- 14 Jun, 2023 6 commits
-
-
Ian Rogers authored
Multiple threads, such as with "perf top", may race to initialize a file system path like hugetlbfs. The racy initialization of the path leads to at least memory leaks. To avoid this initialize each fs for reading the mount point path with pthread_once. Mounting the file system may also be racy, so introduce a mutex over the function. This does mean that the path is being accessed with and without a mutex, which is inherently racy but hopefully benign, especially as there are fewer callers to fs__mount. Remove the fs__entries by directly using global variables, this was done as no argument like the index can be passed to the init once routine. Issue found and tested with "perf top" and address sanitizer. Signed-off-by:
Ian Rogers <irogers@google.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: bpf@vger.kernel.org Link: https://lore.kernel.org/r/20230609224004.180988-1-irogers@google.comSigned-off-by:
Arnaldo Carvalho de Melo <acme@redhat.com>
-
Ian Rogers authored
The addr2line process is sent an address then multiple function, filename:line "records" are read. To detect the end of output a ',' is sent and for llvm-addr2line a ',' is then read back showing the end of addrline's output. For binutils addr2line the ',' translates to address 0 and we expect the bogus filename marker "??:0" (see filename_split) to be sent from addr2line. For some kernels address 0 may have a mapping and so a seemingly valid inline output is given and breaking the sentinel discovery: ``` $ addr2line -e vmlinux -f -i , __per_cpu_start ./arch/x86/kernel/cpu/common.c:1850 ``` To avoid this problem enable the address dumping for addr2line (the -a option). If an address of 0x0000000000000000 is read then this is the sentinel value working around the problem above. The filename_split still needs to check for "??:0" as bogus non-zero addresses also need handling. Reported-by:
Changbin Du <changbin.du@huawei.com> Signed-off-by:
-
Ian Rogers authored
To aid debugging why it fails. Also, combine the loops for reading a line for the llvm/binutils cases. Signed-off-by:
-
Adrian Hunter authored
The "x86 instruction decoder - new instructions" test takes up space but is only really useful to developers. Make it optional at build time. Add variable EXTRA_TESTS which must be defined in order to build perf with the test. Example: Before: $ make -C tools/perf clean >/dev/null $ make -C tools/perf >/dev/null Makefile.config:650: No libunwind found. Please install libunwind-dev[el] >= 1.1 and/or set LIBUNWIND_DIR Makefile.config:1149: libpfm4 not found, disables libpfm4 support. Please install libpfm4-dev PERF_VERSION = 6.4.rc3.gd15b8c76 $ readelf -SW tools/perf/perf | grep '\.rela.dyn\|.rodata\|\.data.rel.ro' [10] .rela.dyn RELA 000000000002fcb0 02fcb0 0748b0 18 A 6 0 8 [18] .rodata PROGBITS 00000000002eb000 2eb000 6bac00 00 A 0 0 32 [25] .data.rel.ro PROGBITS 00000000009ea180 9e9180 04b540 00 WA 0 0 32 After: $ make -C tools/perf clean >/dev/null $ make -C tools/perf >/dev/null Makefile.config:650: No libunwind found. Please install libunwind-dev[el] >= 1.1 and/or set LIBUNWIND_DIR Makefile.config:1154: libpfm4 not found, disables libpfm4 support. Please install libpfm4-dev PERF_VERSION = 6.4.rc3.g4ea9c1569ea4 $ readelf -SW tools/perf/perf | grep '\.rela.dyn\|.rodata\|\.data.rel.ro' [10] .rela.dyn RELA 000000000002f3c8 02f3c8 036d68 18 A 6 0 8 [18] .rodata PROGBITS 00000000002ac000 2ac000 68da80 00 A 0 0 32 [25] .data.rel.ro PROGBITS 000000000097d440 97c440 022280 00 WA 0 0 32 Committer notes: Build with 'make EXTRA_TESTS=1 -C tools/perf O=/tmp/build/perf" and reproduced the ELF section size differences. Signed-off-by:Adrian Hunter <adrian.hunter@intel.com> Acked-by:
-
Namhyung Kim authored
It's possible some struct/union/enum type don't have type name. Allow the empty name after "struct"/"union"/"enum" string rather than fail. Signed-off-by:
Namhyung Kim <namhyung@kernel.org> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Ian Rogers <irogers@google.com> Cc: Ingo Molnar <mingo@kernel.org> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Masami Hiramatsu <mhiramat@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://lore.kernel.org/r/20230612234102.3909116-2-namhyung@kernel.orgSigned-off-by:
-
Namhyung Kim authored
The die_get_varname() returns "(unknown_type)" string if it failed to find a type for the variable. But it had a space before the opening parenthesis and it made the closing parenthesis cut off due to the off-by-one in the string length (14). Signed-off-by:
-
- 13 Jun, 2023 2 commits
-
-
Arnaldo Carvalho de Melo authored
Fixes: d1f1cecc ("perf list: Check if libpfm4 event is supported") Reported-by:
kernel test robot <yujie.liu@intel.com> Closes: https://lore.kernel.org/r/202306110636.2sTsiAcl-lkp@intel.com/ Cc: Namhyung Kim <namhyung@kernel.org> Signed-off-by:
-
Namhyung Kim authored
The llvm-objdump adds a space between the operands while GNU objdump does not. Allow a space to handle the both. In GNU objdump: Disassembly of section .text: here | ffffffff81000000 <_stext>: v ffffffff81000000: 48 8d 25 51 1f 40 01 lea 0x1401f51(%rip),%rsp ffffffff81000007: e8 d4 00 00 00 call ffffffff810000e0 <verify_cpu> ffffffff8100000c: 48 8d 3d ed ff ff ff lea -0x13(%rip),%rdi In llvm-objdump: Disassembly of section .text: here | ffffffff81000000 <startup_64>: v ffffffff81000000: 48 8d 25 51 1f 40 01 leaq 20979537(%rip), %rsp ffffffff81000007: e8 d4 00 00 00 callq 0xffffffff810000e0 <verify_cpu> ffffffff8100000c: 48 8d 3d ed ff ff ff leaq -19(%rip), %rdi Signed-off-by:
-
- 12 Jun, 2023 32 commits
-
-
Ian Rogers authored
The event_buf is 64kb (PERF_SAMPLE_SIZE_MAX) and stack allocated in struct perf_inject. It is used for guest events that may not exist in a file. Make the array allocation lazy to cut down on the stack usage. Signed-off-by:
-
Ian Rogers authored
The event_copy is 64kb (PERF_SAMPLE_SIZE_MAX) and stack allocated in struct perf_inject. It is used for aux events that may not exist in a file. Make the array allocation lazy to cut down on the stack usage. Signed-off-by:
-
Ian Rogers authored
Some char buffers are stack allocated but in total they come to 24kb. Avoid Wstack-usage warnings by moving the arrays to being dynamically allocated. Signed-off-by:
-
Ian Rogers authored
Commit 5ded57ac ("perf inject: Remove static variables") moved static variables to local, however, in this case 3 MAX_CPUS (4096) sized arrays were moved onto the stack making the stack frame quite large. Avoid the stack usage by dynamically allocating the arrays. Signed-off-by:
-
Ian Rogers authored
Place sender and receiver contexts onto lists so that they may be freed on exit. Add missing pthread_attr_destroy. Fixes memory leaks reported by leak sanitizer. Signed-off-by:
-
Ian Rogers authored
Remove code sharing the pthread_attr_t and initialize/destroy pthread_attr_t when needed. This avoids the same attribute being set that leak sanitizer reports as a memory leak. Signed-off-by:
-
Ian Rogers authored
Issues detected by leak sanitizer. Signed-off-by:
-
Ian Rogers authored
Avoid potential memory leaks. Committer notes: This is right before calling exit(1), so just to clean up memory leak checker detection. Signed-off-by:
-
Ian Rogers authored
exclude_cmds will shorten the cmds names array, before doing so free the removed entry. Signed-off-by:
-
James Clark authored
Assert that our own tracking of the exception level matches what OpenCSD provides. OpenCSD doesn't distinguish between EL0 and EL1 in the memory access callback so the extra tracking was required. But a rough assert can still be done. Signed-off-by:
James Clark <james.clark@arm.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Ian Rogers <irogers@google.com> Cc: Ingo Molnar <mingo@redhat.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: John Garry <john.g.garry@oracle.com> Cc: Leo Yan <leo.yan@linaro.org> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Mike Leach <mike.leach@linaro.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Suzuki Poulouse <suzuki.poulose@arm.com> Cc: Will Deacon <will@kernel.org> Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: https://lore.kernel.org/r/20230612111403.100613-6-james.clark@arm.comSigned-off-by:
-
James Clark authored
Currently we assume all trace belongs to the host machine so when the decoder should be looking at the guest kernel maps it can crash because it looks at the host ones instead. Avoid one scenario (guest kernel running at EL1) by assigning the default guest machine to this trace. For userspace trace it's still not possible to determine guest vs host, but the PIDs should help in this case. Committer notes: Fixed up conflict with: perf addr_location: Add init/exit/copy functions That was only on tmp.perf-tools-next. Reviewed-by:
Leo Yan <leo.yan@linaro.org> Signed-off-by:
-
James Clark authored
To avoid every user of PID format having to use their own static local variable, cache it on initialisation and change the accessor to take struct cs_etm_auxtrace. Reviewed-by:
-
James Clark authored
Branch samples currently use the IP of the previous packet as the from IP, and the IP of the current packet as the to IP. But it incorrectly uses the current thread. In some cases like a jump into a different exception level this will attribute to the incorrect process. Fix it by tracking the previous thread in the same way the previous packet is tracked. Committer notes: Resolved conflicts with: perf addr_location: Add init/exit/copy functions perf thread: Add accessor functions for thread Reviewed-by:
Mike Leach <mike.leach@linaro.org> Signed-off-by:
-
James Clark authored
PIDs and TIDs are already contained within the thread struct, so to avoid inconsistencies drop the extra members on the etm queue and only use the thread struct. At the same time stop using the 'unknown' thread. In a later commit we will be making samples from multiple machines so it will be better to use the idle thread of each machine rather than overlapping unknown threads. Using the idle thread is also better because kernel addresses with a previously unknown thread will now be assigned to a real kernel thread. Committer notes: Resolved conflicts with: perf addr_location: Add init/exit/copy functions perf thread: Add accessor functions for thread perf thread: Remove notion of dead threads That were present in tmp.perf-tools.next only. Reviewed-by:
Suzuki Poulouse <suzuki.poulose@arm.com> Cc: Adrian Hunter <adrian.hunter@intel.com> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Ian Rogers <irogers@google.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: John Garry <john.g.garry@oracle.com> Cc: Mark Rutland <mark.rutland@arm.com> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Suzuki Poulouse <suzuki.poulose@arm.com> Cc: Will Deacon <will@kernel.org> Cc: coresight@lists.linaro.org Cc: linux-arm-kernel@lists.infradead.org Link: http://lore.kernel.org/lkml/20230612111403.100613-2-james.clark@arm.comSigned-off-by:
-
James Clark authored
When quitting after running a 'perf report', the refcount checker finds some double frees. The issue is that map__put() is called on a function argument so it removes the refcount wrapper that someone else was using. Fix it by only calling map__put() on a reference that is owned by this function. Committer notes: Narrowed the map_ref scope as suggested by Ian, removed the symbol-elf part as it was already fixed by another patch, from Ian. Signed-off-by:
-
Arnaldo Carvalho de Melo authored
This is a string constant that gets returned and then strcmp() around, we can instead just do a pointer comparision. That requires a new global variable to comply with these warnings from some versions of clang and gcc: 41 68.95 fedora:rawhide : FAIL clang version 16.0.4 (Fedora 16.0.4-1.fc39) result of comparison against a string literal is unspecified (use an explicit string comparison function instead) [-Werror,-Wstring-compare] if (start_line != SRCLINE_UNKNOWN && ^ ~~~~~~~~~~~~~~~ 41 Ack comments: Agreed, the strcmps make me nervous as they won't distinguish heap from a global meaning we could end up with things like pointers to freed memory. The comparison with the global is always going to be same imo. Acked-by: -
Ian Rogers authored
srcline isn't freed if it is SRCLINE_UNKNOWN. Avoid strduping in this case as such strdups are redundant and leak memory. Signed-off-by:
-
Ian Rogers authored
Make use after free more unlikely. Signed-off-by:
-
Ian Rogers authored
Pthread keys are more portable than __thread and allow the association of a destructor with the key. Use the destructor to clean up TLS callchain cursors to aid understanding memory leaks. Committer notes: Had to fixup a series of unconverted places and also check for the return of get_tls_callchain_cursor() as it may fail and return NULL. In that unlikely case we now either print something to a file, if the caller was expecting to print a callchain, or return an error code to state that resolving the callchain isn't possible. In some cases this was made easier because thread__resolve_callchain() already can fail for other reasons, so this new one (cursor == NULL) can be added and the callers don't have to explicitely check for this new condition. Signed-off-by:
-
Ian Rogers authored
intel-pt tests were failing: -- Test virtual LBR --- Linux [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.126 MB /tmp/perf-test-intel-pt-sh.FW57CXnCqQ/test-perf.data ] Failed with virtual lbr ... ``` The root cause is an out-of-bounds read in header (where maxbrstack.py is from test_intel_pt.sh): ``` $ perf --no-pager script --itrace=L -s maxbrstack.py ================================================================= ==3907930==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x6020000095a8 at pc 0x563c26c840bb bp 0x7fff43582710 sp 0x7fff43582708 READ of size 4 at 0x6020000095a8 thread T0 #0 0x563c26c840ba in process_group_desc util/header.c:2847 #1 0x563c26c8bc78 in perf_file_section__process util/header.c:4037 #2 0x563c26c8aa9b in perf_header__process_sections util/header.c:3813 #3 0x563c26c8d028 in perf_session__read_header util/header.c:4286 #4 0x563c26cbab29 in perf_session__open util/session.c:113 #5 0x563c26cbb3d0 in __perf_session__new util/session.c:221 #6 0x563c26aacb14 in perf_session__new util/session.h:73 #7 0x563c26acf7f1 in cmd_script tools/perf/builtin-script.c:4212 #8 0x563c26bb58ff in run_builtin tools/perf/perf.c:323 #9 0x563c26bb5e70 in handle_internal_command tools/perf/perf.c:377 #10 0x563c26bb6238 in run_argv tools/perf/perf.c:421 #11 0x563c26bb67a0 in main tools/perf/perf.c:537 #12 0x7f34bde46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 #13 0x7f34bde46244 in __libc_start_main_impl ../csu/libc-start.c:381 #14 0x563c26a33390 in _start (/tmp/perf/perf+0x1eb390) 0x6020000095a8 is located 8 bytes to the right of 16-byte region [0x602000009590,0x6020000095a0) allocated by thread T0 here: #0 0x7f34beeb83b7 in __interceptor_calloc ../../../../src/libsanitizer/asan/asan_malloc_linux.cpp:77 #1 0x563c26c83df8 in process_group_desc util/header.c:2824 #2 0x563c26c8bc78 in perf_file_section__process util/header.c:4037 #3 0x563c26c8aa9b in perf_header__process_sections util/header.c:3813 #4 0x563c26c8d028 in perf_session__read_header util/header.c:4286 #5 0x563c26cbab29 in perf_session__open util/session.c:113 #6 0x563c26cbb3d0 in __perf_session__new util/session.c:221 #7 0x563c26aacb14 in perf_session__new util/session.h:73 #8 0x563c26acf7f1 in cmd_script tools/perf/builtin-script.c:4212 #9 0x563c26bb58ff in run_builtin tools/perf/perf.c:323 #10 0x563c26bb5e70 in handle_internal_command tools/perf/perf.c:377 #11 0x563c26bb6238 in run_argv tools/perf/perf.c:421 #12 0x563c26bb67a0 in main tools/perf/perf.c:537 #13 0x7f34bde46189 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58 ``` Avoid the out-of-bounds read checking for the leader. Leave the 'nr' check intact as nr will be 0 or the counting down and evsel be a group member. Signed-off-by: -
Ian Rogers authored
Add exit_process_thread that reverses init_process_thread. This avoids leak sanitizer reporting memory leaks. Signed-off-by:
-
Ian Rogers authored
fileloc is used to hold a previous line, before overwriting it ensure the previous contents is freed. Free the storage once done in symbol__disassemble. Signed-off-by:
-
Ian Rogers authored
Fix missed reference count gets and puts as detected with leak sanitizer and reference count checking. Signed-off-by:
-
Ian Rogers authored
machine__addnew_module_map requires a put on its result. Add this and narrow the scope of map to make the correctness more obvious. This leak was caught with leak sanitizer and the reference count checker. Signed-off-by:
-
Ian Rogers authored
The kernel dso may be found by searching dsos or allocating if not found. The allocation returns with a reference count of 2, once for the dsos list and once for the returned value. The list search has a reference count of 1, once for the dsos list. To make the reference counts consistent, increase the dsos list search reference count to 2 with a dso__get, and do a put when the scope ends for either the allocated or found dso. This issue was found with leak sanitizer and reference count checking. Signed-off-by:
-
Ian Rogers authored
Add a missed free detected by leak sanitizer. Signed-off-by:
-
Ian Rogers authored
If a reference is held, don't put it as this will confuse reference count checking. Signed-off-by:
-
Ian Rogers authored
As reported by leak sanitizer with reference count checking. Signed-off-by:
-
Ian Rogers authored
Leak sanitizer complains about the variable size bf allocation and store to bf if sized 0. Signed-off-by:
-
Ian Rogers authored
There is no evsel free stats, freeing in the evlist__delete ensures memory leaks are avoided. Issues detected with "perf stat report" and leak sanitizer, perf stat uses perf_session__delete to free the evlist. Add dummy symbol for python build. Signed-off-by:
-
Ian Rogers authored
Add missing put and free, detected with leak sanitizer. Signed-off-by:
-
Ian Rogers authored
Free evlist before overwriting in "perf stat report" mode. Detected using leak sanitizer. Signed-off-by:
-
