linux-kernel - Re: [PATCH v1] libperf evlist: Avoid out-of-bounds access

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 29 Feb 2024 17:58:09 -0800
From: Namhyung Kim <namhyung@...nel.org>
To: Ian Rogers <irogers@...gle.com>
Cc: Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...hat.com>, 
	Arnaldo Carvalho de Melo <acme@...nel.org>, Mark Rutland <mark.rutland@....com>, 
	Alexander Shishkin <alexander.shishkin@...ux.intel.com>, Jiri Olsa <jolsa@...nel.org>, 
	Adrian Hunter <adrian.hunter@...el.com>, Yang Jihong <yangjihong1@...wei.com>, 
	linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] libperf evlist: Avoid out-of-bounds access

On Thu, Feb 29, 2024 at 5:06 PM Ian Rogers <irogers@...gle.com> wrote:
>
> On Thu, Feb 29, 2024 at 1:46 PM Namhyung Kim <namhyung@...nel.org> wrote:
> >
> > On Wed, Feb 28, 2024 at 11:08 PM Ian Rogers <irogers@...gle.com> wrote:
> > >
> > > Parallel testing appears to show a race between allocating and setting
> > > evsel ids. As there is a bounds check on the xyarray it yields a segv
> > > like:
> > >
> > > ```
> > > AddressSanitizer:DEADLYSIGNAL
> > >
> > > =================================================================
> > >
> > > ==484408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010
> > >
> > > ==484408==The signal is caused by a WRITE memory access.
> > >
> > > ==484408==Hint: address points to the zero page.
> > >
> > >     #0 0x55cef5d4eff4 in perf_evlist__id_hash tools/lib/perf/evlist.c:256
> > >     #1 0x55cef5d4f132 in perf_evlist__id_add tools/lib/perf/evlist.c:274
> > >     #2 0x55cef5d4f545 in perf_evlist__id_add_fd tools/lib/perf/evlistc:315
> > >     #3 0x55cef5a1923f in store_evsel_ids util/evsel.c:3130
> > >     #4 0x55cef5a19400 in evsel__store_ids util/evsel.c:3147
> > >     #5 0x55cef5888204 in __run_perf_stat tools/perf/builtin-stat.c:832
> > >     #6 0x55cef5888c06 in run_perf_stat tools/perf/builtin-stat.c:960
> > >     #7 0x55cef58932db in cmd_stat tools/perf/builtin-stat.c:2878
> > > ...
> > > ```
> > >
> > > Avoid this crash by early exiting the perf_evlist__id_add_fd and
> > > perf_evlist__id_add is the access is out-of-bounds.
> > >
> > > Signed-off-by: Ian Rogers <irogers@...gle.com>
> >
> > While I'm ok with this change, the real fix would be changing
> > evsel_store__ids() to use xyarray__max_{x,y} for fd instead
> > of cpu and thread map numbers.
>
> So I'm not sure on how to code that fix. Could you take over looking
> at this? It reproduces for me with "perf test -v -p" when built with
> "-fsanitize=address".

Ok, but now I think that the fd array should have the same dimension
with the id array.  I'm not sure where it can change but I'll take a look
later.  Let's apply this one first.

Thanks,
Namhyung