linux-kernel - Re: [PATCH v2 1/4] perf tools: Fix segfault for symbol annotation on TUI

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150114125736.GB3691@kernel.org>
Date:	Wed, 14 Jan 2015 09:57:36 -0300
From:	Arnaldo Carvalho de Melo <acme@...nel.org>
To:	Namhyung Kim <namhyung@...nel.org>
Cc:	Ingo Molnar <mingo@...nel.org>,
	Peter Zijlstra <a.p.zijlstra@...llo.nl>,
	Jiri Olsa <jolsa@...hat.com>,
	LKML <linux-kernel@...r.kernel.org>,
	Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
	David Ahern <dsahern@...il.com>
Subject: Re: [PATCH v2 1/4] perf tools: Fix segfault for symbol annotation on
 TUI

Em Wed, Jan 14, 2015 at 08:18:05PM +0900, Namhyung Kim escreveu:
> Currently the symbol structure is allocated with symbol_conf.priv_size
> to carry sideband information like annotation, map browser on TUI and
> sort-by-name tree node.  So retrieving these information from symbol
> needs to care about the details of such placement.
> 
> However the annotation code just assumes that the symbol is placed after
> the struct annotation.  But actually there's other info between them.
> So accessing those struct will lead to an undefined behavior (usually a
> crash) after they write their info to the same location.
> 
> To reproduce the problem, please follow the steps below:
> 
>   1. run perf report (TUI of course) with -v option
>   2. open map browser (by pressing right arrow key for any entry)
>   3. search any function (by pressing '/' key and input whatever..)
>   4. return to the hist browser (by pressing 'q' or left arrow key)
>   5. open annotation window for the same entry (by pressing 'a' key)

Thanks, nice fix, description and reproduction steps, applied to perf/urgent.

- Arnaldo
 
> Signed-off-by: Namhyung Kim <namhyung@...nel.org>
> ---
>  tools/perf/util/annotate.h | 8 +-------
>  1 file changed, 1 insertion(+), 7 deletions(-)
> 
> diff --git a/tools/perf/util/annotate.h b/tools/perf/util/annotate.h
> index 0784a9420528..cadbdc90a5cb 100644
> --- a/tools/perf/util/annotate.h
> +++ b/tools/perf/util/annotate.h
> @@ -116,11 +116,6 @@ struct annotation {
>  	struct annotated_source *src;
>  };
>  
> -struct sannotation {
> -	struct annotation annotation;
> -	struct symbol	  symbol;
> -};
> -
>  static inline struct sym_hist *annotation__histogram(struct annotation *notes, int idx)
>  {
>  	return (((void *)&notes->src->histograms) +
> @@ -129,8 +124,7 @@ static inline struct sym_hist *annotation__histogram(struct annotation *notes, i
>  
>  static inline struct annotation *symbol__annotation(struct symbol *sym)
>  {
> -	struct sannotation *a = container_of(sym, struct sannotation, symbol);
> -	return &a->annotation;
> +	return (void *)sym - symbol_conf.priv_size;
>  }
>  
>  int addr_map_symbol__inc_samples(struct addr_map_symbol *ams, int evidx);
> -- 
> 2.2.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/