linux-kernel - [tip:perf/core] perf evlist: Fix perf_evlist__mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tip-a65cb4b9f8a777a715371c63c0525408048cea3e@git.kernel.org>
Date:	Mon, 14 Oct 2013 22:29:51 -0700
From:	tip-bot for Jiri Olsa <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	acme@...hat.com, linux-kernel@...r.kernel.org, paulus@...ba.org,
	hpa@...or.com, mingo@...nel.org, a.p.zijlstra@...llo.nl,
	namhyung@...nel.org, jolsa@...hat.com, fweisbec@...il.com,
	dsahern@...il.com, tglx@...utronix.de, cjashfor@...ux.vnet.ibm.com,
	mingo@...e.hu
Subject: [tip:perf/core] perf evlist:
  Fix perf_evlist__mmap_read event overflow

Commit-ID:  a65cb4b9f8a777a715371c63c0525408048cea3e
Gitweb:     http://git.kernel.org/tip/a65cb4b9f8a777a715371c63c0525408048cea3e
Author:     Jiri Olsa <jolsa@...hat.com>
AuthorDate: Wed, 2 Oct 2013 15:46:39 +0200
Committer:  Arnaldo Carvalho de Melo <acme@...hat.com>
CommitDate: Fri, 11 Oct 2013 12:17:40 -0300

perf evlist: Fix perf_evlist__mmap_read event overflow

The perf_evlist__mmap_read used 'union perf_event' as a placeholder for
event crossing the mmap boundary.

This is ok for sample shorter than ~PATH_MAX. However we could grow up
to the maximum sample size which is 16 bits max.

I hit this overflow issue when using 'perf top -G dwarf' which produces
sample with the size around 8192 bytes.  We could configure any valid
sample size here using: '-G dwarf,size'.

Using array with sample max size instead for the event placeholder. Also
adding another safe check for the dynamic size of the user stack.

TODO: The 'struct perf_mmap' is quite big now, maybe we could use some
lazy allocation for event_copy size.

Signed-off-by: Jiri Olsa <jolsa@...hat.com>
Acked-by: David Ahern <dsahern@...il.com>
Cc: Corey Ashford <cjashfor@...ux.vnet.ibm.com>
Cc: David Ahern <dsahern@...il.com>
Cc: Frederic Weisbecker <fweisbec@...il.com>
Cc: Ingo Molnar <mingo@...e.hu>
Cc: Namhyung Kim <namhyung@...nel.org>
Cc: Paul Mackerras <paulus@...ba.org>
Cc: Peter Zijlstra <a.p.zijlstra@...llo.nl>
Link: http://lkml.kernel.org/r/1380721599-24285-1-git-send-email-jolsa@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
---
 tools/perf/util/event.h  | 3 +++
 tools/perf/util/evlist.c | 4 ++--
 tools/perf/util/evlist.h | 2 +-
 tools/perf/util/evsel.c  | 3 +++
 4 files changed, 9 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/event.h b/tools/perf/util/event.h
index 9b7d4d3..752709c 100644
--- a/tools/perf/util/event.h
+++ b/tools/perf/util/event.h
@@ -75,6 +75,9 @@ struct throttle_event {
 	 PERF_SAMPLE_CPU | PERF_SAMPLE_PERIOD |		\
 	 PERF_SAMPLE_IDENTIFIER)
 
+/* perf sample has 16 bits size limit */
+#define PERF_SAMPLE_MAX_SIZE (1 << 16)
+
 struct sample_event {
 	struct perf_event_header        header;
 	u64 array[];
diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c
index f0d71a9..cb9523f 100644
--- a/tools/perf/util/evlist.c
+++ b/tools/perf/util/evlist.c
@@ -540,7 +540,7 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
 		if ((old & md->mask) + size != ((old + size) & md->mask)) {
 			unsigned int offset = old;
 			unsigned int len = min(sizeof(*event), size), cpy;
-			void *dst = &md->event_copy;
+			void *dst = md->event_copy;
 
 			do {
 				cpy = min(md->mask + 1 - (offset & md->mask), len);
@@ -550,7 +550,7 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx)
 				len -= cpy;
 			} while (len);
 
-			event = &md->event_copy;
+			event = (union perf_event *) md->event_copy;
 		}
 
 		old += size;
diff --git a/tools/perf/util/evlist.h b/tools/perf/util/evlist.h
index 871b55a..722618f 100644
--- a/tools/perf/util/evlist.h
+++ b/tools/perf/util/evlist.h
@@ -21,7 +21,7 @@ struct perf_mmap {
 	void		 *base;
 	int		 mask;
 	unsigned int	 prev;
-	union perf_event event_copy;
+	char		 event_copy[PERF_SAMPLE_MAX_SIZE];
 };
 
 struct perf_evlist {
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c
index abe69af..bfebc1e 100644
--- a/tools/perf/util/evsel.c
+++ b/tools/perf/util/evsel.c
@@ -1456,6 +1456,9 @@ int perf_evsel__parse_sample(struct perf_evsel *evsel, union perf_event *event,
 			array = (void *)array + sz;
 			OVERFLOW_CHECK_u64(array);
 			data->user_stack.size = *array++;
+			if (WARN_ONCE(data->user_stack.size > sz,
+				      "user stack dump failure\n"))
+				return -EFAULT;
 		}
 	}
 
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/