Skip to content

Commit 1947b92

Browse files
captain5050namhyung
authored andcommitted
libperf evlist: Avoid out-of-bounds access
Parallel testing appears to show a race between allocating and setting evsel ids. As there is a bounds check on the xyarray it yields a segv like: ``` AddressSanitizer:DEADLYSIGNAL ================================================================= ==484408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010 ==484408==The signal is caused by a WRITE memory access. ==484408==Hint: address points to the zero page. #0 0x55cef5d4eff4 in perf_evlist__id_hash tools/lib/perf/evlist.c:256 #1 0x55cef5d4f132 in perf_evlist__id_add tools/lib/perf/evlist.c:274 #2 0x55cef5d4f545 in perf_evlist__id_add_fd tools/lib/perf/evlist.c:315 #3 0x55cef5a1923f in store_evsel_ids util/evsel.c:3130 #4 0x55cef5a19400 in evsel__store_ids util/evsel.c:3147 #5 0x55cef5888204 in __run_perf_stat tools/perf/builtin-stat.c:832 #6 0x55cef5888c06 in run_perf_stat tools/perf/builtin-stat.c:960 #7 0x55cef58932db in cmd_stat tools/perf/builtin-stat.c:2878 ... ``` Avoid this crash by early exiting the perf_evlist__id_add_fd and perf_evlist__id_add is the access is out-of-bounds. Signed-off-by: Ian Rogers <irogers@google.com> Cc: Yang Jihong <yangjihong1@huawei.com> Signed-off-by: Namhyung Kim <namhyung@kernel.org> Link: https://lore.kernel.org/r/20240229070757.796244-1-irogers@google.com
1 parent b44d665 commit 1947b92

File tree

2 files changed

+14
-8
lines changed

2 files changed

+14
-8
lines changed

Diff for: tools/lib/perf/evlist.c

+12-6
Original file line numberDiff line numberDiff line change
@@ -248,10 +248,10 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist)
248248

249249
static void perf_evlist__id_hash(struct perf_evlist *evlist,
250250
struct perf_evsel *evsel,
251-
int cpu, int thread, u64 id)
251+
int cpu_map_idx, int thread, u64 id)
252252
{
253253
int hash;
254-
struct perf_sample_id *sid = SID(evsel, cpu, thread);
254+
struct perf_sample_id *sid = SID(evsel, cpu_map_idx, thread);
255255

256256
sid->id = id;
257257
sid->evsel = evsel;
@@ -269,21 +269,27 @@ void perf_evlist__reset_id_hash(struct perf_evlist *evlist)
269269

270270
void perf_evlist__id_add(struct perf_evlist *evlist,
271271
struct perf_evsel *evsel,
272-
int cpu, int thread, u64 id)
272+
int cpu_map_idx, int thread, u64 id)
273273
{
274-
perf_evlist__id_hash(evlist, evsel, cpu, thread, id);
274+
if (!SID(evsel, cpu_map_idx, thread))
275+
return;
276+
277+
perf_evlist__id_hash(evlist, evsel, cpu_map_idx, thread, id);
275278
evsel->id[evsel->ids++] = id;
276279
}
277280

278281
int perf_evlist__id_add_fd(struct perf_evlist *evlist,
279282
struct perf_evsel *evsel,
280-
int cpu, int thread, int fd)
283+
int cpu_map_idx, int thread, int fd)
281284
{
282285
u64 read_data[4] = { 0, };
283286
int id_idx = 1; /* The first entry is the counter value */
284287
u64 id;
285288
int ret;
286289

290+
if (!SID(evsel, cpu_map_idx, thread))
291+
return -1;
292+
287293
ret = ioctl(fd, PERF_EVENT_IOC_ID, &id);
288294
if (!ret)
289295
goto add;
@@ -312,7 +318,7 @@ int perf_evlist__id_add_fd(struct perf_evlist *evlist,
312318
id = read_data[id_idx];
313319

314320
add:
315-
perf_evlist__id_add(evlist, evsel, cpu, thread, id);
321+
perf_evlist__id_add(evlist, evsel, cpu_map_idx, thread, id);
316322
return 0;
317323
}
318324

Diff for: tools/lib/perf/include/internal/evlist.h

+2-2
Original file line numberDiff line numberDiff line change
@@ -126,11 +126,11 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist);
126126

127127
void perf_evlist__id_add(struct perf_evlist *evlist,
128128
struct perf_evsel *evsel,
129-
int cpu, int thread, u64 id);
129+
int cpu_map_idx, int thread, u64 id);
130130

131131
int perf_evlist__id_add_fd(struct perf_evlist *evlist,
132132
struct perf_evsel *evsel,
133-
int cpu, int thread, int fd);
133+
int cpu_map_idx, int thread, int fd);
134134

135135
void perf_evlist__reset_id_hash(struct perf_evlist *evlist);
136136

0 commit comments

Comments
 (0)