Messages in this thread |  | | Date | Mon, 11 Jul 2022 21:11:39 +0530 | From | "Naveen N. Rao" <> | Subject | Re: [PATCH v2] perf trace: Fix SIGSEGV when processing syscall args |
| |
Hi Namhyung,
Namhyung Kim wrote: > Hello, > > On Thu, Jul 7, 2022 at 2:09 AM Naveen N. Rao > <naveen.n.rao@linux.vnet.ibm.com> wrote: >> >> On powerpc, 'perf trace' is crashing with a SIGSEGV when trying to >> process a perf.data file created with 'perf trace record -p': >> >> #0 0x00000001225b8988 in syscall_arg__scnprintf_augmented_string <snip> at builtin-trace.c:1492 >> #1 syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1492 >> #2 syscall_arg__scnprintf_filename <snip> at builtin-trace.c:1486 >> #3 0x00000001225bdd9c in syscall_arg_fmt__scnprintf_val <snip> at builtin-trace.c:1973 >> #4 syscall__scnprintf_args <snip> at builtin-trace.c:2041 >> #5 0x00000001225bff04 in trace__sys_enter <snip> at builtin-trace.c:2319 >> >> That points to the below code in tools/perf/builtin-trace.c: >> /* >> * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible >> * arguments, even if the syscall being handled, say "openat", uses only 4 arguments >> * this breaks syscall__augmented_args() check for augmented args, as we calculate >> * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file, >> * so when handling, say the openat syscall, we end up getting 6 args for the >> * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly >> * thinking that the extra 2 u64 args are the augmented filename, so just check >> * here and avoid using augmented syscalls when the evsel is the raw_syscalls one. >> */ >> if (evsel != trace->syscalls.events.sys_enter) >> augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size); >> >> As the comment points out, we should not be trying to augment the args >> for raw_syscalls. However, when processing a perf.data file, we are not >> initializing those properly. Fix the same. >> >> Reported-by: Claudio Carvalho <cclaudio@linux.ibm.com> >> Signed-off-by: Naveen N. Rao <naveen.n.rao@linux.vnet.ibm.com> >> --- >> tools/perf/builtin-trace.c | 2 ++ >> 1 file changed, 2 insertions(+) >> >> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c >> index 897fc504918b91..f075cf37a65ef8 100644 >> --- a/tools/perf/builtin-trace.c >> +++ b/tools/perf/builtin-trace.c >> @@ -4280,6 +4280,7 @@ static int trace__replay(struct trace *trace) >> goto out; >> >> evsel = evlist__find_tracepoint_by_name(session->evlist, "raw_syscalls:sys_enter"); >> + trace->syscalls.events.sys_enter = evsel; >> /* older kernels have syscalls tp versus raw_syscalls */ > > Isn't it better to set it after the NULL check below?
From trace__sys_enter(): /* * If this is raw_syscalls.sys_enter, then it always comes with the 6 possible * arguments, even if the syscall being handled, say "openat", uses only 4 arguments * this breaks syscall__augmented_args() check for augmented args, as we calculate * syscall->args_size using each syscalls:sys_enter_NAME tracefs format file, * so when handling, say the openat syscall, we end up getting 6 args for the * raw_syscalls:sys_enter event, when we expected just 4, we end up mistakenly * thinking that the extra 2 u64 args are the augmented filename, so just check * here and avoid using augmented syscalls when the evsel is the raw_syscalls one. */ if (evsel != trace->syscalls.events.sys_enter) augmented_args = syscall__augmented_args(sc, sample, &augmented_args_size, trace->raw_augmented_syscalls_args_size);
From the previous discussion [1], it looks like the assumption above is that sys_enter would be set to raw_syscalls.
As such, I set it before the NULL check below, which ends up falling back to the non-raw syscalls tracepoint.
Thanks, Naveen
[1] https://lore.kernel.org/all/YjDSRb1wwswKpJNJ@kernel.org/
|  |