lkml.org 
[lkml]   [2015]   [May]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 05/37] perf session: Fix perf_session__peek_event()
    Date
    From: Adrian Hunter <adrian.hunter@intel.com>

    perf_session__peek_event() generally leverages there being a single mmap
    of the perf.data file, however on 32-bit platforms when there is more
    that 32MiB of data, then there are multiple mmaps, so
    perf_session__peek_event() reads from the file.

    In that case a couple of bugs were exposed (note how the seg. fault
    appears with >32M of data):

    $ perf record --per-thread -e intel_bts// ../rtit-tests/loopy 1000000
    [ perf record: Woken up 13 times to write data ]
    [ perf record: Captured and wrote 24.568 MB perf.data ]
    $ perf script > /dev/null
    $ perf record --per-thread -e intel_bts// ../rtit-tests/loopy 10000000
    [ perf record: Woken up 136 times to write data ]
    [ perf record: Captured and wrote 270.794 MB perf.data ]
    $ perf script > /dev/null
    Segmentation fault (core dumped)

    The wrong address was being passed to the readn() function and the
    buffer size was not being checked.

    Signed-off-by: Adrian Hunter <adrian.hunter@intel.com>
    Cc: Jiri Olsa <jolsa@redhat.com>
    Cc: Namhyung Kim <namhyung@gmail.com>
    Link: http://lkml.kernel.org/r/1432040746-1755-5-git-send-email-adrian.hunter@intel.com
    Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
    ---
    tools/perf/util/session.c | 6 +++---
    1 file changed, 3 insertions(+), 3 deletions(-)

    diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
    index e722107f932a..39fe09d5a87e 100644
    --- a/tools/perf/util/session.c
    +++ b/tools/perf/util/session.c
    @@ -1182,7 +1182,7 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
    return -1;

    if (lseek(fd, file_offset, SEEK_SET) == (off_t)-1 ||
    - readn(fd, &buf, hdr_sz) != (ssize_t)hdr_sz)
    + readn(fd, buf, hdr_sz) != (ssize_t)hdr_sz)
    return -1;

    event = (union perf_event *)buf;
    @@ -1190,12 +1190,12 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
    if (session->header.needs_swap)
    perf_event_header__bswap(&event->header);

    - if (event->header.size < hdr_sz)
    + if (event->header.size < hdr_sz || event->header.size > buf_sz)
    return -1;

    rest = event->header.size - hdr_sz;

    - if (readn(fd, &buf, rest) != (ssize_t)rest)
    + if (readn(fd, buf, rest) != (ssize_t)rest)
    return -1;

    if (session->header.needs_swap)
    --
    2.1.0


    \
     
     \ /
      Last update: 2015-05-26 19:21    [W:4.155 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site