linux-kernel - Re: [PATCH] perf mmap: Fix accessing unmapped mmap in perf_mmap__read

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <cf6f5ab7-5be4-19c6-318c-c665c0d888c4@linux.intel.com>
Date:   Mon, 26 Mar 2018 10:51:37 -0400
From:   "Liang, Kan" <kan.liang@...ux.intel.com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:     mingo@...hat.com, linux-kernel@...r.kernel.org, jolsa@...nel.org,
        namhyung@...nel.org, wangnan0@...wei.com
Subject: Re: [PATCH] perf mmap: Fix accessing unmapped mmap in
 perf_mmap__read_done()



On 3/26/2018 10:41 AM, Arnaldo Carvalho de Melo wrote:
> Em Mon, Mar 26, 2018 at 11:26:04AM -0300, Arnaldo Carvalho de Melo escreveu:
>> Em Mon, Mar 26, 2018 at 09:42:09AM -0400, kan.liang@...ux.intel.com escreveu:
>>> From: Kan Liang <kan.liang@...ux.intel.com>
>>>
>>> There is segmentation fault when running perf trace. For example,
>>>    [root@...et e]# perf trace -e *chdir -o /tmp/bla perf report
>>>    --ignore-vmlinux -i ../perf.data
>>>
>>> The perf_mmap__consume() could unmap the mmap. It needs to check the
>>> refcnt in perf_mmap__read_done().
>>>
>>> Fixes: ee023de05f35 ("perf mmap: Introduce perf_mmap__read_done()")
>>> Reported-by: Arnaldo Carvalho de Melo <acme@...hat.com>
>>> Signed-off-by: Kan Liang <kan.liang@...ux.intel.com>
>>
>> Seems insuficient:
>>
>> [root@...et ~]# perf trace -e *chdir -o /tmp/bla perf report --ignore-vmlinux
>> perf: Segmentation fault
>> Obtained 9 stack frames.
>> perf(sighandler_dump_stack+0x3e) [0x4fe31e]
>> /lib64/libc.so.6(+0x346df) [0x7fc0c3ced6df]
>> perf(perf_mmap__read_init+0x26) [0x4ccd06]
>> perf(cmd_trace+0x1bf6) [0x47bb76]
>> perf() [0x4a824e]
>> perf() [0x4a8550]
>> perf(main+0x331) [0x42bef1]
>> /lib64/libc.so.6(__libc_start_main+0xe9) [0x7fc0c3cd9f29]
>> perf(_start+0x29) [0x42c319]
>> Segmentation fault (core dumped)
>> [root@...et ~]#
> 
> I'm adding this as a separate patch, with yours and this one, the
> segfault is gone.
>

Thanks. Yes, we should check the mmap before using it for all new 
interfaces.

Thanks,
Kan

> - Arnaldo
> 
> diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
> index f6cfc52ff1fe..fc832676a798 100644
> --- a/tools/perf/util/mmap.c
> +++ b/tools/perf/util/mmap.c
> @@ -234,7 +234,7 @@ static int overwrite_rb_find_range(void *buf, int mask, u64 *start, u64 *end)
>   /*
>    * Report the start and end of the available data in ringbuffer
>    */
> -int perf_mmap__read_init(struct perf_mmap *md)
> +static int __perf_mmap__read_init(struct perf_mmap *md)
>   {
>   	u64 head = perf_mmap__read_head(md);
>   	u64 old = md->prev;
> @@ -268,6 +268,17 @@ int perf_mmap__read_init(struct perf_mmap *md)
>   	return 0;
>   }
>   
> +int perf_mmap__read_init(struct perf_mmap *map)
> +{
> +	/*
> +	 * Check if event was unmapped due to a POLLHUP/POLLERR.
> +	 */
> +	if (!refcount_read(&map->refcnt))
> +		return -ENOENT;
> +
> +	return __perf_mmap__read_init(map);
> +}
> +
>   int perf_mmap__push(struct perf_mmap *md, void *to,
>   		    int push(void *to, void *buf, size_t size))
>   {
>