Patch "perf db-export: Fix missing reference count get in call_path_from_sample()" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    perf db-export: Fix missing reference count get in call_path_from_sample()

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     perf-db-export-fix-missing-reference-count-get-in-ca.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 69949416bf66e9aa01e2233e79341d2a0050af11
Author: Ben Gainey <ben.gainey@xxxxxxx>
Date:   Thu Dec 7 14:09:11 2023 +0000

    perf db-export: Fix missing reference count get in call_path_from_sample()
    
    [ Upstream commit 1e24ce402c97dc3c0ab050593f1d5f6fde524564 ]
    
    The addr_location map and maps fields in the inner loop were missing
    calls to map__get()/maps__get(). The subsequent addr_location__exit()
    call in each loop puts the map/maps fields causing use-after-free
    aborts.
    
    This issue reproduces on at least arm64 and x86_64 with something
    simple like `perf record -g ls` followed by `perf script -s script.py`
    with the following script:
    
        perf_db_export_mode = True
        perf_db_export_calls = False
        perf_db_export_callchains = True
    
        def sample_table(*args):
            print(f'sample_table({args})')
    
        def call_path_table(*args):
            print(f'call_path_table({args}')
    
    Committer testing:
    
    This test, just introduced by Ian Rogers, now passes, not segfaulting
    anymore:
    
      # perf test "perf script tests"
       95: perf script tests                                               : Ok
      #
    
    Fixes: 0dd5041c9a0eaf8c ("perf addr_location: Add init/exit/copy functions")
    Signed-off-by: Ben Gainey <ben.gainey@xxxxxxx>
    Tested-by: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
    Tested-by: Ian Rogers <irogers@xxxxxxxxxx>
    Cc: Adrian Hunter <adrian.hunter@xxxxxxxxx>
    Cc: Alexander Shishkin <alexander.shishkin@xxxxxxxxxxxxxxx>
    Cc: Ingo Molnar <mingo@xxxxxxxxxx>
    Cc: Jiri Olsa <jolsa@xxxxxxxxxx>
    Cc: Mark Rutland <mark.rutland@xxxxxxx>
    Cc: Namhyung Kim <namhyung@xxxxxxxxxx>
    Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20231207140911.3240408-1-ben.gainey@xxxxxxx
    Signed-off-by: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/tools/perf/util/db-export.c b/tools/perf/util/db-export.c
index b9fb71ab7a73..106429155c2e 100644
--- a/tools/perf/util/db-export.c
+++ b/tools/perf/util/db-export.c
@@ -253,8 +253,8 @@ static struct call_path *call_path_from_sample(struct db_export *dbe,
 		 */
 		addr_location__init(&al);
 		al.sym = node->ms.sym;
-		al.map = node->ms.map;
-		al.maps = thread__maps(thread);
+		al.map = map__get(node->ms.map);
+		al.maps = maps__get(thread__maps(thread));
 		al.addr = node->ip;
 
 		if (al.map && !al.sym)