linux-kernel - [PATCH 2/2] perf tools: Fix fault in tracepoint_error if NULL is passed to parse

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Mon, 1 Feb 2016 03:21:05 +0000
From:	Wang Nan <wangnan0@...wei.com>
To:	<acme@...nel.org>
CC:	<linux-kernel@...r.kernel.org>, Wang Nan <wangnan0@...wei.com>,
	"Adrian Hunter" <adrian.hunter@...el.com>,
	Arnaldo Carvalho de Melo <acme@...hat.com>,
	Tong Zhang <ztong@...edu>, Josh Poimboeuf <jpoimboe@...hat.com>
Subject: [PATCH 2/2] perf tools: Fix fault in tracepoint_error if NULL is passed to parse_event

Following segfault can happen with a non-root user:

 $ ./perf record -I -e intel_pt/tsc=1,noretcomp=1/u /bin/ls
 WARNING: Kernel address maps (/proc/{kallsyms,modules}) are restricted,
 check /proc/sys/kernel/kptr_restrict.

 Samples in kernel functions may not be resolved if a suitable vmlinux
 file is not found in the buildid cache or in the vmlinux path.

 Samples in kernel modules won't be resolved at all.

 If some relocation was applied (e.g. kexec) symbols may be misresolved
 even with a suitable vmlinux or kallsyms file.

 Segmentation fault (core dumped)

The error is in tracepoint_error: it assumes 'e' is valid.

However, there are many situation a parse_event can be called without
parse_events_error. See result of
'grep 'parse_events(.*NULL)' ./tools/perf/ -r'.

This patch makes tracepoint_error() directly return when !e.

Signed-off-by: Wang Nan <wangnan0@...wei.com>
Cc: Adrian Hunter <adrian.hunter@...el.com>
Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
Cc: Tong Zhang <ztong@...edu>
Cc: Josh Poimboeuf <jpoimboe@...hat.com>
---
 tools/perf/util/parse-events.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 4f7b0ef..813d9b2 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -399,6 +399,9 @@ static void tracepoint_error(struct parse_events_error *e, int err,
 {
 	char help[BUFSIZ];

+	if (!e)
+		return;
+
 	/*
 	 * We get error directly from syscall errno ( > 0),
 	 * or from encoded pointer's error ( < 0).
-- 
1.8.3.4