Messages in this thread Patch in this message | | | From | Stephane Eranian <> | Subject | [PATCH v2] perf ordered_events: fix crash in free_dup_event() | Date | Wed, 8 Aug 2018 15:33:20 -0700 |
| |
This patch fixes a bug in ordered_event.c:alloc_event(). An ordered_event struct was not initialized properly potentially causing crashes later on in free_dup_event() depending on the content of the memory. If it was NULL, then it would work fine, otherwise, it could cause crashes such as:
$ perf record -o - -e cycles date | perf inject -b -i - >/dev/null Tue Aug 7 12:03:48 PDT 2018 [ perf record: Woken up 1 times to write data ] [ perf record: Captured and wrote 0.000 MB - ] Segmentation fault (core dumped):
(gdb) r inject -b -i - < tt >/dev/null Program received signal SIGSEGV, Segmentation fault. free_dup_event (oe=0x26a39a0, event=0xffffffff00000000) at util/ordered-events.c:85 (gdb) bt #0 free_dup_event (oe=0x26a39a0, event=0xffffffff00000000) at util/ordered-events.c:85 #1 ordered_events__free (oe=0x26a39a0) at util/ordered-events.c:310 #2 0x00000000004b5a56 in __perf_session__process_pipe_events (session=<optimized out>) at util/session.c:1753 #3 perf_session__process_events (session=<optimized out>) at util/session.c:1932 #4 0x000000000043a2eb in __cmd_inject (inject=<optimized out>) at builtin-inject.c:750 #5 cmd_inject (argc=<optimized out>, argv=<optimized out>) at builtin-inject.c:924 #6 0x000000000046b175 in run_builtin (p=0xabc640 <commands+576>, argc=4, argv=0x7fffffffe560) at perf.c:297 #7 0x000000000046b062 in handle_internal_command (argc=4, argv=0x7fffffffe560) at perf.c:349 #8 0x000000000046a5e8 in run_argv (argcp=<optimized out>, argv=<optimized out>) at perf.c:393 #9 main (argc=4, argv=0x7fffffffe560) at perf.c:531
Signed-off-by: Stephane Eranian <eranian@google.com>
--- tools/perf/util/ordered-events.c | 6 ++++++ 1 file changed, 6 insertions(+)
diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c index a90dbe5df019..95c91e5a3754 100644 --- a/tools/perf/util/ordered-events.c +++ b/tools/perf/util/ordered-events.c @@ -118,6 +118,12 @@ static struct ordered_event *alloc_event(struct ordered_events *oe, pr("alloc size %" PRIu64 "B (+%zu), max %" PRIu64 "B\n", oe->cur_alloc_size, size, oe->max_alloc_size); + /* + * must initialize event pointer of commandeered first + * entry to avoid crash in free_dup_event() due to random + * value for this field. + */ + oe->buffer->event = NULL; oe->cur_alloc_size += size; list_add(&oe->buffer->list, &oe->to_free); -- 2.18.0.597.ga71716f1ad-goog
| |