linux-kernel - [tip:perf/urgent] perf record: Prevent reading invalid data in record__mmap

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-2d11c65071d489e20b3a811167507939dd8c2eac@git.kernel.org>
Date:	Mon, 23 May 2016 22:48:26 -0700
From:	tip-bot for Wang Nan <tipbot@...or.com>
To:	linux-tip-commits@...r.kernel.org
Cc:	tglx@...utronix.de, hpa@...or.com, mingo@...nel.org,
	masami.hiramatsu.pt@...achi.com, linux-kernel@...r.kernel.org,
	wangnan0@...wei.com, lizefan@...wei.com, hekuang@...wei.com,
	namhyung@...nel.org, jolsa@...nel.org, acme@...hat.com
Subject: [tip:perf/urgent] perf record: Prevent reading invalid data in
 record__mmap_read

Commit-ID:  2d11c65071d489e20b3a811167507939dd8c2eac
Gitweb:     http://git.kernel.org/tip/2d11c65071d489e20b3a811167507939dd8c2eac
Author:     Wang Nan <wangnan0@...wei.com>
AuthorDate: Mon, 23 May 2016 07:13:39 +0000
Committer:  Arnaldo Carvalho de Melo <acme@...hat.com>
CommitDate: Mon, 23 May 2016 18:22:46 -0300

perf record: Prevent reading invalid data in record__mmap_read

When record__mmap_read() requires data more than the size of ring
buffer, drop those data to avoid accessing invalid memory.

This can happen when reading from overwritable ring buffer, which
should be avoided. However, check this for robustness.

Signed-off-by: Wang Nan <wangnan0@...wei.com>
Cc: Jiri Olsa <jolsa@...nel.org>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
Cc: Namhyung Kim <namhyung@...nel.org>
Cc: Zefan Li <lizefan@...wei.com>
Cc: pi3orama@....com
Link: http://lkml.kernel.org/r/1463987628-163563-3-git-send-email-wangnan0@huawei.com
Signed-off-by: He Kuang <hekuang@...wei.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
---
 tools/perf/builtin-record.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index f3679c4..f302cc9 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -40,6 +40,7 @@
 #include <unistd.h>
 #include <sched.h>
 #include <sys/mman.h>
+#include <asm/bug.h>
 
 
 struct record {
@@ -98,6 +99,13 @@ static int record__mmap_read(struct record *rec, int idx)
 	rec->samples++;
 
 	size = head - old;
+	if (size > (unsigned long)(md->mask) + 1) {
+		WARN_ONCE(1, "failed to keep up with mmap data. (warn only once)\n");
+
+		md->prev = head;
+		perf_evlist__mmap_consume(rec->evlist, idx);
+		return 0;
+	}
 
 	if ((old & md->mask) + size != (head & md->mask)) {
 		buf = &data[old & md->mask];