lkml.org 
[lkml]   [2012]   [Feb]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
Patch in this message
/
Date
From
Subject[PATCH v2] perf tools: fix piped mode read code

In __perf_session__process_pipe_events(), there is a risk
we could read more than what a union perf_event struct can
hold. This could happen when perf is reading a file which
contains new and unknown record types which are larger than
anything the tool already knows about (i.e. part of union
perf_event).

In general, perf is supposed to skip records it does not
understand, but in pipe mode, those have to be read and
ignored. They cannot just be skipped. In the current code,
the backing for the read is provided by union perf_event.
There is no check for the size limit thus there is a risk
of buffer overrun:

union perf_event event;
void *p;

size = event->header.size;

p = &event;
p += sizeof(struct perf_event_header);
if (size - sizeof(struct perf_event_header)) {
err = readn(self->fd, p, size - sizeof(struct perf_event_header));

We fix this by allocating a buffer based on the size reported in
the header. We reuse the buffer as much as we can. We realloc in
case it becomes too small. In the common case, the performance
impact is negligible.

In version 2, we fixed the potential memory leak introduced by
the realloc() statement in case of error.

Signed-off-by: Stephane Eranian <eranian@google.com>
---

diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index 9f833cf..ecaf541 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -982,8 +982,9 @@ volatile int session_done;
static int __perf_session__process_pipe_events(struct perf_session *self,
struct perf_tool *tool)
{
- union perf_event event;
- uint32_t size;
+ union perf_event *event;
+ uint32_t size, cur_size = 0;
+ void *buf = NULL;
int skip = 0;
u64 head;
int err;
@@ -992,8 +993,14 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
perf_tool__fill_defaults(tool);

head = 0;
+ cur_size = sizeof(union perf_event);
+
+ buf = malloc(cur_size);
+ if (!buf)
+ return -errno;
more:
- err = readn(self->fd, &event, sizeof(struct perf_event_header));
+ event = buf;
+ err = readn(self->fd, event, sizeof(struct perf_event_header));
if (err <= 0) {
if (err == 0)
goto done;
@@ -1003,13 +1010,23 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
}

if (self->header.needs_swap)
- perf_event_header__bswap(&event.header);
+ perf_event_header__bswap(&event->header);

- size = event.header.size;
+ size = event->header.size;
if (size == 0)
size = 8;

- p = &event;
+ if (size > cur_size) {
+ void *new = realloc(buf, size);
+ if (!new) {
+ pr_err("failed to allocate memory to read event\n");
+ goto out_err;
+ }
+ buf = new;
+ cur_size = size;
+ event = buf;
+ }
+ p = event;
p += sizeof(struct perf_event_header);

if (size - sizeof(struct perf_event_header)) {
@@ -1025,9 +1042,9 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
}
}

- if ((skip = perf_session__process_event(self, &event, tool, head)) < 0) {
+ if ((skip = perf_session__process_event(self, event, tool, head)) < 0) {
dump_printf("%#" PRIx64 " [%#x]: skipping unknown header type: %d\n",
- head, event.header.size, event.header.type);
+ head, event->header.size, event->header.type);
/*
* assume we lost track of the stream, check alignment, and
* increment a single u64 in the hope to catch on again 'soon'.
@@ -1048,6 +1065,7 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
done:
err = 0;
out_err:
+ free(buf);
perf_session__warn_about_errors(self, tool);
perf_session_free_sample_buffers(self);
return err;

\
 
 \ /
  Last update: 2012-02-27 10:05    [W:0.028 / U:0.676 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site