linux/tools/perf/ui
Dario Petrillo d5962fb7d6 perf annotate: Avoid TUI crash when navigating in the annotation of recursive functions
In 'perf report', entering a recursive function from inside of itself
(either directly of indirectly through some other function) results in
calling symbol__annotate2 multiple() times, and freeing the whole
disassembly when exiting from the innermost instance.

The first issue causes the function's disassembly to be duplicated, and
the latter a heap use-after-free (and crash) when trying to access the
disassembly again.

I reproduced the bug on perf 5.11.22 (Ubuntu 20.04.3 LTS) and 5.16.rc8
with the following testcase (compile with gcc recursive.c -o recursive).
To reproduce:

- perf record ./recursive
- perf report
- enter fibonacci and annotate it
- move the cursor on one of the "callq fibonacci" instructions and press enter
  - at this point there will be two copies of the function in the disassembly
- go back by pressing q, and perf will crash

  #include <stdio.h>

  int fibonacci(int n)
  {
      if(n <= 2) return 1;
      return fibonacci(n-1) + fibonacci(n-2);
  }

  int main()
  {
      printf("%d\n", fibonacci(40));
  }

This patch addresses the issue by annotating a function and freeing the
associated memory on exit only if no annotation is already present, so
that a recursive function is only annotated on entry.

Signed-off-by: Dario Petrillo <dario.pk1@gmail.com>
Tested-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: stable@kernel.org
Link: http://lore.kernel.org/lkml/20220109234441.325106-1-dario.pk1@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
2022-01-10 15:47:30 -03:00
..
browsers perf annotate: Avoid TUI crash when navigating in the annotation of recursive functions 2022-01-10 15:47:30 -03:00
gtk perf annotate: Re-add annotate_warned functionality 2021-08-03 17:04:04 -03:00
stdio perf report: Print percentage of each event statistics 2021-04-29 10:30:59 -03:00
tui perf top: Fix TUI exit screen refresh race condition 2022-01-02 11:46:44 -03:00
browser.c perf annotate: Fix fused instr logic for assembly functions 2021-09-18 17:43:05 -03:00
browser.h perf annotate: Fix fused instr logic for assembly functions 2021-09-18 17:43:05 -03:00
Build perf tools: Rename build libperf to perf 2019-02-14 15:18:08 -03:00
helpline.c perf tools: Remove util.h from where it is not needed 2019-09-20 09:19:20 -03:00
helpline.h perf tools: Remove needless evlist.h include directives 2019-08-31 22:24:10 -03:00
hist.c perf hist: Fix memory leak of a perf_hpp_fmt 2021-11-18 10:16:56 -03:00
keysyms.h perf report: Support a new key to reload the browser 2020-03-24 09:37:27 -03:00
libslang.h perf build: Handle slang being in /usr/include and in /usr/include/slang/ 2019-06-18 17:48:12 -03:00
progress.c perf tools: Remove needless evlist.h include directives 2019-08-31 22:24:10 -03:00
progress.h Merge branch 'linus' into perf/core, to fix conflicts 2017-11-07 10:30:18 +01:00
setup.c perf tools: Remove util.h from where it is not needed 2019-09-20 09:19:20 -03:00
ui.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
util.c perf debug: Remove needless include directives from debug.h 2019-08-31 19:10:19 -03:00
util.h tools ui popup: Allow returning hotkeys 2020-01-06 11:46:10 -03:00