• Ian Rogers's avatar
    perf record: Delete session after stopping sideband thread · 88ce0106
    Ian Rogers authored
    The session has a header in it which contains a perf env with
    bpf_progs. The bpf_progs are accessed by the sideband thread and so
    the sideband thread must be stopped before the session is deleted, to
    avoid a use after free.  This error was detected by AddressSanitizer
    in the following:
    
      ==2054673==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000161e00 at pc 0x55769289de54 bp 0x7f9df36d4ab0 sp 0x7f9df36d4aa8
      READ of size 8 at 0x61d000161e00 thread T1
          #0 0x55769289de53 in __perf_env__insert_bpf_prog_info util/env.c:42
          #1 0x55769289dbb1 in perf_env__insert_bpf_prog_info util/env.c:29
          #2 0x557692bbae29 in perf_env__add_bpf_info util/bpf-event.c:483
          #3 0x557692bbb01a in bpf_event__sb_cb util/bpf-event.c:512
          #4 0x5576928b75f4 in perf_evlist__poll_thread util/sideband_evlist.c:68
          #5 0x7f9df96a63eb in start_thread nptl/pthread_create.c:444
          #6 0x7f9df9726a4b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
      0x61d000161e00 is located 384 bytes inside of 2136-byte region [0x61d000161c80,0x61d0001624d8)
      freed by thread T0 here:
          #0 0x7f9dfa6d7288 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
          #1 0x557692978d50 in perf_session__delete util/session.c:319
          #2 0x557692673959 in __cmd_record tools/perf/builtin-record.c:2884
          #3 0x55769267a9f0 in cmd_record tools/perf/builtin-record.c:4259
          #4 0x55769286710c in run_builtin tools/perf/perf.c:349
          #5 0x557692867678 in handle_internal_command tools/perf/perf.c:402
          #6 0x557692867a40 in run_argv tools/perf/perf.c:446
          #7 0x557692867fae in main tools/perf/perf.c:562
          #8 0x7f9df96456c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    
    Fixes: 657ee553 ("perf evlist: Introduce side band thread")
    Signed-off-by: default avatarIan Rogers <irogers@google.com>
    Cc: Adrian Hunter <adrian.hunter@intel.com>
    Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
    Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
    Cc: Christian Brauner <brauner@kernel.org>
    Cc: Disha Goel <disgoel@linux.ibm.com>
    Cc: Ingo Molnar <mingo@redhat.com>
    Cc: James Clark <james.clark@arm.com>
    Cc: Jiri Olsa <jolsa@kernel.org>
    Cc: Kajol Jain <kjain@linux.ibm.com>
    Cc: Kan Liang <kan.liang@linux.intel.com>
    Cc: K Prateek Nayak <kprateek.nayak@amd.com>
    Cc: Mark Rutland <mark.rutland@arm.com>
    Cc: Namhyung Kim <namhyung@kernel.org>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Song Liu <songliubraving@fb.com>
    Cc: Tim Chen <tim.c.chen@linux.intel.com>
    Cc: Yicong Yang <yangyicong@hisilicon.com>
    Link: https://lore.kernel.org/r/20240301074639.2260708-1-irogers@google.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
    88ce0106
builtin-record.c 113 KB