Patch "perf record: Delete session after stopping sideband thread" has been added to the 6.6-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    perf record: Delete session after stopping sideband thread

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     perf-record-delete-session-after-stopping-sideband-t.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit d313e8e6b6b0467ae2a2e861c47bad3d2e927d26
Author: Ian Rogers <irogers@xxxxxxxxxx>
Date:   Thu Feb 29 23:46:36 2024 -0800

    perf record: Delete session after stopping sideband thread
    
    [ Upstream commit 88ce0106a1f603bf360cb397e8fe293f8298fabb ]
    
    The session has a header in it which contains a perf env with
    bpf_progs. The bpf_progs are accessed by the sideband thread and so
    the sideband thread must be stopped before the session is deleted, to
    avoid a use after free.  This error was detected by AddressSanitizer
    in the following:
    
      ==2054673==ERROR: AddressSanitizer: heap-use-after-free on address 0x61d000161e00 at pc 0x55769289de54 bp 0x7f9df36d4ab0 sp 0x7f9df36d4aa8
      READ of size 8 at 0x61d000161e00 thread T1
          #0 0x55769289de53 in __perf_env__insert_bpf_prog_info util/env.c:42
          #1 0x55769289dbb1 in perf_env__insert_bpf_prog_info util/env.c:29
          #2 0x557692bbae29 in perf_env__add_bpf_info util/bpf-event.c:483
          #3 0x557692bbb01a in bpf_event__sb_cb util/bpf-event.c:512
          #4 0x5576928b75f4 in perf_evlist__poll_thread util/sideband_evlist.c:68
          #5 0x7f9df96a63eb in start_thread nptl/pthread_create.c:444
          #6 0x7f9df9726a4b in clone3 ../sysdeps/unix/sysv/linux/x86_64/clone3.S:81
    
      0x61d000161e00 is located 384 bytes inside of 2136-byte region [0x61d000161c80,0x61d0001624d8)
      freed by thread T0 here:
          #0 0x7f9dfa6d7288 in __interceptor_free libsanitizer/asan/asan_malloc_linux.cpp:52
          #1 0x557692978d50 in perf_session__delete util/session.c:319
          #2 0x557692673959 in __cmd_record tools/perf/builtin-record.c:2884
          #3 0x55769267a9f0 in cmd_record tools/perf/builtin-record.c:4259
          #4 0x55769286710c in run_builtin tools/perf/perf.c:349
          #5 0x557692867678 in handle_internal_command tools/perf/perf.c:402
          #6 0x557692867a40 in run_argv tools/perf/perf.c:446
          #7 0x557692867fae in main tools/perf/perf.c:562
          #8 0x7f9df96456c9 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
    
    Fixes: 657ee5531903339b ("perf evlist: Introduce side band thread")
    Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
    Cc: Adrian Hunter <adrian.hunter@xxxxxxxxx>
    Cc: Alexander Shishkin <alexander.shishkin@xxxxxxxxxxxxxxx>
    Cc: Athira Rajeev <atrajeev@xxxxxxxxxxxxxxxxxx>
    Cc: Christian Brauner <brauner@xxxxxxxxxx>
    Cc: Disha Goel <disgoel@xxxxxxxxxxxxx>
    Cc: Ingo Molnar <mingo@xxxxxxxxxx>
    Cc: James Clark <james.clark@xxxxxxx>
    Cc: Jiri Olsa <jolsa@xxxxxxxxxx>
    Cc: Kajol Jain <kjain@xxxxxxxxxxxxx>
    Cc: Kan Liang <kan.liang@xxxxxxxxxxxxxxx>
    Cc: K Prateek Nayak <kprateek.nayak@xxxxxxx>
    Cc: Mark Rutland <mark.rutland@xxxxxxx>
    Cc: Namhyung Kim <namhyung@xxxxxxxxxx>
    Cc: Peter Zijlstra <peterz@xxxxxxxxxxxxx>
    Cc: Song Liu <songliubraving@xxxxxx>
    Cc: Tim Chen <tim.c.chen@xxxxxxxxxxxxxxx>
    Cc: Yicong Yang <yangyicong@xxxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240301074639.2260708-1-irogers@xxxxxxxxxx
    Signed-off-by: Arnaldo Carvalho de Melo <acme@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index c40460e936ccd..ea80bf4dc4343 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -2822,10 +2822,10 @@ static int __cmd_record(struct record *rec, int argc, const char **argv)
 	}
 #endif
 	zstd_fini(&session->zstd_data);
-	perf_session__delete(session);
-
 	if (!opts->no_bpf_event)
 		evlist__stop_sb_thread(rec->sb_evlist);
+
+	perf_session__delete(session);
 	return status;
 }
 




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux