Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

libperf evlist: Avoid out-of-bounds access

Parallel testing appears to show a race between allocating and setting
evsel ids. As there is a bounds check on the xyarray it yields a segv
like:

```
AddressSanitizer:DEADLYSIGNAL

=================================================================

==484408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010

==484408==The signal is caused by a WRITE memory access.

==484408==Hint: address points to the zero page.

#0 0x55cef5d4eff4 in perf_evlist__id_hash tools/lib/perf/evlist.c:256
#1 0x55cef5d4f132 in perf_evlist__id_add tools/lib/perf/evlist.c:274
#2 0x55cef5d4f545 in perf_evlist__id_add_fd tools/lib/perf/evlist.c:315
#3 0x55cef5a1923f in store_evsel_ids util/evsel.c:3130
#4 0x55cef5a19400 in evsel__store_ids util/evsel.c:3147
#5 0x55cef5888204 in __run_perf_stat tools/perf/builtin-stat.c:832
#6 0x55cef5888c06 in run_perf_stat tools/perf/builtin-stat.c:960
#7 0x55cef58932db in cmd_stat tools/perf/builtin-stat.c:2878
...
```

Avoid this crash by early exiting the perf_evlist__id_add_fd and
perf_evlist__id_add is the access is out-of-bounds.

Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Yang Jihong <yangjihong1@huawei.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20240229070757.796244-1-irogers@google.com

authored by

Ian Rogers and committed by
Namhyung Kim
1947b924 b44d6653

+14 -8
+12 -6
tools/lib/perf/evlist.c
··· 248 248 249 249 static void perf_evlist__id_hash(struct perf_evlist *evlist, 250 250 struct perf_evsel *evsel, 251 - int cpu, int thread, u64 id) 251 + int cpu_map_idx, int thread, u64 id) 252 252 { 253 253 int hash; 254 - struct perf_sample_id *sid = SID(evsel, cpu, thread); 254 + struct perf_sample_id *sid = SID(evsel, cpu_map_idx, thread); 255 255 256 256 sid->id = id; 257 257 sid->evsel = evsel; ··· 269 269 270 270 void perf_evlist__id_add(struct perf_evlist *evlist, 271 271 struct perf_evsel *evsel, 272 - int cpu, int thread, u64 id) 272 + int cpu_map_idx, int thread, u64 id) 273 273 { 274 - perf_evlist__id_hash(evlist, evsel, cpu, thread, id); 274 + if (!SID(evsel, cpu_map_idx, thread)) 275 + return; 276 + 277 + perf_evlist__id_hash(evlist, evsel, cpu_map_idx, thread, id); 275 278 evsel->id[evsel->ids++] = id; 276 279 } 277 280 278 281 int perf_evlist__id_add_fd(struct perf_evlist *evlist, 279 282 struct perf_evsel *evsel, 280 - int cpu, int thread, int fd) 283 + int cpu_map_idx, int thread, int fd) 281 284 { 282 285 u64 read_data[4] = { 0, }; 283 286 int id_idx = 1; /* The first entry is the counter value */ 284 287 u64 id; 285 288 int ret; 289 + 290 + if (!SID(evsel, cpu_map_idx, thread)) 291 + return -1; 286 292 287 293 ret = ioctl(fd, PERF_EVENT_IOC_ID, &id); 288 294 if (!ret) ··· 318 312 id = read_data[id_idx]; 319 313 320 314 add: 321 - perf_evlist__id_add(evlist, evsel, cpu, thread, id); 315 + perf_evlist__id_add(evlist, evsel, cpu_map_idx, thread, id); 322 316 return 0; 323 317 } 324 318
+2 -2
tools/lib/perf/include/internal/evlist.h
··· 126 126 127 127 void perf_evlist__id_add(struct perf_evlist *evlist, 128 128 struct perf_evsel *evsel, 129 - int cpu, int thread, u64 id); 129 + int cpu_map_idx, int thread, u64 id); 130 130 131 131 int perf_evlist__id_add_fd(struct perf_evlist *evlist, 132 132 struct perf_evsel *evsel, 133 - int cpu, int thread, int fd); 133 + int cpu_map_idx, int thread, int fd); 134 134 135 135 void perf_evlist__reset_id_hash(struct perf_evlist *evlist); 136 136