linux-kernel - perf segmentation fault from NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Tue, 25 Sep 2018 16:53:40 +0100
From:   John Garry <john.garry@...wei.com>
To:     Andi Kleen <ak@...ux.intel.com>, Jiri Olsa <jolsa@...hat.com>,
        Ingo Molnar <mingo@...hat.com>,
        Peter Zijlstra <peterz@...radead.org>,
        "Arnaldo Carvalho de Melo" <acme@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>
CC:     Linuxarm <linuxarm@...wei.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Namhyung Kim <namhyung@...nel.org>
Subject: perf segmentation fault from NULL dereference

Hi,

I am seeing this perf crash on my arm64-based system:

root@...alhost:~# ./perf_debug_ record -e armv8_pmuv3_0/br_mis_pred/ sleep 1
perf: Segmentation fault
Obtained 9 stack frames.
./perf_debug_() [0x4c5ef8]
[0xffff82ba267c]
./perf_debug_() [0x4bc5a8]
./perf_debug_() [0x419550]
./perf_debug_() [0x41a928]
./perf_debug_() [0x472f58]
./perf_debug_() [0x473210]
./perf_debug_() [0x4070f4]
/lib/aarch64-linux-gnu/libc.so.6(__libc_start_main+0xe0) [0xffff8294c8a0]
Segmentation fault (core dumped)

I find 'cycles' event is fine.

I bisected the issue to here:
commit bfd8f72c2778f5bd63dc9eb6d23bd7a0d99cff6d (HEAD, refs/bisect/bad)
Author: Andi Kleen <ak@...ux.intel.com>
Date:   Fri Nov 17 13:42:58 2017 -0800

     perf record: Synthesize unit/scale/... in event update

     Move the code to synthesize event updates for scale/unit/cpus to a
     common utility file, and use it both from stat and record.

     This allows to access scale and other extra qualifiers from perf 
script.

     Signed-off-by: Andi Kleen <ak@...ux.intel.com>
     Acked-by: Jiri Olsa <jolsa@...nel.org>
     Link: 
http://lkml.kernel.org/r/20171117214300.32746-2-andi@firstfloor.org
     Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>

I am suspicious that this is a real issue, as this patch has been in 
mainline for some time...

This simple change fixes the issue me:
diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index 91e6d9c..f4fd826 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -3576,7 +3576,7 @@ int perf_event__process_feature(struct perf_tool 
*tool,
      int max, err;
      u16 type;

-    if (!evsel->own_cpus)
+    if (!evsel->own_cpus || !(evsel->attr.read_format & 
PERF_FORMAT_ID)) // roundabout check for !evsel->id
          return 0;

      ev = cpu_map_data__alloc(evsel->own_cpus, &size, &type, &max);

It turns out that evsel->id is NULL on a call to 
perf_event__process_feature(), which upsets this code:

     ev->header.type = PERF_RECORD_EVENT_UPDATE;
     ev->header.size = (u16)size;
     ev->type = PERF_EVENT_UPDATE__CPUS;
     ev->id   = evsel->id[0];

Please me let me know if a valid issue so we can get a fix in.

Apologies for crying wolf if I'm off the mark.

Cheers,
John