linux-kernel - [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 1 Feb 2016 03:21:04 +0000
From:	Wang Nan <wangnan0@...wei.com>
To:	<acme@...nel.org>
CC:	<linux-kernel@...r.kernel.org>, Wang Nan <wangnan0@...wei.com>,
	"Adrian Hunter" <adrian.hunter@...el.com>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Josh Poimboeuf <jpoimboe@...hat.com>
Subject: [PATCH 1/2] perf tools: Fix fault in error patch of intel_pt_process_auxtrace_info()

In error processing path of intel_pt_process_auxtrace_info() it calls
thread__zput() to clean and free pt->unknown_thread which is created by
thread__new(). However, when error raise, a segfault happen:

 # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs
 Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field.
 intel_pt_synth_events: failed to synthesize 'instructions' event type
 Segmentation fault (core dumped)

The problem is: there's a union in 'struct thread' combines a list_head
and a rb_node. The standard life cycle of a thread is: init rb_node during
creating, inserted into machine->threads rbtree uses rb_node, move to
machine->dead_threads using list_head, clean by thread__put:
list_del_init(&thread->node).

In the above command, it clean a thread before adding it into list,
causes the above segfault.

This patch gives a fake list_head and link the thread into it before
calling thread__zput(), get rid of the segfault.

After this patch:
 # perf script -F event,comm,pid,tid,time,addr,ip,sym,dso,iregs
 Samples for 'instructions:u' event do not have IREGS attribute set. Cannot print 'iregs' field.
 intel_pt_synth_events: failed to synthesize 'instructions' event type
 0x248 [0x88]: failed to process type: 70

Reported-by: Tong Zhang <ztong@...edu>
Signed-off-by: Wang Nan <wangnan0@...wei.com>
Cc: Adrian Hunter <adrian.hunter@...el.com>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: Josh Poimboeuf <jpoimboe@...hat.com>
---
 tools/perf/util/intel-pt.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
index 81a2eb7..e2add63 100644
--- a/tools/perf/util/intel-pt.c
+++ b/tools/perf/util/intel-pt.c
@@ -2013,6 +2013,7 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
 	struct auxtrace_info_event *auxtrace_info = &event->auxtrace_info;
 	size_t min_sz = sizeof(u64) * INTEL_PT_PER_CPU_MMAPS;
 	struct intel_pt *pt;
+	struct list_head dead_thread;
 	int err;

 	if (auxtrace_info->header.size < sizeof(struct auxtrace_info_event) +
@@ -2153,6 +2154,9 @@ int intel_pt_process_auxtrace_info(union perf_event *event,
 	return 0;

 err_delete_thread:
+	RB_CLEAR_NODE(&pt->unknown_thread->rb_node);
+	INIT_LIST_HEAD(&dead_thread);
+	list_add(&pt->unknown_thread->node, &dead_thread);
 	thread__zput(pt->unknown_thread);
 err_free_queues:
 	intel_pt_log_disable();
-- 
1.8.3.4