Messages in this thread | | | From | Namhyung Kim <> | Date | Thu, 29 Feb 2024 17:58:09 -0800 | Subject | Re: [PATCH v1] libperf evlist: Avoid out-of-bounds access |
| |
On Thu, Feb 29, 2024 at 5:06 PM Ian Rogers <irogers@google.com> wrote: > > On Thu, Feb 29, 2024 at 1:46 PM Namhyung Kim <namhyung@kernel.org> wrote: > > > > On Wed, Feb 28, 2024 at 11:08 PM Ian Rogers <irogers@google.com> wrote: > > > > > > Parallel testing appears to show a race between allocating and setting > > > evsel ids. As there is a bounds check on the xyarray it yields a segv > > > like: > > > > > > ``` > > > AddressSanitizer:DEADLYSIGNAL > > > > > > ================================================================= > > > > > > ==484408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 > > > > > > ==484408==The signal is caused by a WRITE memory access. > > > > > > ==484408==Hint: address points to the zero page. > > > > > > #0 0x55cef5d4eff4 in perf_evlist__id_hash tools/lib/perf/evlist.c:256 > > > #1 0x55cef5d4f132 in perf_evlist__id_add tools/lib/perf/evlist.c:274 > > > #2 0x55cef5d4f545 in perf_evlist__id_add_fd tools/lib/perf/evlistc:315 > > > #3 0x55cef5a1923f in store_evsel_ids util/evsel.c:3130 > > > #4 0x55cef5a19400 in evsel__store_ids util/evsel.c:3147 > > > #5 0x55cef5888204 in __run_perf_stat tools/perf/builtin-stat.c:832 > > > #6 0x55cef5888c06 in run_perf_stat tools/perf/builtin-stat.c:960 > > > #7 0x55cef58932db in cmd_stat tools/perf/builtin-stat.c:2878 > > > ... > > > ``` > > > > > > Avoid this crash by early exiting the perf_evlist__id_add_fd and > > > perf_evlist__id_add is the access is out-of-bounds. > > > > > > Signed-off-by: Ian Rogers <irogers@google.com> > > > > While I'm ok with this change, the real fix would be changing > > evsel_store__ids() to use xyarray__max_{x,y} for fd instead > > of cpu and thread map numbers. > > So I'm not sure on how to code that fix. Could you take over looking > at this? It reproduces for me with "perf test -v -p" when built with > "-fsanitize=address".
Ok, but now I think that the fd array should have the same dimension with the id array. I'm not sure where it can change but I'll take a look later. Let's apply this one first.
Thanks, Namhyung
| |