linux-kernel - Re: [PATCH v1] perf trace: Fix runtime error of index out of bounds

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-Id: <173809172358.948154.8877116739875725727.b4-ty@kernel.org>
Date: Tue, 28 Jan 2025 11:15:23 -0800
From: Namhyung Kim <namhyung@...nel.org>
To: acme@...nel.org, Howard Chu <howardchu95@...il.com>
Cc: jolsa@...nel.org, irogers@...gle.com, adrian.hunter@...el.com, 
 linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] perf trace: Fix runtime error of index out of
 bounds

On Tue, 21 Jan 2025 18:55:19 -0800, Howard Chu wrote:
> libtraceevent parses and returns an array of argument fields, sometimes
> larger than RAW_SYSCALL_ARGS_NUM (6) because it includes "__syscall_nr",
> idx will traverse to index 6 (7th element) whereas sc->fmt->arg holds 6
> elements max, creating an out-of-bounds access. This runtime error is
> found by UBsan. The error message:
> 
> perf $ sudo UBSAN_OPTIONS=print_stacktrace=1 ./perf trace -a --max-events=1
> builtin-trace.c:1966:35: runtime error: index 6 out of bounds for type 'syscall_arg_fmt [6]'
>     #0 0x5c04956be5fe in syscall__alloc_arg_fmts /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:1966
>     #1 0x5c04956c0510 in trace__read_syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2110
>     #2 0x5c04956c372b in trace__syscall_info /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:2436
>     #3 0x5c04956d2f39 in trace__init_syscalls_bpf_prog_array_maps /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:3897
>     #4 0x5c04956d6d25 in trace__run /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:4335
>     #5 0x5c04956e112e in cmd_trace /home/howard/hw/linux-perf/tools/perf/builtin-trace.c:5502
>     #6 0x5c04956eda7d in run_builtin /home/howard/hw/linux-perf/tools/perf/perf.c:351
>     #7 0x5c04956ee0a8 in handle_internal_command /home/howard/hw/linux-perf/tools/perf/perf.c:404
>     #8 0x5c04956ee37f in run_argv /home/howard/hw/linux-perf/tools/perf/perf.c:448
>     #9 0x5c04956ee8e9 in main /home/howard/hw/linux-perf/tools/perf/perf.c:556
>     #10 0x79eb3622a3b7 in __libc_start_call_main ../sysdeps/nptl/libc_start_call_main.h:58
>     #11 0x79eb3622a47a in __libc_start_main_impl ../csu/libc-start.c:360
>     #12 0x5c04955422d4 in _start (/home/howard/hw/linux-perf/tools/perf/perf+0x4e02d4) (BuildId: 5b6cab2d59e96a4341741765ad6914a4d784dbc6)
> 
> [...]
Applied to perf-tools, thanks!

Best regards,
Namhyung