linux-kernel - Re: [PATCH 5/5] perf tools: Fix NULL pointer deference when vdso not found

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Thu, 23 Jun 2016 11:03:11 +0800
From:	Hekuang <hekuang@...wei.com>
To:	"Wangnan (F)" <wangnan0@...wei.com>, <peterz@...radead.org>,
	<mingo@...hat.com>, <acme@...nel.org>,
	<alexander.shishkin@...ux.intel.com>, <jolsa@...hat.com>,
	<jpoimboe@...hat.com>, <ak@...ux.intel.com>, <eranian@...gle.com>,
	<namhyung@...nel.org>, <adrian.hunter@...el.com>,
	<sukadev@...ux.vnet.ibm.com>, <masami.hiramatsu.pt@...achi.com>,
	<tumanova@...ux.vnet.ibm.com>, <kan.liang@...el.com>,
	<penberg@...nel.org>, <dsahern@...il.com>
CC:	<linux-kernel@...r.kernel.org>
Subject: Re: [PATCH 5/5] perf tools: Fix NULL pointer deference when vdso not
 found



在 2016/6/23 10:02, Wangnan (F) 写道:
> Hi,
>
> This patch fixes a real crash problem when we do 'perf report'
> on an arm64 platform with arm32 program.
> It is introduced by commit f9b2bdf228 ("perf tools: Find vdso
> with the consider of cross-platform"). From dmesg report, perf
> crashes in dso__type() because dso is NULL.
>
> Still don't know why on x86 it never crash, but it is obviously

This is because the fault only occured while
dso_type==DSO__TYPE_32BIT, run 64bit executable won't enter the
fault branch, but if we run a 32bit executable on x86_64, this
bug can be reproduced easily.

   # file ~/hello
   ~/hello: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked (uses shared libs), for GNU/Linux 4.5.0, not stripped

   # perf record -g hello
   Segmentation fault

Thank you.

> that we need to check the return vaule from __dso__find(): it can
> be NULL.
>
> So please consider pulling.
>
> Thank you.
>
> On 2016/6/22 14:57, He Kuang wrote:
>> We should check if 'dso' is a null pointer before passing it to the
>> function dso__type(), otherwise a segfault will be raised in
>> dso__data_get_fd(). In function machine__find_vdso(), the return value
>> checking of 'dso' is missed and this patch fixes this issue.
>>
>> Signed-off-by: He Kuang <hekuang@...wei.com>
>> ---
>>   tools/perf/util/vdso.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/tools/perf/util/vdso.c b/tools/perf/util/vdso.c
>> index 8f81c41..7bdcad4 100644
>> --- a/tools/perf/util/vdso.c
>> +++ b/tools/perf/util/vdso.c
>> @@ -296,7 +296,7 @@ static struct dso *machine__find_vdso(struct 
>> machine *machine,
>>           if (!dso) {
>>               dso = __dsos__find(&machine->dsos, DSO__NAME_VDSO,
>>                          true);
>> -            if (dso_type != dso__type(dso, machine))
>> +            if (dso && dso_type != dso__type(dso, machine))
>>                   dso = NULL;
>>           }
>>           break;
>
>
>