| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20190419133517.GE17719@sasha-vm>
Date: Fri, 19 Apr 2019 09:35:17 -0400
From: Sasha Levin <sashal@...nel.org>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
linux-kernel@...r.kernel.org, stable@...r.kernel.org,
Changbin Du <changbin.du@...il.com>,
Jiri Olsa <jolsa@...nel.org>,
Alexei Starovoitov <ast@...nel.org>,
Daniel Borkmann <daniel@...earbox.net>,
Namhyung Kim <namhyung@...nel.org>,
Peter Zijlstra <peterz@...radead.org>,
"Steven Rostedt (VMware)" <rostedt@...dmis.org>,
Arnaldo Carvalho de Melo <acme@...hat.com>
Subject: Re: [PATCH 5.0 39/93] perf top: Delete the evlist before
perf_session, fixing heap-use-after-free issue
On Thu, Apr 18, 2019 at 02:31:43PM -0500, Dan Rue wrote:
>On Thu, Apr 18, 2019 at 07:57:17PM +0200, Greg Kroah-Hartman wrote:
>> [ Upstream commit 0dba9e4be95b59e77060645ca8e37ca3231061f5 ]
>>
>> The evlist should be destroyed before the perf session.
>>
>> Detected with gcc's ASan:
>>
>> =================================================================
>> ==27350==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b000002e38 at pc 0x5611da276999 bp 0x7ffce8f1d1a0 sp 0x7ffce8f1d190
>> WRITE of size 8 at 0x62b000002e38 thread T0
>> #0 0x5611da276998 in __list_del /home/work/linux/tools/include/linux/list.h:89
>> #1 0x5611da276d4a in __list_del_entry /home/work/linux/tools/include/linux/list.h:102
>> #2 0x5611da276e77 in list_del_init /home/work/linux/tools/include/linux/list.h:145
>> #3 0x5611da2781cd in thread__put util/thread.c:130
>> #4 0x5611da2cc0a8 in __thread__zput util/thread.h:68
>> #5 0x5611da2d2dcb in hist_entry__delete util/hist.c:1148
>> #6 0x5611da2cdf91 in hists__delete_entry util/hist.c:337
>> #7 0x5611da2ce19e in hists__delete_entries util/hist.c:365
>> #8 0x5611da2db2ab in hists__delete_all_entries util/hist.c:2639
>> #9 0x5611da2db325 in hists_evsel__exit util/hist.c:2651
>> #10 0x5611da1c5352 in perf_evsel__exit util/evsel.c:1304
>> #11 0x5611da1c5390 in perf_evsel__delete util/evsel.c:1309
>> #12 0x5611da1b35f0 in perf_evlist__purge util/evlist.c:124
>> #13 0x5611da1b38e2 in perf_evlist__delete util/evlist.c:148
>> #14 0x5611da069781 in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1645
>> #15 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
>> #16 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
>> #17 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
>> #18 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520
>> #19 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
>> #20 0x5611d9ff35c9 in _start (/home/work/linux/tools/perf/perf+0x3e95c9)
>>
>> 0x62b000002e38 is located 11320 bytes inside of 27448-byte region [0x62b000000200,0x62b000006d38)
>> freed by thread T0 here:
>> #0 0x7fdccb04ab70 in free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xedb70)
>> #1 0x5611da260df4 in perf_session__delete util/session.c:201
>> #2 0x5611da063de5 in __cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1300
>> #3 0x5611da06973c in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1642
>> #4 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
>> #5 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
>> #6 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
>> #7 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520
>> #8 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
>>
>> previously allocated by thread T0 here:
>> #0 0x7fdccb04b138 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xee138)
>> #1 0x5611da26010c in zalloc util/util.h:23
>> #2 0x5611da260824 in perf_session__new util/session.c:118
>> #3 0x5611da0633a6 in __cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1192
>> #4 0x5611da06973c in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1642
>> #5 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
>> #6 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
>> #7 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
>> #8 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520
>> #9 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
>>
>> SUMMARY: AddressSanitizer: heap-use-after-free /home/work/linux/tools/include/linux/list.h:89 in __list_del
>> Shadow bytes around the buggy address:
>> 0x0c567fff8570: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> 0x0c567fff8580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> 0x0c567fff8590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> 0x0c567fff85a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> 0x0c567fff85b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> =>0x0c567fff85c0: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
>> 0x0c567fff85d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> 0x0c567fff85e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> 0x0c567fff85f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> 0x0c567fff8600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> 0x0c567fff8610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
>> Shadow byte legend (one shadow byte represents 8 application bytes):
>> Addressable: 00
>> Partially addressable: 01 02 03 04 05 06 07
>> Heap left redzone: fa
>> Freed heap region: fd
>> Stack left redzone: f1
>> Stack mid redzone: f2
>> Stack right redzone: f3
>> Stack after return: f5
>> Stack use after scope: f8
>> Global redzone: f9
>> Global init order: f6
>> Poisoned by user: f7
>> Container overflow: fc
>> Array cookie: ac
>> Intra object redzone: bb
>> ASan internal: fe
>> Left alloca redzone: ca
>> Right alloca redzone: cb
>> ==27350==ABORTING
>
>I'm seeing the following build error as a result of this patch being
>backported to 5.0:
>
> builtin-top.c: In function ‘__cmd_top’:
> builtin-top.c:1241:3: error: label ‘out_delete’ used but not defined
> goto out_delete;
> ^~~~
> CC builtin-script.o
>
>Dropping this patch from 5.0 (along with ad59b96f965a ("perf data: Don't store
>auxtrace index for directory data file") does fix the perf build.
Now dropped, thanks again!
--
Thanks,
Sasha
Powered by blists - more mailing lists