diff mbox

[42/53] perf record: Prevent reading invalid data in record__mmap_read

Message ID 1452520124-2073-43-git-send-email-wangnan0@huawei.com
State Not Applicable, archived
Delegated to: David Miller
Headers show

Commit Message

Wangnan (F) Jan. 11, 2016, 1:48 p.m. UTC
When record__mmap_read() require data more than the size of ring
buffer, drop those data to avoid access invalid memory.

This can happen when reading from overwritable ring buffer, which
should be avoided. However, check this for robustness.

Signed-off-by: Wang Nan <wangnan0@huawei.com>
Signed-off-by: He Kuang <hekuang@huawei.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Zefan Li <lizefan@huawei.com>
Cc: pi3orama@163.com
---
 tools/perf/builtin-record.c | 8 ++++++++
 1 file changed, 8 insertions(+)

Comments

Sergei Shtylyov Jan. 11, 2016, 2:21 p.m. UTC | #1
Hello.

On 01/11/2016 04:48 PM, Wang Nan wrote:

> When record__mmap_read() require data more than the size of ring
> buffer, drop those data to avoid access invalid memory.
>
> This can happen when reading from overwritable ring buffer, which
> should be avoided. However, check this for robustness.
>
> Signed-off-by: Wang Nan <wangnan0@huawei.com>
> Signed-off-by: He Kuang <hekuang@huawei.com>
> Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
> Cc: Jiri Olsa <jolsa@kernel.org>
> Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Cc: Zefan Li <lizefan@huawei.com>
> Cc: pi3orama@163.com
> ---
>   tools/perf/builtin-record.c | 8 ++++++++
>   1 file changed, 8 insertions(+)
>
> diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
> index b65b41f..3f58426 100644
> --- a/tools/perf/builtin-record.c
> +++ b/tools/perf/builtin-record.c
> @@ -37,6 +37,7 @@
>   #include <unistd.h>
>   #include <sched.h>
>   #include <sys/mman.h>
> +#include <asm/bug.h>
>
>
>   struct record {
> @@ -94,6 +95,13 @@ static int record__mmap_read(struct record *rec, int idx)
>   	rec->samples++;
>
>   	size = head - old;
> +	if (size > (unsigned long)(md->mask) + 1) {
> +		WARN_ONCE(1, "WARNING: failed to keep up with mmap data. (warn only once)\n");

    WARNING is already printed by WARN*(), no?

[...]

MBR, Sergei
Arnaldo Carvalho de Melo Jan. 11, 2016, 3 p.m. UTC | #2
Em Mon, Jan 11, 2016 at 05:21:44PM +0300, Sergei Shtylyov escreveu:
> On 01/11/2016 04:48 PM, Wang Nan wrote:
> >  	size = head - old;
> >+	if (size > (unsigned long)(md->mask) + 1) {
> >+		WARN_ONCE(1, "WARNING: failed to keep up with mmap data. (warn only once)\n");
> 
>    WARNING is already printed by WARN*(), no?

No, at least not in tools/include/asm/bug.h, perhaps include/asm/bug.h
has this now and tools/ drifted? Checking now...

- Arnaldo
Arnaldo Carvalho de Melo Jan. 11, 2016, 3:01 p.m. UTC | #3
Em Mon, Jan 11, 2016 at 01:00:07PM -0200, Arnaldo Carvalho de Melo escreveu:
> Em Mon, Jan 11, 2016 at 05:21:44PM +0300, Sergei Shtylyov escreveu:
> > On 01/11/2016 04:48 PM, Wang Nan wrote:
> > >  	size = head - old;
> > >+	if (size > (unsigned long)(md->mask) + 1) {
> > >+		WARN_ONCE(1, "WARNING: failed to keep up with mmap data. (warn only once)\n");
> > 
> >    WARNING is already printed by WARN*(), no?
> 
> No, at least not in tools/include/asm/bug.h, perhaps include/asm/bug.h
> has this now and tools/ drifted? Checking now...

Indeed, need to bring it closer together again...

- Arnaldo
diff mbox

Patch

diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index b65b41f..3f58426 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -37,6 +37,7 @@ 
 #include <unistd.h>
 #include <sched.h>
 #include <sys/mman.h>
+#include <asm/bug.h>
 
 
 struct record {
@@ -94,6 +95,13 @@  static int record__mmap_read(struct record *rec, int idx)
 	rec->samples++;
 
 	size = head - old;
+	if (size > (unsigned long)(md->mask) + 1) {
+		WARN_ONCE(1, "WARNING: failed to keep up with mmap data. (warn only once)\n");
+
+		md->prev = head;
+		perf_evlist__mmap_consume(rec->evlist, idx);
+		return 0;
+	}
 
 	if ((old & md->mask) + size != (head & md->mask)) {
 		buf = &data[old & md->mask];