# futex contention
# (c) 2010, Arnaldo Carvalho de Melo <acme@redhat.com>
# Licensed under the terms of the GNU GPL License version 2
#
# Translation of:
#
# http://sourceware.org/systemtap/wiki/WSFutexContention
#
# to perf python scripting.
#
# Measures futex contention

import os, sys
sys.path.append(os.environ['PERF_EXEC_PATH'] + '/scripts/python/Perf-Trace-Util/lib/Perf/Trace')
from Util import *

process_names = {}
thread_thislock = {}
thread_blocktime = {}

lock_waits = {} # long-lived stats on (tid,lock) blockage elapsed time
process_names = {} # long-lived pid-to-execname mapping

def syscalls__sys_enter_futex(event, ctxt, cpu, s, ns, tid, comm, callchain,
			      nr, uaddr, op, val, utime, uaddr2, val3):
	cmd = op & FUTEX_CMD_MASK
	if cmd != FUTEX_WAIT:
		return # we don't care about originators of WAKE events

	process_names[tid] = comm
	thread_thislock[tid] = uaddr
	thread_blocktime[tid] = nsecs(s, ns)

def syscalls__sys_exit_futex(event, ctxt, cpu, s, ns, tid, comm, callchain,
			     nr, ret):
	if thread_blocktime.has_key(tid):
		elapsed = nsecs(s, ns) - thread_blocktime[tid]
		add_stats(lock_waits, (tid, thread_thislock[tid]), elapsed)
		del thread_blocktime[tid]
		del thread_thislock[tid]

def trace_begin():
	print "Press control+C to stop and show the summary"

def trace_end():
	for (tid, lock) in lock_waits:
		min, max, avg, count = lock_waits[tid, lock]
		print "%s[%d] lock %x contended %d times, %d avg ns" % \
		      (process_names[tid], tid, lock, count, avg)

a><a href='/cgit.cgi/linux/net-next.git/refs/?id=a810007afe239d59c1115fcaa06eb5b480f876e9'>refs</a><a class='active' href='/cgit.cgi/linux/net-next.git/log/include/scsi/scsi_dbg.h'>log</a><a href='/cgit.cgi/linux/net-next.git/tree/include/scsi/scsi_dbg.h?id=a810007afe239d59c1115fcaa06eb5b480f876e9'>tree</a><a href='/cgit.cgi/linux/net-next.git/commit/include/scsi/scsi_dbg.h?id=a810007afe239d59c1115fcaa06eb5b480f876e9'>commit</a><a href='/cgit.cgi/linux/net-next.git/diff/include/scsi/scsi_dbg.h?id=a810007afe239d59c1115fcaa06eb5b480f876e9'>diff</a></td><td class='form'><form class='right' method='get' action='/cgit.cgi/linux/net-next.git/log/include/scsi/scsi_dbg.h'>
<input type='hidden' name='id' value='a810007afe239d59c1115fcaa06eb5b480f876e9'/><select name='qt'>
<option value='grep'>log msg</option>
<option value='author'>author</option>
<option value='committer'>committer</option>
<option value='range'>range</option>
</select>
<input class='txt' type='search' size='10' name='q' value=''/>
<input type='submit' value='search'/>
</form>
</td></tr></table>
<div class='path'>path: <a href='/cgit.cgi/linux/net-next.git/log/?id=a810007afe239d59c1115fcaa06eb5b480f876e9'>root</a>/<a href='/cgit.cgi/linux/net-next.git/log/include?id=a810007afe239d59c1115fcaa06eb5b480f876e9'>include</a>/<a href='/cgit.cgi/linux/net-next.git/log/include/scsi?id=a810007afe239d59c1115fcaa06eb5b480f876e9'>scsi</a>/<a href='/cgit.cgi/linux/net-next.git/log/include/scsi/scsi_dbg.h?id=a810007afe239d59c1115fcaa06eb5b480f876e9'>scsi_dbg.h</a></div><div class='content'><table class='list nowrap'><tr class='nohover'><th class='left'>Age</th><th class='left'>Commit message (<a href='/cgit.cgi/linux/net-next.git/log/include/scsi/scsi_dbg.h?id=a810007afe239d59c1115fcaa06eb5b480f876e9&amp;showmsg=1'>Expand</a>)</th><th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
th class='left'>Author</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
uthor</th><th class='left'>Files</th><th class='left'>Lines</th></tr>
2'>2</option><option value='3' selected='selected'>3</option><option value='4'>4</option><option value='5'>5</option><option value='6'>6</option><option value='7'>7</option><option value='8'>8</option><option value='9'>9</option><option value='10'>10</option><option value='15'>15</option><option value='20'>20</option><option value='25'>25</option><option value='30'>30</option><option value='35'>35</option><option value='40'>40</option></select></td></tr><tr><td class='label'>space:</td><td class='ctrl'><select name='ignorews' onchange='this.form.submit();'><option value='0' selected='selected'>include</option><option value='1'>ignore</option></select></td></tr><tr><td class='label'>mode:</td><td class='ctrl'><select name='dt' onchange='this.form.submit();'><option value='0' selected='selected'>unified</option><option value='1'>ssdiff</option><option value='2'>stat only</option></select></td></tr><tr><td/><td class='ctrl'><noscript><input type='submit' value='reload'/></noscript></td></tr></table></form></div><table summary='commit info' class='commit-info'>
<tr><th>author</th><td>Peter Zijlstra &lt;peterz@infradead.org&gt;</td><td class='right'>2017-01-26 16:39:55 +0100</td></tr>
<tr><th>committer</th><td>Ingo Molnar &lt;mingo@kernel.org&gt;</td><td class='right'>2017-01-30 11:41:25 +0100</td></tr>
<tr><th>commit</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/tools/perf/arch/common.c?id=a76a82a3e38c8d3fb6499e3dfaeb0949241ab588'>a76a82a3e38c8d3fb6499e3dfaeb0949241ab588</a> (<a href='/cgit.cgi/linux/net-next.git/patch/tools/perf/arch/common.c?id=a76a82a3e38c8d3fb6499e3dfaeb0949241ab588'>patch</a>)</td></tr>
<tr><th>tree</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/tree/?id=a76a82a3e38c8d3fb6499e3dfaeb0949241ab588'>b5bc906278fe1ac66d75de984d26bf59b43b3ed8</a> /<a href='/cgit.cgi/linux/net-next.git/tree/tools/perf/arch/common.c?id=a76a82a3e38c8d3fb6499e3dfaeb0949241ab588'>tools/perf/arch/common.c</a></td></tr>
<tr><th>parent</th><td colspan='2' class='oid'><a href='/cgit.cgi/linux/net-next.git/commit/tools/perf/arch/common.c?id=566cf877a1fcb6d6dc0126b076aad062054c2637'>566cf877a1fcb6d6dc0126b076aad062054c2637</a> (<a href='/cgit.cgi/linux/net-next.git/diff/tools/perf/arch/common.c?id=a76a82a3e38c8d3fb6499e3dfaeb0949241ab588&amp;id2=566cf877a1fcb6d6dc0126b076aad062054c2637'>diff</a>)</td></tr></table>
<div class='commit-subject'>perf/core: Fix use-after-free bug</div><div class='commit-msg'>Dmitry reported a KASAN use-after-free on event-&gt;group_leader.

It turns out there's a hole in perf_remove_from_context() due to
event_function_call() not calling its function when the task
associated with the event is already dead.

In this case the event will have been detached from the task, but the
grouping will have been retained, such that group operations might
still work properly while there are live child events etc.

This does however mean that we can miss a perf_group_detach() call
when the group decomposes, this in turn can then lead to
use-after-free.

Fix it by explicitly doing the group detach if its still required.

Reported-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Tested-by: Dmitry Vyukov &lt;dvyukov@google.com&gt;
Signed-off-by: Peter Zijlstra (Intel) &lt;peterz@infradead.org&gt;
Cc: Alexander Shishkin &lt;alexander.shishkin@linux.intel.com&gt;
Cc: Arnaldo Carvalho de Melo &lt;acme@kernel.org&gt;
Cc: Arnaldo Carvalho de Melo &lt;acme@redhat.com&gt;
Cc: Jiri Olsa &lt;jolsa@redhat.com&gt;
Cc: Linus Torvalds &lt;torvalds@linux-foundation.org&gt;
Cc: Mathieu Desnoyers &lt;mathieu.desnoyers@efficios.com&gt;
Cc: Peter Zijlstra &lt;peterz@infradead.org&gt;
Cc: Thomas Gleixner &lt;tglx@linutronix.de&gt;
Cc: stable@vger.kernel.org # v4.5+
Cc: syzkaller &lt;syzkaller@googlegroups.com&gt;
Fixes: 63b6da39bb38 ("perf: Fix perf_event_exit_task() race")
Link: http://lkml.kernel.org/r/20170126153955.GD6515@twins.programming.kicks-ass.net
Signed-off-by: Ingo Molnar &lt;mingo@kernel.org&gt;
</div><div class='diffstat-header'><a href='/cgit.cgi/linux/net-next.git/diff/?id=a76a82a3e38c8d3fb6499e3dfaeb0949241ab588'>Diffstat</a> (limited to 'tools/perf/arch/common.c')</div><table summary='diffstat' class='diffstat'>