linux-kernel - Re: perf per-symbol histogram causes memory corruption

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20100225141351.GA8553@ghostprotocols.net>
Date:	Thu, 25 Feb 2010 11:13:51 -0300
From:	Arnaldo Carvalho de Melo <acme@...hat.com>
To:	Ingo Molnar <mingo@...e.hu>
Cc:	David Miller <davem@...emloft.net>, a.p.zijlstra@...llo.nl,
	paulus@...ba.org, linux-kernel@...r.kernel.org,
	Frédéric Weisbecker <fweisbec@...il.com>
Subject: Re: perf per-symbol histogram causes memory corruption

Em Thu, Feb 25, 2010 at 12:11:48PM +0100, Ingo Molnar escreveu:
> 
> (Added Arnaldo to the Cc: - he's maintaining the symbol lookup bits of perf.)
> 
> * David Miller <davem@...emloft.net> wrote:
> 
> > When builtin-annotate.c processes sample events via
> > process_sample_event() it uses 'sample_filter'
> > 
> > sample_filter() sizes the histogram object for a symbol based upon the
> > size, calculated as "sym->end - sym->start", to determine the number
> > of IP sample slots to allocate.
> > 
> > The problem is, the sym->end value is not stable at this point.
> > 
> > For example, dso__load_sym() first loads all of the symbols, then it
> > makes another pass over the symbols by calling symbols__fixup_end()
> > which will adjust the sym->end values of various symbols.
> > 
> > At this point, the histogram IP sample array allocated by
> > sample_filter() can become too small, and hits recorded can thus
> > access past the end of the array corrupting memory.
> > 
> > I get this very reliably on sparc64, and it took me a few days to root
> > cause this. :-)
> > 
> > I don't see an immediate way to fix this, any ideas?

This was reported by Anton as well, I guess the right way to fix this is
to first load all symbols and then iterate thru them allocating the
resources that need to have ->end fixed up.

As we already fix up the symbols when we finish loading them, annotate
would have meaningful ->end members.

I.e. 'perf annotate' is not using this mechanism as a filter. Its a post
processing phase.

I'll provide a patch.

- Arnaldo
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/