Do not sort the task scan result from /proc when synthesizing perf events

Bug #2008971 reported by Chengen Du
8
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux (Ubuntu)
In Progress
Undecided
Chengen Du
Jammy
Fix Released
Medium
Chengen Du

Bug Description

[Impact]
The perf tool use scandir() to iterate threads and sort in alphabetical order when synthesizing PERF_RECORD_ events.
If the process ID is 9999 and it has one thread (tid = 10000), the thread will be processed before the process.
It results in PERF_RECORD_FORK events that come before PERF_RECORD_MMAP2 events.
The callstack will have missing symbols for threads where `PERF_RECORD_FORK` events are processed before the `PERF_RECORD_MMAP2` event for the corresponding process.

[Fix]
Do not use alphasort when calling scandir()

363afa3aef24f5e08df6a539f5dc3aae4cddcc1a (perf synthetic-events: Don't sort the task scan result from /proc)

[Test Plan]
<test.lua>
function update_last_pid()
  local file <close> = io.open("/proc/sys/kernel/ns_last_pid", "w")
  file:write(9997)
end

update_last_pid()
os.execute("~/reproducer")

<reproducer.cpp>
#include <iostream>
#include <thread>
#include <unistd.h>

constexpr int kThreadNum = 10;

void thread_job() { sleep(30); }

int main(void) {
  std::thread threads[kThreadNum];

  std::cout << "Parent process with pid " << getpid() << std::endl;

  for (int i = 0; i < kThreadNum; ++i) {
    threads[i] = std::thread(thread_job);
  }

  for (int i = 0; i < kThreadNum; ++i) {
    threads[i].join();
  }

  std::cout << "All threads have finished" << std::endl;
  return 0;
}

The flow is to set /proc/sys/kernel/ns_last_pid first, which represents the last pid allocated in the current pid namespace.
The script (test.lua) sets ns_last_pid to 9997 and executes the reproducer (reproducer.cpp).
After the reproducer creates ten threads, we execute the perf command as follows: perf record -F 49 -e cpu-clock -a -g sleep 20.
Here is the result of command: perf report -f --tasks --mmaps -D | egrep -i 'perf_record_fork|perf_record_mmap' | grep 9999

Before applying the patch, the output of the perf command was as follows:
0 0 0x34910 [0x40]: PERF_RECORD_FORK(9999:10000):(9999:9999)
0 0 0x34990 [0x40]: PERF_RECORD_FORK(9999:10001):(9999:9999)
0 0 0x34a10 [0x40]: PERF_RECORD_FORK(9999:10002):(9999:9999)
0 0 0x34a90 [0x40]: PERF_RECORD_FORK(9999:10003):(9999:9999)
0 0 0x34b10 [0x40]: PERF_RECORD_FORK(9999:10004):(9999:9999)
0 0 0x34b90 [0x40]: PERF_RECORD_FORK(9999:10005):(9999:9999)
0 0 0x34c10 [0x40]: PERF_RECORD_FORK(9999:10006):(9999:9999)
0 0 0x34c90 [0x40]: PERF_RECORD_FORK(9999:10007):(9999:9999)
0 0 0x34d10 [0x40]: PERF_RECORD_FORK(9999:10008):(9999:9999)
0 0 0x34d90 [0x40]: PERF_RECORD_FORK(9999:10009):(9999:9999)
0 0 0x34e10 [0x40]: PERF_RECORD_FORK(9999:9999):(9998:9998)
0 0 0x34e90 [0x80]: PERF_RECORD_MMAP2 9999/9999: [0x555de0159000(0x1000) @ 0x1000 fd:00 2097758 0]: r-xp /root/reproducer
0 0 0x34f10 [0x90]: PERF_RECORD_MMAP2 9999/9999: [0x7f9cd17f8000(0x7c000) @ 0xe000 fd:00 1055098 0]: r-xp /usr/lib/x86_64-linux-gnu/libm.so.6
0 0 0x34fa0 [0x90]: PERF_RECORD_MMAP2 9999/9999: [0x7f9cd18f9000(0x195000) @ 0x28000 fd:00 1054988 0]: r-xp /usr/lib/x86_64-linux-gnu/libc.so.6
0 0 0x35030 [0x90]: PERF_RECORD_MMAP2 9999/9999: [0x7f9cd1afc000(0x17000) @ 0x3000 fd:00 1054745 0]: r-xp /usr/lib/x86_64-linux-gnu/libgcc_s.so.1
0 0 0x350c0 [0x98]: PERF_RECORD_MMAP2 9999/9999: [0x7f9cd1bb3000(0x110000) @ 0x9a000 fd:00 1068050 0]: r-xp /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30
0 0 0x35158 [0x98]: PERF_RECORD_MMAP2 9999/9999: [0x7f9cd1d4e000(0x2a000) @ 0x2000 fd:00 1054949 0]: r-xp /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
0 0 0x351f0 [0x70]: PERF_RECORD_MMAP2 9999/9999: [0x7ffc983bb000(0x2000) @ 0 00:00 0 0]: r-xp [vdso]
0 0 0x35260 [0x78]: PERF_RECORD_MMAP2 9999/9999: [0xffffffffff600000(0x1000) @ 0 00:00 0 0]: --xp [vsyscall]

After applying the patch, the output of the perf command is as follows:
0 0 0x30c28 [0x40]: PERF_RECORD_FORK(9999:9999):(9998:9998)
0 0 0x30ca8 [0x80]: PERF_RECORD_MMAP2 9999/9999: [0x5642c7635000(0x1000) @ 0x1000 fd:00 2097758 0]: r-xp /root/reproducer
0 0 0x30d28 [0x90]: PERF_RECORD_MMAP2 9999/9999: [0x7f8ada03d000(0x7c000) @ 0xe000 fd:00 1055098 0]: r-xp /usr/lib/x86_64-linux-gnu/libm.so.6
0 0 0x30db8 [0x90]: PERF_RECORD_MMAP2 9999/9999: [0x7f8ada13e000(0x195000) @ 0x28000 fd:00 1054988 0]: r-xp /usr/lib/x86_64-linux-gnu/libc.so.6
0 0 0x30e48 [0x90]: PERF_RECORD_MMAP2 9999/9999: [0x7f8ada341000(0x17000) @ 0x3000 fd:00 1054745 0]: r-xp /usr/lib/x86_64-linux-gnu/libgcc_s.so.1
0 0 0x30ed8 [0x98]: PERF_RECORD_MMAP2 9999/9999: [0x7f8ada3f8000(0x110000) @ 0x9a000 fd:00 1068050 0]: r-xp /usr/lib/x86_64-linux-gnu/libstdc++.so.6.0.30
0 0 0x30f70 [0x98]: PERF_RECORD_MMAP2 9999/9999: [0x7f8ada593000(0x2a000) @ 0x2000 fd:00 1054949 0]: r-xp /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
0 0 0x31008 [0x70]: PERF_RECORD_MMAP2 9999/9999: [0x7ffcb2116000(0x2000) @ 0 00:00 0 0]: r-xp [vdso]
0 0 0x31078 [0x78]: PERF_RECORD_MMAP2 9999/9999: [0xffffffffff600000(0x1000) @ 0 00:00 0 0]: --xp [vsyscall]
0 0 0x310f0 [0x40]: PERF_RECORD_FORK(9999:10000):(9999:9999)
0 0 0x31170 [0x40]: PERF_RECORD_FORK(9999:10001):(9999:9999)
0 0 0x311f0 [0x40]: PERF_RECORD_FORK(9999:10002):(9999:9999)
0 0 0x31270 [0x40]: PERF_RECORD_FORK(9999:10003):(9999:9999)
0 0 0x312f0 [0x40]: PERF_RECORD_FORK(9999:10004):(9999:9999)
0 0 0x31370 [0x40]: PERF_RECORD_FORK(9999:10005):(9999:9999)
0 0 0x313f0 [0x40]: PERF_RECORD_FORK(9999:10006):(9999:9999)
0 0 0x31470 [0x40]: PERF_RECORD_FORK(9999:10007):(9999:9999)
0 0 0x314f0 [0x40]: PERF_RECORD_FORK(9999:10008):(9999:9999)
0 0 0x31570 [0x40]: PERF_RECORD_FORK(9999:10009):(9999:9999)

[Where problems could occur]
The fix will apply upstream commits, so the regression can be considered as low.

CVE References

Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote : Missing required logs.

This bug is missing log files that will aid in diagnosing the problem. While running an Ubuntu kernel (not a mainline or third-party kernel) please enter the following command in a terminal window:

apport-collect 2008971

and then change the status of the bug to 'Confirmed'.

If, due to the nature of the issue you have encountered, you are unable to run this command, please add a comment stating that fact and change the bug status to 'Confirmed'.

This change has been made by an automated script, maintained by the Ubuntu Kernel Team.

Changed in linux (Ubuntu):
status: New → Incomplete
Chengen Du (chengendu)
Changed in linux (Ubuntu):
assignee: nobody → ChengEn, Du (chengendu)
Changed in linux (Ubuntu Jammy):
assignee: nobody → ChengEn, Du (chengendu)
Changed in linux (Ubuntu):
status: Incomplete → In Progress
Changed in linux (Ubuntu Jammy):
status: New → In Progress
Stefan Bader (smb)
Changed in linux (Ubuntu Jammy):
importance: Undecided → Medium
status: In Progress → Fix Committed
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux/5.15.0-70.77 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-jammy-linux verification-needed-jammy
Revision history for this message
Chengen Du (chengendu) wrote :

Tested using the same test plan by linux/5.15.0-70.77 and confirmed that the issue has been resolved.

tags: added: verification-done-jammy
removed: verification-needed-jammy
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (29.9 KiB)

This bug was fixed in the package linux - 5.15.0-70.77

---------------
linux (5.15.0-70.77) jammy; urgency=medium

  * jammy/linux: 5.15.0-70.77 -proposed tracker (LP: #2011918)

  * CVE-2023-26545
    - net: mpls: fix stale pointer if allocation fails during device rename

  * CVE-2023-1281
    - net/sched: tcindex: update imperfect hash filters respecting rcu

  * [SRU][Ubuntu 22.04.1] mpi3mr: Add management application interface(BSG)
    support (LP: #1971151)
    - scsi: mpi3mr: Add bsg device support
    - scsi: mpi3mr: Add support for driver commands
    - scsi: mpi3mr: Move data structures/definitions from MPI headers to uapi
      header
    - scsi: mpi3mr: Add support for MPT commands
    - scsi: mpi3mr: Add support for PEL commands
    - scsi: mpi3mr: Expose adapter state to sysfs
    - scsi: mpi3mr: Add support for NVMe passthrough
    - scsi: mpi3mr: Update driver version to 8.0.0.69.0
    - scsi: mpi3mr: Increase I/O timeout value to 60s
    - scsi: mpi3mr: Hidden drives not removed during soft reset
    - scsi: mpi3mr: Return I/Os to an unrecoverable HBA with DID_ERROR
    - scsi: mpi3mr: Fix a NULL vs IS_ERR() bug in mpi3mr_bsg_init()
    - scsi: mpi3mr: Return error if dma_alloc_coherent() fails
    - scsi: mpi3mr: Add shost related sysfs attributes
    - scsi: mpi3mr: Add target device related sysfs attributes
    - scsi: mpi3mr: Rework mrioc->bsg_device model to fix warnings
    - scsi: mpi3mr: Fix kernel-doc

  * cpufreq: intel_pstate: Update Balance performance EPP for Sapphire Rapids
    (LP: #2008519)
    - cpufreq: intel_pstate: Update EPP for AlderLake mobile
    - cpufreq: intel_pstate: Adjust balance_performance EPP for Sapphire Rapids

  * Fail to output sound to external monitor which connects via docking station
    (LP: #2009024)
    - [Config] Enable CONFIG_SND_HDA_INTEL_HDMI_SILENT_STREAM

  * Fix mediatek wifi driver crash when loading wrong SAR table (LP: #2009118)
    - wifi: mt76: mt7921: fix error code of return in mt7921_acpi_read

  * Jammy update: v5.15.92 upstream stable release (LP: #2011472)
    - ARM: dts: imx: Fix pca9547 i2c-mux node name
    - ARM: dts: vf610: Fix pca9548 i2c-mux node names
    - arm64: dts: freescale: Fix pca954x i2c-mux node names
    - arm64: dts: imx8mq-thor96: fix no-mmc property for SDHCI
    - firmware: arm_scmi: Clear stale xfer->hdr.status
    - bpf: Skip task with pid=1 in send_signal_common()
    - erofs/zmap.c: Fix incorrect offset calculation
    - blk-cgroup: fix missing pd_online_fn() while activating policy
    - HID: playstation: sanity check DualSense calibration data.
    - dmaengine: imx-sdma: Fix a possible memory leak in sdma_transfer_init
    - cifs: fix return of uninitialized rc in dfs_cache_update_tgthint()
    - extcon: usbc-tusb320: fix kernel-doc warning
    - Bluetooth: fix null ptr deref on hci_sync_conn_complete_evt
    - tools: fix ARRAY_SIZE defines in tools and selftests hdrs
    - selftests/vm: remove ARRAY_SIZE define from individual tests
    - selftests: Provide local define of __cpuid_count()
    - net: fix NULL pointer in skb_segment_list
    - net: mctp: purge receive queues on sk destruction
    - Linux 5.15.92

  * Jammy update: v5.15....

Changed in linux (Ubuntu Jammy):
status: Fix Committed → Fix Released
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-hwe-5.15/5.15.0-71.78~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-focal-linux-hwe-5.15 verification-needed-focal
Revision history for this message
Chengen Du (chengendu) wrote :

The SRU targeted on Jammy only and doesn't need to be tested in Focal.

tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-aws/5.15.0-1036.40 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-jammy-linux-aws verification-needed-jammy
removed: verification-done-jammy
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-azure/5.15.0-1038.45 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-jammy-linux-azure
Chengen Du (chengendu)
tags: added: verification-done-jammy
removed: verification-needed-jammy
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-intel-iotg-5.15/5.15.0-1029.34~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal' to 'verification-done-focal'. If the problem still exists, change the tag 'verification-needed-focal' to 'verification-failed-focal'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-focal-linux-intel-iotg-5.15 verification-needed-focal
removed: verification-done-focal
Chengen Du (chengendu)
tags: added: verification-done-focal
removed: verification-needed-focal
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-xilinx-zynqmp/5.15.0-1021.25 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-jammy-linux-xilinx-zynqmp verification-needed-jammy
removed: verification-done-jammy
Chengen Du (chengendu)
tags: added: verification-done-jammy
removed: verification-needed-jammy
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-aws-5.15/5.15.0-1046.51~20.04.1 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-focal-linux-aws-5.15' to 'verification-done-focal-linux-aws-5.15'. If the problem still exists, change the tag 'verification-needed-focal-linux-aws-5.15' to 'verification-failed-focal-linux-aws-5.15'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-focal-linux-aws-5.15-v2 verification-needed-focal-linux-aws-5.15
Revision history for this message
Ubuntu Kernel Bot (ubuntu-kernel-bot) wrote :

This bug is awaiting verification that the linux-mtk/5.15.0-1030.34 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy-linux-mtk' to 'verification-done-jammy-linux-mtk'. If the problem still exists, change the tag 'verification-needed-jammy-linux-mtk' to 'verification-failed-jammy-linux-mtk'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: kernel-spammed-jammy-linux-mtk-v2 verification-needed-jammy-linux-mtk
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.