linux-kernel - Re: [GIT PULL] perf fixes

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20130929224720.GA282@x4>
Date:	Mon, 30 Sep 2013 00:47:20 +0200
From:	Markus Trippelsdorf <markus@...ppelsdorf.de>
To:	Andi Kleen <ak@...ux.intel.com>
Cc:	Ingo Molnar <mingo@...nel.org>,
	Linus Torvalds <torvalds@...ux-foundation.org>,
	linux-kernel@...r.kernel.org,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Arnaldo Carvalho de Melo <acme@...radead.org>,
	Arnaldo Carvalho de Melo <acme@...hat.com>
Subject: Re: [GIT PULL] perf fixes

On 2013.09.29 at 14:33 -0700, Andi Kleen wrote:
> > breaks "perf top" on my machine. I just see a gray screen with no text
> > at all. Sometimes the following error messages are printed:
> >  *** Error in `perf': invalid fastbin entry (free): 0x00000000029b18c0 ***
> >  *** Error in `perf': malloc(): memory corruption (fast): 0x0000000000ee0b10 ***
> 
> Hmm, works for me. In fact I wrote it to fix a perf top issue.
> 
> What does valgrind say?

Here's the -fsanitize=address output instead:

markus@x4 perf % perf top --stdio 2>&1 | asan_symbolize.py
=================================================================
==24617== ERROR: AddressSanitizer: heap-buffer-overflow on address 0x600c0000b638 at pc 0x7f2683fad79d bp 0x7fffbb8ec3b0 sp 0x7fffbb8ebb70
WRITE of size 9 at 0x600c0000b638 thread T0
    #0 0x7f2683fad79c in __interceptor_strcpy ??:?
    #1 0x4e422c in strcpy /usr/include/bits/string3.h:104
    #2 0x4ddeff in dso__load /usr/src/linux/tools/perf/util/symbol.c:1085
    #3 0x509058 in map__load /usr/src/linux/tools/perf/util/map.c:159
    #4 0x49fa6b in perf_event__preprocess_sample /usr/src/linux/tools/perf/util/event.c:762
    #5 0x455fa0 in perf_event__process_sample /usr/src/linux/tools/perf/builtin-top.c:719
    #6 0x45be8e in perf_top__mmap_read /usr/src/linux/tools/perf/builtin-top.c:870
    #7 0x41f88d in run_builtin /usr/src/linux/tools/perf/perf.c:319
    #8 0x41bc05 in run_argv /usr/src/linux/tools/perf/perf.c:376
    #9 0x7f2682d41a74 in __libc_start_main /home/markus/glibc/csu/libc-start.c:269
    #10 0x41e948 in _start /home/markus/glibc/csu/../sysdeps/x86_64/start.S:122
0x600c0000b63d is located 0 bytes to the right of 61-byte region [0x600c0000b600,0x600c0000b63d)
allocated by thread T0 here:
    #0 0x7f2683fb6d6f in __interceptor_realloc ??:?
    #1 0x4e420f in dso__load_sym /usr/src/linux/tools/perf/util/symbol-elf.c:951
    #2 0x4ddeff in dso__load /usr/src/linux/tools/perf/util/symbol.c:1085
    #3 0x509058 in map__load /usr/src/linux/tools/perf/util/map.c:159
    #4 0x49fa6b in perf_event__preprocess_sample /usr/src/linux/tools/perf/util/event.c:762
    #5 0x455fa0 in perf_event__process_sample /usr/src/linux/tools/perf/builtin-top.c:719
    #6 0x45be8e in perf_top__mmap_read /usr/src/linux/tools/perf/builtin-top.c:870
    #7 0x41f88d in run_builtin /usr/src/linux/tools/perf/perf.c:319
    #8 0x41bc05 in run_argv /usr/src/linux/tools/perf/perf.c:376
    #9 0x7f2682d41a74 in __libc_start_main /home/markus/glibc/csu/libc-start.c:269
Shadow bytes around the buggy address:
  0x0c01ffff9670: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c01ffff9680: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c01ffff9690: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c01ffff96a0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
  0x0c01ffff96b0: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
=>0x0c01ffff96c0: 00 00 00 00 00 00 00[05]fa fa fa fa fd fd fd fd
  0x0c01ffff96d0: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c01ffff96e0: fa fa fa fa fd fd fd fd fd fd fd fa fa fa fa fa
  0x0c01ffff96f0: fd fd fd fd fd fd fd fd fa fa fa fa fd fd fd fd
  0x0c01ffff9700: fd fd fd fd fa fa fa fa fd fd fd fd fd fd fd fd
  0x0c01ffff9710: fa fa fa fa fd fd fd fd fd fd fd fd fa fa fa fa
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:     fa
  Heap righ redzone:     fb
  Freed Heap region:     fd
  Stack left redzone:    f1
  Stack mid redzone:     f2
  Stack right redzone:   f3
  Stack partial redzone: f4
  Stack after return:    f5
  Stack use after scope: f8
  Global redzone:        f9
  Global init order:     f6
  Poisoned by user:      f7
  ASan internal:         fe
==24617== ABORTING

And please note that cloned functions are demangled just fine on my machine
even without your patch, e.g.:

 10.61%  libQtGui.so.4.8.5   [.] QFontEngineFT::stringToCMap(QChar const*, int, QGlyphLayout*, int*, QFlags<QTextEngine::ShaperFlag>) const [clone .part.20]

-- 
Markus
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/