[lkml]   [2012]   [Mar]   [21]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[ 4/8] perf tools: Incorrect use of snprintf results in SEGV
    3.0-stable review patch.  If anyone has any objections, please let me know.


    From: Anton Blanchard <>

    commit b832796caa1fda8516464a003c8c7cc547bc20c2 upstream.

    I have a workload where perf top scribbles over the stack and we SEGV.
    What makes it interesting is that an snprintf is causing this.

    The workload is a c++ gem that has method names over 3000 characters
    long, but snprintf is designed to avoid overrunning buffers. So what
    went wrong?

    The problem is we assume snprintf returns the number of characters

    ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", self->level);
    ret += repsep_snprintf(bf + ret, size - ret, "%s", self->ms.sym->name);

    Unfortunately this is not how snprintf works. snprintf returns the
    number of characters that would have been written if there was enough
    space. In the above case, if the first snprintf returns a value larger
    than size, we pass a negative size into the second snprintf and happily
    scribble over the stack. If you have 3000 character c++ methods thats a
    lot of stack to trample.

    This patch fixes repsep_snprintf by clamping the value at size - 1 which
    is the maximum snprintf can write before adding the NULL terminator.

    I get the sinking feeling that there are a lot of other uses of snprintf
    that have this same bug, we should audit them all.

    Cc: David Ahern <>
    Cc: Eric B Munson <>
    Cc: Frederic Weisbecker <>
    Cc: Ingo Molnar <>
    Cc: Paul Mackerras <>
    Cc: Peter Zijlstra <>
    Cc: Yanmin Zhang <>
    Signed-off-by: Anton Blanchard <>
    Signed-off-by: Arnaldo Carvalho de Melo <>
    Signed-off-by: Greg Kroah-Hartman <>

    tools/perf/util/sort.c | 3 +++
    1 file changed, 3 insertions(+)

    --- a/tools/perf/util/sort.c
    +++ b/tools/perf/util/sort.c
    @@ -122,6 +122,9 @@ static int repsep_snprintf(char *bf, siz
    + if (n >= (int)size)
    + return size - 1;
    return n;

     \ /
      Last update: 2012-03-21 22:19    [W:0.023 / U:36.936 seconds]
    ©2003-2017 Jasper Spaans. hosted at Digital OceanAdvertise on this site