Commit e2511d60 authored by Ian Rogers's avatar Ian Rogers Committed by sanglipeng1
Browse files

libperf evlist: Avoid out-of-bounds access 

stable inclusion
from stable-v5.10.215
commit d2341dc41a9632a797a01dd1a4b2fc1da0acc40a
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAJJ2D

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=d2341dc41a9632a797a01dd1a4b2fc1da0acc40a



--------------------------------

[ Upstream commit 1947b92464c3268381604bbe2ac977a3fd78192f ]

Parallel testing appears to show a race between allocating and setting
evsel ids. As there is a bounds check on the xyarray it yields a segv
like:

```
AddressSanitizer:DEADLYSIGNAL

=================================================================

==484408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010

==484408==The signal is caused by a WRITE memory access.

==484408==Hint: address points to the zero page.

    #0 0x55cef5d4eff4 in perf_evlist__id_hash tools/lib/perf/evlist.c:256
    #1 0x55cef5d4f132 in perf_evlist__id_add tools/lib/perf/evlist.c:274
    #2 0x55cef5d4f545 in perf_evlist__id_add_fd tools/lib/perf/evlist.c:315
    #3 0x55cef5a1923f in store_evsel_ids util/evsel.c:3130
    #4 0x55cef5a19400 in evsel__store_ids util/evsel.c:3147
    #5 0x55cef5888204 in __run_perf_stat tools/perf/builtin-stat.c:832
    #6 0x55cef5888c06 in run_perf_stat tools/perf/builtin-stat.c:960
    #7 0x55cef58932db in cmd_stat tools/perf/builtin-stat.c:2878
...
```

Avoid this crash by early exiting the perf_evlist__id_add_fd and
perf_evlist__id_add is the access is out-of-bounds.

Signed-off-by: default avatarIan Rogers <irogers@google.com>
Cc: Yang Jihong <yangjihong1@huawei.com>
Signed-off-by: default avatarNamhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20240229070757.796244-1-irogers@google.com


Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarsanglipeng1 <sanglipeng1@jd.com>
parent 9b81df5e

tools/lib/perf/evlist.c

+12 −6
Original line number Diff line number Diff line
@@ -226,10 +226,10 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist) 


static void perf_evlist__id_hash(struct perf_evlist *evlist,

				 struct perf_evsel *evsel,

				 int cpu, int thread, u64 id)

				 int cpu_map_idx, int thread, u64 id)

{

	int hash;

	struct perf_sample_id *sid = SID(evsel, cpu, thread);

	struct perf_sample_id *sid = SID(evsel, cpu_map_idx, thread);



	sid->id = id;

	sid->evsel = evsel;
@@ -239,21 +239,27 @@ static void perf_evlist__id_hash(struct perf_evlist *evlist, 


void perf_evlist__id_add(struct perf_evlist *evlist,

			 struct perf_evsel *evsel,

			 int cpu, int thread, u64 id)

			 int cpu_map_idx, int thread, u64 id)

{

	perf_evlist__id_hash(evlist, evsel, cpu, thread, id);

	if (!SID(evsel, cpu_map_idx, thread))

		return;



	perf_evlist__id_hash(evlist, evsel, cpu_map_idx, thread, id);

	evsel->id[evsel->ids++] = id;

}



int perf_evlist__id_add_fd(struct perf_evlist *evlist,

			   struct perf_evsel *evsel,

			   int cpu, int thread, int fd)

			   int cpu_map_idx, int thread, int fd)

{

	u64 read_data[4] = { 0, };

	int id_idx = 1; /* The first entry is the counter value */

	u64 id;

	int ret;



	if (!SID(evsel, cpu_map_idx, thread))

		return -1;



	ret = ioctl(fd, PERF_EVENT_IOC_ID, &id);

	if (!ret)

		goto add;
@@ -282,7 +288,7 @@ int perf_evlist__id_add_fd(struct perf_evlist *evlist, 
	id = read_data[id_idx];



add:

	perf_evlist__id_add(evlist, evsel, cpu, thread, id);

	perf_evlist__id_add(evlist, evsel, cpu_map_idx, thread, id);

	return 0;

}

tools/lib/perf/include/internal/evlist.h

+2 −2
Original line number Diff line number Diff line
@@ -119,10 +119,10 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist); 


void perf_evlist__id_add(struct perf_evlist *evlist,

			 struct perf_evsel *evsel,

			 int cpu, int thread, u64 id);

			 int cpu_map_idx, int thread, u64 id);



int perf_evlist__id_add_fd(struct perf_evlist *evlist,

			   struct perf_evsel *evsel,

			   int cpu, int thread, int fd);

			   int cpu_map_idx, int thread, int fd);



#endif /* __LIBPERF_INTERNAL_EVLIST_H */