+00:00

Later changes will add reference count checking for struct map, with
dso being the most frequently accessed variable. Add an accessor so
that the reference count check is only necessary in one place.

Additional changes:
 - add a dso variable to avoid repeated map__dso calls.
 - in builtin-mem.c dump_raw_samples, code only partially tested for
   dso == NULL. Make the possibility of NULL consistent.
 - in thread.c thread__memcpy fix use of spaces and use tabs.

Committer notes:

Did missing conversions on these files:

   tools/perf/arch/powerpc/util/skip-callchain-idx.c
   tools/perf/arch/powerpc/util/sym-handling.c
   tools/perf/ui/browsers/hists.c
   tools/perf/ui/gtk/annotate.c
   tools/perf/util/cs-etm.c
   tools/perf/util/thread.c
   tools/perf/util/unwind-libunwind-local.c
   tools/perf/util/unwind-libunwind.c

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Alexey Bayduraev 
Cc: Andi Kleen 
Cc: Andrew Morton 
Cc: Andy Shevchenko 
Cc: Darren Hart 
Cc: Davidlohr Bueso 
Cc: Dmitriy Vyukov 
Cc: Eric Dumazet 
Cc: German Gomez 
Cc: Hao Luo 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Kajol Jain 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Madhavan Srinivasan 
Cc: Mark Rutland 
Cc: Masami Hiramatsu 
Cc: Miaoqian Lin 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Riccardo Mancini 
Cc: Shunsuke Nakamura 
Cc: Song Liu 
Cc: Stephane Eranian 
Cc: Stephen Brennan 
Cc: Steven Rostedt (VMware) 
Cc: Thomas Gleixner 
Cc: Thomas Richter 
Cc: Yury Norov 
Link: https://lore.kernel.org/r/20230320212248.1175731-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf maps: Add functions to access maps

2023-04-04T18:45:38+00:00

Introduce functions to access struct maps. These functions reduce the
number of places reference counting is necessary. While tidying APIs do
some small const-ification, in particlar to unwind_libunwind_ops.

Committer notes:

Fixed up tools/perf/util/unwind-libunwind.c:

-               return ops->get_entries(cb, arg, thread, data, max_stack);
+               return ops->get_entries(cb, arg, thread, data, max_stack, best_effort);

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Alexey Bayduraev 
Cc: Andi Kleen 
Cc: Andrew Morton 
Cc: Andy Shevchenko 
Cc: Darren Hart 
Cc: Davidlohr Bueso 
Cc: Dmitriy Vyukov 
Cc: Eric Dumazet 
Cc: German Gomez 
Cc: Hao Luo 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Kajol Jain 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Madhavan Srinivasan 
Cc: Mark Rutland 
Cc: Masami Hiramatsu 
Cc: Miaoqian Lin 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Riccardo Mancini 
Cc: Shunsuke Nakamura 
Cc: Song Liu 
Cc: Stephane Eranian 
Cc: Stephen Brennan 
Cc: Steven Rostedt (VMware) 
Cc: Thomas Gleixner 
Cc: Thomas Richter 
Cc: Yury Norov 
Link: https://lore.kernel.org/r/20230320212248.1175731-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf maps: Remove rb_node from struct map

2023-04-04T17:06:27+00:00

struct map is reference counted, having it also be a node in an
red-black tree complicates the reference counting. Switch to having a
map_rb_node which is a red-block tree node but points at the reference
counted struct map. This reference is responsible for a single reference
count.

Committer notes:

Fixed up tools/perf/util/unwind-libunwind-local.c to use map_rb_node as
well.

Signed-off-by: Ian Rogers 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Alexey Bayduraev 
Cc: Andi Kleen 
Cc: Andrew Morton 
Cc: Andy Shevchenko 
Cc: Darren Hart 
Cc: Davidlohr Bueso 
Cc: Dmitriy Vyukov 
Cc: Eric Dumazet 
Cc: German Gomez 
Cc: Hao Luo 
Cc: Ingo Molnar 
Cc: James Clark 
Cc: Jiri Olsa 
Cc: John Garry 
Cc: Kajol Jain 
Cc: Kan Liang 
Cc: Leo Yan 
Cc: Madhavan Srinivasan 
Cc: Mark Rutland 
Cc: Masami Hiramatsu 
Cc: Miaoqian Lin 
Cc: Namhyung Kim 
Cc: Peter Zijlstra 
Cc: Riccardo Mancini 
Cc: Shunsuke Nakamura 
Cc: Song Liu 
Cc: Stephane Eranian 
Cc: Stephen Brennan 
Cc: Steven Rostedt (VMware) 
Cc: Thomas Gleixner 
Cc: Thomas Richter 
Cc: Yury Norov 
Link: https://lore.kernel.org/r/20230320212248.1175731-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo

perf top: Fix rare segfault in thread__comm_len()

2023-03-15T13:28:25+00:00

In thread__comm_len(),strlen() is called outside of the
thread->comm_lock critical section,which may cause a UAF
problems if comm__free() is called by the process_thread
concurrently.

backtrace of the core file is as follows:

    (gdb) bt
    #0  __strlen_evex () at ../sysdeps/x86_64/multiarch/strlen-evex.S:77
    #1  0x000055ad15d31de5 in thread__comm_len (thread=0x7f627d20e300) at util/thread.c:320
    #2  0x000055ad15d4fade in hists__calc_col_len (h=0x7f627d295940, hists=0x55ad1772bfe0)
        at util/hist.c:103
    #3  hists__calc_col_len (hists=0x55ad1772bfe0, h=0x7f627d295940) at util/hist.c:79
    #4  0x000055ad15d52c8c in output_resort (hists=hists@entry=0x55ad1772bfe0, prog=0x0,
        use_callchain=false, cb=cb@entry=0x0, cb_arg=0x0) at util/hist.c:1926
    #5  0x000055ad15d530a4 in evsel__output_resort_cb (evsel=evsel@entry=0x55ad1772bde0,
        prog=prog@entry=0x0, cb=cb@entry=0x0, cb_arg=cb_arg@entry=0x0) at util/hist.c:1945
    #6  0x000055ad15d53110 in evsel__output_resort (evsel=evsel@entry=0x55ad1772bde0,
        prog=prog@entry=0x0) at util/hist.c:1950
    #7  0x000055ad15c6ae9a in perf_top__resort_hists (t=t@entry=0x7ffcd9cbf4f0) at builtin-top.c:311
    #8  0x000055ad15c6cc6d in perf_top__print_sym_table (top=0x7ffcd9cbf4f0) at builtin-top.c:346
    #9  display_thread (arg=0x7ffcd9cbf4f0) at builtin-top.c:700
    #10 0x00007f6282fab4fa in start_thread (arg=) at pthread_create.c:443
    #11 0x00007f628302e200 in clone3 () at ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81

The reason is that strlen() get a pointer to a memory that has been freed.

The string pointer is stored in the structure comm_str, which corresponds
to a rb_tree node,when the node is erased, the memory of the string is also freed.

In thread__comm_len(),it gets the pointer within the thread->comm_lock critical section,
but passed to strlen() outside of the thread->comm_lock critical section, and the perf
process_thread may called comm__free() concurrently, cause this segfault problem.

The process is as follows:

display_thread                                  process_thread
--------------                                  --------------

thread__comm_len
  -> thread__comm_str
       # held the comm read lock
    -> __thread__comm_str(thread)
       # release the comm read lock
                                                thread__delete
                                                     # held the comm write lock
                                                  -> comm__free
                                                    -> comm_str__put(comm->comm_str)
                                                      -> zfree(&cs->str)
                                                     # release the comm write lock
      # The memory of the string pointed
        to by comm has been free.
    -> thread->comm_len = strlen(comm);

This patch expand the critical section range of thread->comm_lock in thread__comm_len(),
to make strlen() called safe.

Signed-off-by: Wenyu Liu 
Acked-by: Namhyung Kim 
Cc: Adrian Hunter 
Cc: Alexander Shishkin 
Cc: Christian Brauner 
Cc: Feilong Lin 
Cc: Hewenliang 
Cc: Ian Rogers 
Cc: Ingo Molnar 
Cc: Jiri Olsa 
Cc: Mark Rutland 
Cc: Yunfeng Ye 
Link: https://lore.kernel.org/r/322bfb49-840b-f3b6-9ef1-f9ec3435b07e@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo