linux-kernel - Re: [PATCH] perf mmap: Fix accessing unmapped mmap in perf_mmap__read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20180326142604.GE18897@kernel.org>
Date:   Mon, 26 Mar 2018 11:26:04 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     kan.liang@...ux.intel.com
Cc:     mingo@...hat.com, linux-kernel@...r.kernel.org, jolsa@...nel.org,
        namhyung@...nel.org, wangnan0@...wei.com
Subject: Re: [PATCH] perf mmap: Fix accessing unmapped mmap in
 perf_mmap__read_done()

Em Mon, Mar 26, 2018 at 09:42:09AM -0400, kan.liang@...ux.intel.com escreveu:
> From: Kan Liang <kan.liang@...ux.intel.com>
> 
> There is segmentation fault when running perf trace. For example,
>   [root@...et e]# perf trace -e *chdir -o /tmp/bla perf report
>   --ignore-vmlinux -i ../perf.data
> 
> The perf_mmap__consume() could unmap the mmap. It needs to check the
> refcnt in perf_mmap__read_done().
> 
> Fixes: ee023de05f35 ("perf mmap: Introduce perf_mmap__read_done()")
> Reported-by: Arnaldo Carvalho de Melo <acme@...hat.com>
> Signed-off-by: Kan Liang <kan.liang@...ux.intel.com>

Seems insuficient:

[root@...et ~]# perf trace -e *chdir -o /tmp/bla perf report --ignore-vmlinux
perf: Segmentation fault
Obtained 9 stack frames.
perf(sighandler_dump_stack+0x3e) [0x4fe31e]
/lib64/libc.so.6(+0x346df) [0x7fc0c3ced6df]
perf(perf_mmap__read_init+0x26) [0x4ccd06]
perf(cmd_trace+0x1bf6) [0x47bb76]
perf() [0x4a824e]
perf() [0x4a8550]
perf(main+0x331) [0x42bef1]
/lib64/libc.so.6(__libc_start_main+0xe9) [0x7fc0c3cd9f29]
perf(_start+0x29) [0x42c319]
Segmentation fault (core dumped)
[root@...et ~]#

- Arnaldo