| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <20160111154202.GE18367@kernel.org>
Date: Mon, 11 Jan 2016 12:42:02 -0300
From: Arnaldo Carvalho de Melo <acme@...nel.org>
To: Wang Nan <wangnan0@...wei.com>
Cc: linux-kernel@...r.kernel.org, pi3orama@....com, lizefan@...wei.com,
netdev@...r.kernel.org, davem@...emloft.net,
Jiri Olsa <jolsa@...nel.org>,
Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>,
Namhyung Kim <namhyung@...nel.org>
Subject: Re: [PATCH 13/53] perf tools: Prevent calling machine__delete() on
non-allocated machine
Em Mon, Jan 11, 2016 at 01:48:04PM +0000, Wang Nan escreveu:
> To prevent futher commits calling machine__delete() on non-allocated
> 'struct machine' (which would cause memory corruption), this patch
> enforces machine__init(), record whether a machine structure is
> dynamically allocated or not, and warn if machine__delete() is called
> on incorrect object.
Not sure on this one, I think I voiced this before, this seems like
something to be tested using some static analysis tool or even checking
if the address for the struct hitting machine__delete() is from malloc
or not.
I.e. if we do it here, we may have to do it to any other struct where we
allocate it in the stack or via malloc, and furthermore there are cases
where we embed a struct in another, when we would free just the main
struct but not the second, embedded one, that would need just calling
foo__exit() and not foo__delete().
- Arnaldo
> Signed-off-by: Wang Nan <wangnan0@...wei.com>
> Reviewed-by: Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
> Cc: Arnaldo Carvalho de Melo <acme@...hat.com>
> Cc: Jiri Olsa <jolsa@...nel.org>
> Cc: Masami Hiramatsu <masami.hiramatsu.pt@...achi.com>
> Cc: Namhyung Kim <namhyung@...nel.org>
> ---
> tools/perf/tests/vmlinux-kallsyms.c | 4 ++--
> tools/perf/util/machine.c | 13 ++++++++-----
> tools/perf/util/machine.h | 3 ++-
> 3 files changed, 12 insertions(+), 8 deletions(-)
>
> diff --git a/tools/perf/tests/vmlinux-kallsyms.c b/tools/perf/tests/vmlinux-kallsyms.c
> index f0bfc9e..441e93d 100644
> --- a/tools/perf/tests/vmlinux-kallsyms.c
> +++ b/tools/perf/tests/vmlinux-kallsyms.c
> @@ -35,8 +35,8 @@ int test__vmlinux_matches_kallsyms(int subtest __maybe_unused)
> * Init the machines that will hold kernel, modules obtained from
> * both vmlinux + .ko files and from /proc/kallsyms split by modules.
> */
> - machine__init(&kallsyms, "", HOST_KERNEL_ID);
> - machine__init(&vmlinux, "", HOST_KERNEL_ID);
> + machine__init(&kallsyms, "", HOST_KERNEL_ID, false);
> + machine__init(&vmlinux, "", HOST_KERNEL_ID, false);
>
> /*
> * Step 2:
> diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
> index ad79297..59a3c01 100644
> --- a/tools/perf/util/machine.c
> +++ b/tools/perf/util/machine.c
> @@ -1,3 +1,4 @@
> +#include <asm/bug.h>
> #include "callchain.h"
> #include "debug.h"
> #include "event.h"
> @@ -23,7 +24,7 @@ static void dsos__init(struct dsos *dsos)
> pthread_rwlock_init(&dsos->lock, NULL);
> }
>
> -int machine__init(struct machine *machine, const char *root_dir, pid_t pid)
> +int machine__init(struct machine *machine, const char *root_dir, pid_t pid, bool allocated)
> {
> memset(machine, 0, sizeof(*machine));
> map_groups__init(&machine->kmaps, machine);
> @@ -65,6 +66,7 @@ int machine__init(struct machine *machine, const char *root_dir, pid_t pid)
> }
>
> machine->current_tid = NULL;
> + machine->allocated = allocated;
>
> return 0;
> }
> @@ -74,7 +76,7 @@ struct machine *machine__new_host(void)
> struct machine *machine = malloc(sizeof(*machine));
>
> if (machine != NULL) {
> - machine__init(machine, "", HOST_KERNEL_ID);
> + machine__init(machine, "", HOST_KERNEL_ID, true);
>
> if (machine__create_kernel_maps(machine) < 0)
> goto out_delete;
> @@ -137,12 +139,13 @@ void machine__exit(struct machine *machine)
> void machine__delete(struct machine *machine)
> {
> machine__exit(machine);
> - free(machine);
> + WARN_ONCE((machine->allocated ? free(machine), 0 : -1),
> + "WARNING: deleting a non-allocated machine. Skip.\n");
> }
>
> void machines__init(struct machines *machines)
> {
> - machine__init(&machines->host, "", HOST_KERNEL_ID);
> + machine__init(&machines->host, "", HOST_KERNEL_ID, false);
> machines->guests = RB_ROOT;
> machines->symbol_filter = NULL;
> }
> @@ -163,7 +166,7 @@ struct machine *machines__add(struct machines *machines, pid_t pid,
> if (machine == NULL)
> return NULL;
>
> - if (machine__init(machine, root_dir, pid) != 0) {
> + if (machine__init(machine, root_dir, pid, true) != 0) {
> free(machine);
> return NULL;
> }
> diff --git a/tools/perf/util/machine.h b/tools/perf/util/machine.h
> index 2c2b443..24dfd46 100644
> --- a/tools/perf/util/machine.h
> +++ b/tools/perf/util/machine.h
> @@ -28,6 +28,7 @@ struct machine {
> pid_t pid;
> u16 id_hdr_size;
> bool comm_exec;
> + bool allocated;
> char *root_dir;
> struct rb_root threads;
> pthread_rwlock_t threads_lock;
> @@ -131,7 +132,7 @@ void machines__set_symbol_filter(struct machines *machines,
> void machines__set_comm_exec(struct machines *machines, bool comm_exec);
>
> struct machine *machine__new_host(void);
> -int machine__init(struct machine *machine, const char *root_dir, pid_t pid);
> +int machine__init(struct machine *machine, const char *root_dir, pid_t pid, bool allocated);
> void machine__exit(struct machine *machine);
> void machine__delete_threads(struct machine *machine);
> void machine__delete(struct machine *machine);
> --
> 1.8.3.4
Powered by blists - more mailing lists