github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf annotate-x86: Delete stale stack state on store of untracked register

Browse Source 
When a register without a tracked type is stored to a stack slot that
previously held a valid type, the code currently performs an early return.
This leaves the old type information intact in the stack state.

As a result, a stale type bug occurs:
1. A tracked register is stored into a stack slot.
2. The register becomes untracked/invalid (e.g., across a function call).
3. The now-untracked register is stored into the same stack slot.
4. Subsequent loads from that slot erroneously pick up the old stale type
   because the stack entry was never invalidated.

Fix this by introducing delete_stack_state() to search and free a stack
entry for a given offset. When storing an untracked or invalid source
register into a stack location, call delete_stack_state() to delete the
stale entry before returning.

Reviewed-by: Ian Rogers <irogers@google.com>
Reviewed-by: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Tengda Wu <wutengda@huaweicloud.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Tengda Wu 2026-10-20 13:45:05 +00:00 committed by Arnaldo Carvalho de Melo
parent f6455a6e20
commit aa2cd2e19c
3 changed files with 24 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
tools/perf/util/annotate-arch/annotate-x86.c
View File

@ -753,15 +753,24 @@ static void update_insn_state_x86(struct type_state *state,
}
/* Case 3. register to memory transfers */
if (!src->mem_ref && dst->mem_ref) {
if (!has_reg_type(state, src->reg1) ||
!state->regs[src->reg1].ok)
return;
/* Check stack variables with offset */
if (dst->reg1 == fbreg || dst->reg1 == state->stack_reg) {
struct type_state_stack *stack;
int offset = dst->offset - fboff;
if (!has_reg_type(state, src->reg1) ||
!state->regs[src->reg1].ok) {
stack = find_stack_state(state, offset);
/*
* Preserve compound states when only a member
* is overwritten.
*/
if (stack && !stack->compound)
delete_stack_state(state, offset);
return;
}
tsr = &state->regs[src->reg1];
stack = find_stack_state(state, offset);

10
tools/perf/util/annotate-data.c
View File

@ -761,6 +761,16 @@ struct type_state_stack *findnew_stack_state(struct type_state *state,
return stack;
}
void delete_stack_state(struct type_state *state, int offset)
{
struct type_state_stack *stack = find_stack_state(state, offset);
if (stack) {
list_del(&stack->list);
free(stack);
}
}
void invalidate_reg_state(struct type_state_reg *reg)
{
reg->kind = TSR_KIND_INVALID;

1
tools/perf/util/annotate-data.h
View File

@ -268,6 +268,7 @@ void set_stack_state(struct type_state_stack *stack, int offset, u8 kind,
Dwarf_Die *type_die, int ptr_offset, u64 imm_value);
struct type_state_stack *find_stack_state(struct type_state *state,
int offset);
void delete_stack_state(struct type_state *state, int offset);
void invalidate_reg_state(struct type_state_reg *reg);
bool get_global_var_type(Dwarf_Die *cu_die, struct data_loc_info *dloc,
u64 ip, u64 var_addr, int *var_offset,