From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753604AbbFRIR6 (ORCPT ); Thu, 18 Jun 2015 04:17:58 -0400 Received: from terminus.zytor.com ([198.137.202.10]:57267 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932276AbbFRIRh (ORCPT ); Thu, 18 Jun 2015 04:17:37 -0400 Date: Thu, 18 Jun 2015 01:17:21 -0700 From: tip-bot for Sukadev Bhattiprolu Message-ID: Cc: linux-kernel@vger.kernel.org, zhlcindy@linux.vnet.ibm.com, tglx@linutronix.de, jolsa@redhat.com, sukadev@linux.vnet.ibm.com, hpa@zytor.com, acme@redhat.com, mingo@kernel.org Reply-To: acme@redhat.com, hpa@zytor.com, mingo@kernel.org, tglx@linutronix.de, sukadev@linux.vnet.ibm.com, jolsa@redhat.com, zhlcindy@linux.vnet.ibm.com, linux-kernel@vger.kernel.org In-Reply-To: <20150612060003.GA19913@us.ibm.com> References: <20150612060003.GA19913@us.ibm.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:perf/core] perf trace: Fix race condition at the end of started workloads Git-Commit-ID: 7951722da2963cc1f1a7831a37aa2311ac927056 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 7951722da2963cc1f1a7831a37aa2311ac927056 Gitweb: http://git.kernel.org/tip/7951722da2963cc1f1a7831a37aa2311ac927056 Author: Sukadev Bhattiprolu AuthorDate: Fri, 12 Jun 2015 01:28:36 -0400 Committer: Arnaldo Carvalho de Melo CommitDate: Wed, 17 Jun 2015 16:38:48 -0300 perf trace: Fix race condition at the end of started workloads I get following crash on multiple systems and across several releases (at least since v3.18). Core was generated by `/tmp/perf trace sleep 0.2 '. Program terminated with signal SIGSEGV, Segmentation fault. #0 perf_mmap__read_head (mm=0x3fff9bf30070) at util/evlist.h:195 195 u64 head = ACCESS_ONCE(pc->data_head); (gdb) bt #0 perf_mmap__read_head (mm=0x3fff9bf30070) at util/evlist.h:195 #1 perf_evlist__mmap_read (evlist=0x10027f11910, idx=) at util/evlist.c:637 #2 0x000000001003ce4c in trace__run (argv=, argc=, trace=0x3fffd7b28288) at builtin-trace.c:2259 #3 cmd_trace (argc=, argv=, prefix=) at builtin-trace.c:2799 #4 0x00000000100657b8 in run_builtin (p=0x10176798 , argc=3, argv=0x3fffd7b2b550) at perf.c:370 #5 0x00000000100063e8 in handle_internal_command (argv=0x3fffd7b2b550, argc=3) at perf.c:429 #6 run_argv (argv=0x3fffd7b2af70, argcp=0x3fffd7b2af7c) at perf.c:473 #7 main (argc=3, argv=0x3fffd7b2b550) at perf.c:588 The problem seems to be a race condition, when the application has just exited. Some/all fds associated with the perf-events (tracepoints) go into a POLLHUP/ POLLERR state and the mmap region associated with those events are unmapped (in perf_evlist__filter_pollfd()). But we go back and do a perf_evlist__mmap_read() which assumes that the mmaps are still valid and we hit the crash. If the mapping for an event is released, its refcnt is 0 (and ->base is NULL), so ensure we have non-zero refcount before accessing the map. Note that perf-record has a similar logic but unlike perf-trace, the record__mmap_read_all() checks the evlist->mmap[i].base before accessing the map. Signed-off-by: Sukadev Bhattiprolu Cc: Jiri Olsa Cc: Li Zhang Link: http://lkml.kernel.org/r/20150612060003.GA19913@us.ibm.com [ Fixed it up to use atomic_read() ] Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/evlist.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c index dc1dc2c..6b58a47 100644 --- a/tools/perf/util/evlist.c +++ b/tools/perf/util/evlist.c @@ -634,11 +634,18 @@ static struct perf_evsel *perf_evlist__event2evsel(struct perf_evlist *evlist, union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx) { struct perf_mmap *md = &evlist->mmap[idx]; - u64 head = perf_mmap__read_head(md); + u64 head; u64 old = md->prev; unsigned char *data = md->base + page_size; union perf_event *event = NULL; + /* + * Check if event was unmapped due to a POLLHUP/POLLERR. + */ + if (!atomic_read(&md->refcnt)) + return NULL; + + head = perf_mmap__read_head(md); if (evlist->overwrite) { /* * If we're further behind than half the buffer, there's a chance