linux-kernel - Re: [PATCH v2] perf buildid: Avoid copy of uninitialized memory

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Y9AlqSH4kBVddKqg@kernel.org>
Date:   Tue, 24 Jan 2023 15:38:33 -0300
From:   Arnaldo Carvalho de Melo <acme@...nel.org>
To:     Ian Rogers <irogers@...gle.com>
Cc:     Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Jiri Olsa <jolsa@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Nathan Chancellor <nathan@...nel.org>,
        Nick Desaulniers <ndesaulniers@...gle.com>,
        Tom Rix <trix@...hat.com>,
        Adrian Hunter <adrian.hunter@...el.com>,
        Leo Yan <leo.yan@...aro.org>, linux-perf-users@...r.kernel.org,
        linux-kernel@...r.kernel.org, llvm@...ts.linux.dev,
        Stephane Eranian <eranian@...gle.com>,
        Arnaldo Carvalho de Melo <acme@...hat.com>
Subject: Re: [PATCH v2] perf buildid: Avoid copy of uninitialized memory

Em Fri, Jan 20, 2023 at 10:58:28AM -0800, Ian Rogers escreveu:
> build_id__init only copies the buildid data up to size leaving the
> rest of the data array uninitialized. Copying the full array during
> synthesis means the written event contains uninitialized
> memory. Ensure the size is less that the buffer size and only copy the
> bytes that were initialized. This was detected by the Clang/LLVM
> memory sanitizer.
> 
> Suggested-by: Arnaldo Carvalho de Melo <acme@...hat.com>
> Signed-off-by: Ian Rogers <irogers@...gle.com>
> 
> v2. Avoids the potential for copying too much as suggested by Arnaldo.

Thanks, applied.

- Arnaldo

> ---
>  tools/perf/util/synthetic-events.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> index 3ab6a92b1a6d..9ab9308ee80c 100644
> --- a/tools/perf/util/synthetic-events.c
> +++ b/tools/perf/util/synthetic-events.c
> @@ -2219,8 +2219,8 @@ int perf_event__synthesize_build_id(struct perf_tool *tool, struct dso *pos, u16
>  
>  	len = pos->long_name_len + 1;
>  	len = PERF_ALIGN(len, NAME_ALIGN);
> -	memcpy(&ev.build_id.build_id, pos->bid.data, sizeof(pos->bid.data));
> -	ev.build_id.size = pos->bid.size;
> +	ev.build_id.size = min(pos->bid.size, sizeof(pos->bid.data));
> +	memcpy(&ev.build_id.build_id, pos->bid.data, ev.build_id.size);
>  	ev.build_id.header.type = PERF_RECORD_HEADER_BUILD_ID;
>  	ev.build_id.header.misc = misc | PERF_RECORD_MISC_BUILD_ID_SIZE;
>  	ev.build_id.pid = machine->pid;
> -- 
> 2.39.0.246.g2a6d74b583-goog
> 

-- 

- Arnaldo