linux-kernel - [PATCH 3/3] perf report: don't crash on invalid inline debug information

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 26 Sep 2018 15:52:07 +0200
From:   Milian Wolff <milian.wolff@...b.com>
To:     acme@...nel.org, jolsa@...nel.org, yao.jin@...ux.intel.com,
        namhyung@...nel.org
Cc:     Linux-kernel@...r.kernel.org, linux-perf-users@...r.kernel.org,
        Milian Wolff <milian.wolff@...b.com>
Subject: [PATCH 3/3] perf report: don't crash on invalid inline debug
 information

When the function name for an inline frame is invalid, we must
not try to demangle this symbol, otherwise we crash with:

#0  0x0000555555895c01 in bfd_demangle ()
#1  0x0000555555823262 in demangle_sym (dso=0x555555d92b90, elf_name=0x0, kmodule=0) at util/symbol-elf.c:215
#2  dso__demangle_sym (dso=dso@...ry=0x555555d92b90, kmodule=<optimized out>, kmodule@...ry=0, elf_name=elf_name@...ry=0x0) at util/symbol-elf.c:400
#3  0x00005555557fef4b in new_inline_sym (funcname=0x0, base_sym=0x555555d92b90, dso=0x555555d92b90) at util/srcline.c:89
#4  inline_list__append_dso_a2l (dso=dso@...ry=0x555555c7bb00, node=node@...ry=0x555555e31810, sym=sym@...ry=0x555555d92b90) at util/srcline.c:264
#5  0x00005555557ff27f in addr2line (dso_name=dso_name@...ry=0x555555d92430 "/home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf", addr=addr@...ry=2888, file=file@...ry=0x0,
    line=line@...ry=0x0, dso=dso@...ry=0x555555c7bb00, unwind_inlines=unwind_inlines@...ry=true, node=0x555555e31810, sym=0x555555d92b90) at util/srcline.c:313
#6  0x00005555557ffe7c in addr2inlines (sym=0x555555d92b90, dso=0x555555c7bb00, addr=2888, dso_name=0x555555d92430 "/home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf")
    at util/srcline.c:358

So instead handle the case where we get invalid function names
for inlined frames and use a fallback '??' function name instead.

While this crash was originally reported by Hadrien for rust code,
I can now also reproduce it with trivial C++ code. Indeed, it seems
like libbfd fails to interpret the debug information for the inline
frame symbol name:

$ addr2line -e /home/milian/.debug/.build-id/f7/186d14bb94f3c6161c010926da66033d24fce5/elf -if b48
main
/usr/include/c++/8.2.1/complex:610
??
/usr/include/c++/8.2.1/complex:618
??
/usr/include/c++/8.2.1/complex:675
??
/usr/include/c++/8.2.1/complex:685
main
/home/milian/projects/kdab/rnd/hotspot/tests/test-clients/cpp-inlining/main.cpp:39

I've reported this bug upstream and also attached a patch there
which should fix this issue:
https://sourceware.org/bugzilla/show_bug.cgi?id=23715

Signed-off-by: Milian Wolff <milian.wolff@...b.com>
Cc: Arnaldo Carvalho de Melo <acme@...nel.org>
Reported-by: Hadrien Grasland <grasland@....in2p3.fr>
---
 tools/perf/util/srcline.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
index 09d6746e6ec8..e767c4a9d4d2 100644
--- a/tools/perf/util/srcline.c
+++ b/tools/perf/util/srcline.c
@@ -85,6 +85,9 @@ static struct symbol *new_inline_sym(struct dso *dso,
 	struct symbol *inline_sym;
 	char *demangled = NULL;
 
+	if (!funcname)
+		funcname = "??";
+
 	if (dso) {
 		demangled = dso__demangle_sym(dso, 0, funcname);
 		if (demangled)
-- 
2.19.0