linux-kernel - Re: perf segmentation fault from NULL dereference

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4ac88076-60fa-4509-7fa0-2f99d73174d2@huawei.com>
Date:   Tue, 2 Oct 2018 11:41:36 +0100
From:   John Garry <john.garry@...wei.com>
To:     Jiri Olsa <jolsa@...hat.com>
CC:     Andi Kleen <ak@...ux.intel.com>, Ingo Molnar <mingo@...hat.com>,
        "Peter Zijlstra" <peterz@...radead.org>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Linuxarm <linuxarm@...wei.com>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        "Will Deacon" <will.deacon@....com>,
        Mark Rutland <mark.rutland@....com>
Subject: Re: perf segmentation fault from NULL dereference


>> I am suspicious that this is a real issue, as this patch has been in
>> mainline for some time...
>>
>> This simple change fixes the issue me:
>> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
>> index 91e6d9c..f4fd826 100644
>> --- a/tools/perf/util/header.c
>> +++ b/tools/perf/util/header.c
>> @@ -3576,7 +3576,7 @@ int perf_event__process_feature(struct perf_tool
>> *tool,
>>      int max, err;
>>      u16 type;
>>
>> -    if (!evsel->own_cpus)
>> +    if (!evsel->own_cpus || !(evsel->attr.read_format & PERF_FORMAT_ID)) //
>> roundabout check for !evsel->id
>>          return 0;
>>
>>      ev = cpu_map_data__alloc(evsel->own_cpus, &size, &type, &max);
>>
>> It turns out that evsel->id is NULL on a call to
>> perf_event__process_feature(), which upsets this code:
>>
>>     ev->header.type = PERF_RECORD_EVENT_UPDATE;
>>     ev->header.size = (u16)size;
>>     ev->type = PERF_EVENT_UPDATE__CPUS;
>>     ev->id   = evsel->id[0];
>>
>> Please me let me know if a valid issue so we can get a fix in.
>
> yea, I can see how we can get here with event having
> its own CPUs, and we allocate the id array later at
> the time we map the event
>
> I wonder instead of skipping on this feature, we should
> allocate the id array, like below
>
> I did not test that.. need to find the server having event
> with its own cpus.. also need to make sure evsel->cpus is
> the way to go in here
>

Thanks for the fix, but I got this:
root@...alhost:~# ./perf_debug_ record -e armv8_pmuv3_0/br_mis_pred/ sleep 1
Couldn't synthesize evsel cpus.
root@...alhost:~#


> thanks,
> jirka
>
>
> ---
> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index 1ec1d9bc2d63..fb2a0dab3978 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c
> @@ -29,6 +29,7 @@
>  #include "symbol.h"
>  #include "debug.h"
>  #include "cpumap.h"
> +#include "thread_map.h"
>  #include "pmu.h"
>  #include "vdso.h"
>  #include "strbuf.h"
> @@ -3579,6 +3580,11 @@ perf_event__synthesize_event_update_cpus(struct perf_tool *tool,
> 	if (!evsel->own_cpus)
> 		return 0;
>
> +	if (!evsel->id ||

for my test, evsel->id is NULL

> +	    perf_evsel__alloc_id(evsel, cpu_map__nr(evsel->cpus),
> +				 thread_map__nr(evsel->threads)))

and then this function is not called as we return immediately. So did 
you really want this:

if (!evsel->id && perf_evsel__alloc_id(...))
	return -ENOMEM;

This looks to work:

root@...alhost:~# ./perf_debug_ record -e armv8_pmuv3_0/br_mis_pred/ sleep 1
[ perf record: Woken up 1 times to write data ]
[ perf record: Captured and wrote 0.001 MB perf.data (7 samples) ]
root@...alhost:~# ./perf_debug_ report
# To display the perf.data header info, please use 
--header/--header-only option
#
#
# Total Lost Samples: 0
#
# Samples: 7  of event 'armv8_pmuv3_0/br_mis_pred/'
# Event count (approx.): 8260
#
# Overhead  Command  Shared Object      Symbol
# ........  .......  .................  ......................
#
     78.28%  sleep    libc-2.23.so       [.] 0x00000000000faef0
     20.53%  sleep    [kernel.kallsyms]  [k] vmacache_find
      1.09%  sleep    [kernel.kallsyms]  [k] find_vma
      0.10%  perf_de  [kernel.kallsyms]  [k] perf_event_exec


#
# (Cannot load tips.txt file, please install perf!)
#
root@...alhost:~#


> +		return -ENOMEM;
> +
> 	ev = cpu_map_data__alloc(evsel->own_cpus, &size, &type, &max);
> 	if (!ev)
> 		return -ENOMEM;
>
> .
>


Thanks,
John