queue-6.8/libperf-evlist-avoid-out-of-bounds-access.patch

   1 From 50e843a43413c4d728a4103e1310f79e51cfa923 Mon Sep 17 00:00:00 2001
   2 From: Sasha Levin <sashal@kernel.org>
   3 Date: Wed, 28 Feb 2024 23:07:57 -0800
   4 Subject: libperf evlist: Avoid out-of-bounds access
   5
   6 From: Ian Rogers <irogers@google.com>
   7
   8 [ Upstream commit 1947b92464c3268381604bbe2ac977a3fd78192f ]
   9
  10 Parallel testing appears to show a race between allocating and setting
  11 evsel ids. As there is a bounds check on the xyarray it yields a segv
  12 like:
  13
  14 ```
  15 AddressSanitizer:DEADLYSIGNAL
  16
  17 =================================================================
  18
  19 ==484408==ERROR: AddressSanitizer: SEGV on unknown address 0x000000000010
  20
  21 ==484408==The signal is caused by a WRITE memory access.
  22
  23 ==484408==Hint: address points to the zero page.
  24
  25     #0 0x55cef5d4eff4 in perf_evlist__id_hash tools/lib/perf/evlist.c:256
  26     #1 0x55cef5d4f132 in perf_evlist__id_add tools/lib/perf/evlist.c:274
  27     #2 0x55cef5d4f545 in perf_evlist__id_add_fd tools/lib/perf/evlist.c:315
  28     #3 0x55cef5a1923f in store_evsel_ids util/evsel.c:3130
  29     #4 0x55cef5a19400 in evsel__store_ids util/evsel.c:3147
  30     #5 0x55cef5888204 in __run_perf_stat tools/perf/builtin-stat.c:832
  31     #6 0x55cef5888c06 in run_perf_stat tools/perf/builtin-stat.c:960
  32     #7 0x55cef58932db in cmd_stat tools/perf/builtin-stat.c:2878
  33 ...
  34 ```
  35
  36 Avoid this crash by early exiting the perf_evlist__id_add_fd and
  37 perf_evlist__id_add is the access is out-of-bounds.
  38
  39 Signed-off-by: Ian Rogers <irogers@google.com>
  40 Cc: Yang Jihong <yangjihong1@huawei.com>
  41 Signed-off-by: Namhyung Kim <namhyung@kernel.org>
  42 Link: https://lore.kernel.org/r/20240229070757.796244-1-irogers@google.com
  43 Signed-off-by: Sasha Levin <sashal@kernel.org>
  44 ---
  45  tools/lib/perf/evlist.c                  | 18 ++++++++++++------
  46  tools/lib/perf/include/internal/evlist.h |  4 ++--
  47  2 files changed, 14 insertions(+), 8 deletions(-)
  48
  49 diff --git a/tools/lib/perf/evlist.c b/tools/lib/perf/evlist.c
  50 index 058e3ff10f9b2..c6d67fc9e57ef 100644
  51 --- a/tools/lib/perf/evlist.c
  52 +++ b/tools/lib/perf/evlist.c
  53 @@ -248,10 +248,10 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist)
  54
  55  static void perf_evlist__id_hash(struct perf_evlist *evlist,
  56                                  struct perf_evsel *evsel,
  57 -                                int cpu, int thread, u64 id)
  58 +                                int cpu_map_idx, int thread, u64 id)
  59  {
  60         int hash;
  61 -       struct perf_sample_id *sid = SID(evsel, cpu, thread);
  62 +       struct perf_sample_id *sid = SID(evsel, cpu_map_idx, thread);
  63
  64         sid->id = id;
  65         sid->evsel = evsel;
  66 @@ -269,21 +269,27 @@ void perf_evlist__reset_id_hash(struct perf_evlist *evlist)
  67
  68  void perf_evlist__id_add(struct perf_evlist *evlist,
  69                          struct perf_evsel *evsel,
  70 -                        int cpu, int thread, u64 id)
  71 +                        int cpu_map_idx, int thread, u64 id)
  72  {
  73 -       perf_evlist__id_hash(evlist, evsel, cpu, thread, id);
  74 +       if (!SID(evsel, cpu_map_idx, thread))
  75 +               return;
  76 +
  77 +       perf_evlist__id_hash(evlist, evsel, cpu_map_idx, thread, id);
  78         evsel->id[evsel->ids++] = id;
  79  }
  80
  81  int perf_evlist__id_add_fd(struct perf_evlist *evlist,
  82                            struct perf_evsel *evsel,
  83 -                          int cpu, int thread, int fd)
  84 +                          int cpu_map_idx, int thread, int fd)
  85  {
  86         u64 read_data[4] = { 0, };
  87         int id_idx = 1; /* The first entry is the counter value */
  88         u64 id;
  89         int ret;
  90
  91 +       if (!SID(evsel, cpu_map_idx, thread))
  92 +               return -1;
  93 +
  94         ret = ioctl(fd, PERF_EVENT_IOC_ID, &id);
  95         if (!ret)
  96                 goto add;
  97 @@ -312,7 +318,7 @@ int perf_evlist__id_add_fd(struct perf_evlist *evlist,
  98         id = read_data[id_idx];
  99
 100  add:
 101 -       perf_evlist__id_add(evlist, evsel, cpu, thread, id);
 102 +       perf_evlist__id_add(evlist, evsel, cpu_map_idx, thread, id);
 103         return 0;
 104  }
 105
 106 diff --git a/tools/lib/perf/include/internal/evlist.h b/tools/lib/perf/include/internal/evlist.h
 107 index d86ffe8ed483e..f43bdb9b6227c 100644
 108 --- a/tools/lib/perf/include/internal/evlist.h
 109 +++ b/tools/lib/perf/include/internal/evlist.h
 110 @@ -126,11 +126,11 @@ u64 perf_evlist__read_format(struct perf_evlist *evlist);
 111
 112  void perf_evlist__id_add(struct perf_evlist *evlist,
 113                          struct perf_evsel *evsel,
 114 -                        int cpu, int thread, u64 id);
 115 +                        int cpu_map_idx, int thread, u64 id);
 116
 117  int perf_evlist__id_add_fd(struct perf_evlist *evlist,
 118                            struct perf_evsel *evsel,
 119 -                          int cpu, int thread, int fd);
 120 +                          int cpu_map_idx, int thread, int fd);
 121
 122  void perf_evlist__reset_id_hash(struct perf_evlist *evlist);
 123
 124 --
 125 2.43.0
 126