mirror of
https://github.com/torvalds/linux.git
synced 2026-06-03 12:03:54 +02:00
Currently, the initialization of loongarch_jump_ops does not contain an
assignment to its .free field. This causes disasm_line__free() to fall
through to ins_ops__delete() for LoongArch jump instructions.
ins_ops__delete() will free ins_operands.source.raw and
ins_operands.source.name, and these fields overlaps with
ins_operands.jump.raw_comment and ins_operands.jump.raw_func_start.
Since in loongarch_jump__parse(), these two fields are populated by
strchr()-ing the same buffer, trying to free them will lead to undefined
behavior.
This invalid free usually leads to crashes:
Process 1712902 (perf) of user 1000 dumped core.
Stack trace of thread 1712902:
#0 0x00007fffef155c58 n/a (libc.so.6 + 0x95c58)
#1 0x00007fffef0f7a94 raise (libc.so.6 + 0x37a94)
#2 0x00007fffef0dd6a8 abort (libc.so.6 + 0x1d6a8)
#3 0x00007fffef145490 n/a (libc.so.6 + 0x85490)
#4 0x00007fffef1646f4 n/a (libc.so.6 + 0xa46f4)
#5 0x00007fffef164718 n/a (libc.so.6 + 0xa4718)
#6 0x00005555583a6764 __zfree (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x106764)
#7 0x000055555854fb70 disasm_line__free (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x2afb70)
#8 0x000055555853d618 annotated_source__purge (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x29d618)
#9 0x000055555852300c __hist_entry__tui_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28300c)
#10 0x0000555558526718 do_annotate (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x286718)
#11 0x000055555852ed94 evsel__hists_browse (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x28ed94)
#12 0x000055555831fdd0 cmd_report (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x7fdd0)
#13 0x000055555839b644 handle_internal_command (/home/csmantle/dist/linux-arch/tools/perf/perf + 0xfb644)
#14 0x00005555582fe6ac main (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5e6ac)
#15 0x00007fffef0ddd90 n/a (libc.so.6 + 0x1dd90)
#16 0x00007fffef0ddf0c __libc_start_main (libc.so.6 + 0x1df0c)
#17 0x00005555582fed10 _start (/home/csmantle/dist/linux-arch/tools/perf/perf + 0x5ed10)
ELF object binary architecture: LoongArch
... and it can be confirmed with Valgrind:
==1721834== Invalid free() / delete / delete[] / realloc()
==1721834== at 0x4EA9014: free (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so)
==1721834== by 0x4106287: __zfree (zalloc.c:13)
==1721834== by 0x42ADC8F: disasm_line__free (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x429B737: annotated_source__purge (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x42811EB: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== Address 0x7d34303 is 35 bytes inside a block of size 62 alloc'd
==1721834== at 0x4EA59B8: malloc (in /usr/lib/valgrind/vgpreload_memcheck-loongarch64-linux.so)
==1721834== by 0x6B80B6F: strdup (strdup.c:42)
==1721834== by 0x42AD917: disasm_line__new (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x42AE5A3: symbol__disassemble_objdump (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x42AF0A7: symbol__disassemble (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x429B3CF: symbol__annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x429C233: symbol__annotate2 (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x42804D3: __hist_entry__tui_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x42848D7: do_annotate (in /home/csmantle/dist/linux-arch/tools/perf/perf)
==1721834== by 0x428CF33: evsel__hists_browse (in /home/csmantle/dist/linux-arch/tools/perf/perf)
This patch adds the missing free() specialization in loongarch_jump_ops,
which prevents disasm_line__free() from invoking the default cleanup
function.
Fixes: fb7fd2a14a ("perf annotate: Move raw_comment and raw_func_start fields out of 'struct ins_operands'")
Cc: stable@vger.kernel.org
Cc: WANG Rui <wangrui@loongson.cn>
Cc: Huacai Chen <chenhuacai@kernel.org>
Cc: WANG Xuerui <kernel@xen0n.name>
Cc: loongarch@lists.linux.dev
Signed-off-by: Rong Bao <rong.bao@csmantle.top>
Tested-by: WANG Rui <wangrui@loongson.cn>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
158 lines
3.8 KiB
C
158 lines
3.8 KiB
C
// SPDX-License-Identifier: GPL-2.0
|
|
/*
|
|
* Perf annotate functions.
|
|
*
|
|
* Copyright (C) 2020-2023 Loongson Technology Corporation Limited
|
|
*/
|
|
#include <stdlib.h>
|
|
#include <string.h>
|
|
#include <linux/compiler.h>
|
|
#include <linux/zalloc.h>
|
|
#include "../disasm.h"
|
|
#include "../map.h"
|
|
#include "../maps.h"
|
|
#include "../symbol.h"
|
|
#include "../thread.h"
|
|
|
|
static int loongarch_call__parse(const struct arch *arch, struct ins_operands *ops,
|
|
struct map_symbol *ms,
|
|
struct disasm_line *dl __maybe_unused)
|
|
{
|
|
char *c, *endptr, *tok, *name;
|
|
struct map *map = ms->map;
|
|
struct addr_map_symbol target;
|
|
|
|
c = strchr(ops->raw, '#');
|
|
if (c++ == NULL)
|
|
return -1;
|
|
|
|
ops->target.addr = strtoull(c, &endptr, 16);
|
|
|
|
name = strchr(endptr, '<');
|
|
name++;
|
|
|
|
if (arch->objdump.skip_functions_char &&
|
|
strchr(name, arch->objdump.skip_functions_char))
|
|
return -1;
|
|
|
|
tok = strchr(name, '>');
|
|
if (tok == NULL)
|
|
return -1;
|
|
|
|
*tok = '\0';
|
|
ops->target.name = strdup(name);
|
|
*tok = '>';
|
|
|
|
if (ops->target.name == NULL)
|
|
return -1;
|
|
|
|
target = (struct addr_map_symbol) {
|
|
.ms = { .map = map__get(map), },
|
|
.addr = map__objdump_2mem(map, ops->target.addr),
|
|
};
|
|
|
|
if (maps__find_ams(thread__maps(ms->thread), &target) == 0 &&
|
|
map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
|
|
ops->target.sym = target.ms.sym;
|
|
|
|
addr_map_symbol__exit(&target);
|
|
return 0;
|
|
}
|
|
|
|
static const struct ins_ops loongarch_call_ops = {
|
|
.parse = loongarch_call__parse,
|
|
.scnprintf = call__scnprintf,
|
|
.is_call = true,
|
|
};
|
|
|
|
static int loongarch_jump__parse(const struct arch *arch, struct ins_operands *ops,
|
|
struct map_symbol *ms,
|
|
struct disasm_line *dl __maybe_unused)
|
|
|
|
{
|
|
struct map *map = ms->map;
|
|
struct symbol *sym = ms->sym;
|
|
struct addr_map_symbol target = {
|
|
.ms = { .map = map__get(map), },
|
|
};
|
|
const char *c = strchr(ops->raw, '#');
|
|
u64 start, end;
|
|
|
|
ops->jump.raw_comment = strchr(ops->raw, arch->objdump.comment_char);
|
|
ops->jump.raw_func_start = strchr(ops->raw, '<');
|
|
|
|
if (ops->jump.raw_func_start && c > ops->jump.raw_func_start)
|
|
c = NULL;
|
|
|
|
if (c++ != NULL)
|
|
ops->target.addr = strtoull(c, NULL, 16);
|
|
else
|
|
ops->target.addr = strtoull(ops->raw, NULL, 16);
|
|
|
|
target.addr = map__objdump_2mem(map, ops->target.addr);
|
|
start = map__unmap_ip(map, sym->start);
|
|
end = map__unmap_ip(map, sym->end);
|
|
|
|
ops->target.outside = target.addr < start || target.addr >= end;
|
|
|
|
if (maps__find_ams(thread__maps(ms->thread), &target) == 0 &&
|
|
map__rip_2objdump(target.ms.map, map__map_ip(target.ms.map, target.addr)) == ops->target.addr)
|
|
ops->target.sym = target.ms.sym;
|
|
|
|
if (!ops->target.outside) {
|
|
ops->target.offset = target.addr - start;
|
|
ops->target.offset_avail = true;
|
|
} else {
|
|
ops->target.offset_avail = false;
|
|
}
|
|
addr_map_symbol__exit(&target);
|
|
return 0;
|
|
}
|
|
|
|
static const struct ins_ops loongarch_jump_ops = {
|
|
.free = jump__delete,
|
|
.parse = loongarch_jump__parse,
|
|
.scnprintf = jump__scnprintf,
|
|
.is_jump = true,
|
|
};
|
|
|
|
static
|
|
const struct ins_ops *loongarch__associate_ins_ops(struct arch *arch, const char *name)
|
|
{
|
|
const struct ins_ops *ops = NULL;
|
|
|
|
if (!strcmp(name, "bl"))
|
|
ops = &loongarch_call_ops;
|
|
else if (!strcmp(name, "jirl"))
|
|
ops = &ret_ops;
|
|
else if (!strcmp(name, "b") ||
|
|
!strncmp(name, "beq", 3) ||
|
|
!strncmp(name, "bne", 3) ||
|
|
!strncmp(name, "blt", 3) ||
|
|
!strncmp(name, "bge", 3) ||
|
|
!strncmp(name, "bltu", 4) ||
|
|
!strncmp(name, "bgeu", 4))
|
|
ops = &loongarch_jump_ops;
|
|
else
|
|
return NULL;
|
|
|
|
arch__associate_ins_ops(arch, name, ops);
|
|
|
|
return ops;
|
|
}
|
|
|
|
const struct arch *arch__new_loongarch(const struct e_machine_and_e_flags *id,
|
|
const char *cpuid __maybe_unused)
|
|
{
|
|
struct arch *arch = zalloc(sizeof(*arch));
|
|
|
|
if (!arch)
|
|
return NULL;
|
|
|
|
arch->name = "loongarch";
|
|
arch->id = *id;
|
|
arch->associate_instruction_ops = loongarch__associate_ins_ops;
|
|
arch->objdump.comment_char = '#';
|
|
return arch;
|
|
}
|