From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752573AbcDSIRS (ORCPT ); Tue, 19 Apr 2016 04:17:18 -0400 Received: from mail-am1on0138.outbound.protection.outlook.com ([157.56.112.138]:29886 "EHLO emea01-am1-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1751740AbcDSIRP (ORCPT ); Tue, 19 Apr 2016 04:17:15 -0400 Authentication-Results: kernel.org; dkim=none (message not signed) header.d=none;kernel.org; dmarc=none action=none header.from=virtuozzo.com; From: Andrey Ryabinin To: Arnaldo Carvalho de Melo , Ingo Molnar , Peter Zijlstra CC: Alexander Shishkin , , Andrey Ryabinin Subject: [PATCH] perf buildid: fix off-by-one in write_buildid() Date: Tue, 19 Apr 2016 11:17:27 +0300 Message-ID: <1461053847-5633-1-git-send-email-aryabinin@virtuozzo.com> X-Mailer: git-send-email 2.7.3 MIME-Version: 1.0 Content-Type: text/plain X-Originating-IP: [195.214.232.10] X-ClientProxiedBy: VI1PR07CA0090.eurprd07.prod.outlook.com (10.165.229.144) To DB6PR0801MB1302.eurprd08.prod.outlook.com (10.168.11.20) X-MS-Office365-Filtering-Correlation-Id: 58418ba3-6090-4671-c67f-08d3682b0165 X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1302;2:2Imyst7queYfMD0oMLaO7Qg6K17o+a1Y5vdPuuDsiPimBl9TpQqt5/ct6RELAeIDfYntzBHJDQpWezYZpSyBloCdAzfG8j4B//SorwB3MJXkAjWHQc5mmgZkc09l+G0aHG5ezUpXp7vpqdruXiyabAU5g4bhxfZXOD5ZfcNlYiBGijWkvaChw6hoU0DDybma;3:O+s6gaSp0RRdvhNhi+hJ4QX1bxhUqFnOfPOp7JaYhn1xoVGwb3omL9jWHr/RIAQTqoGUgcWxeRHNJSR5ngIdgy1Zv0J4hzOgABmxVHE3/ZqoDt2kzeja+0HeaO4x26OY X-Microsoft-Antispam: UriScan:;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0801MB1302; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1302;25:ftJlL1R2Wcp2wfwvsdDxXyLi4N2prhUqhSef8KoDumj8thgnIBuhsvsKD/N+Ew5eKuBX2vmzJG6ag77UPPSQxr6Wlry4QnQ9A721s+jTjuV/B+K8x7x/jQUwBWWh2j2GPAgnhQzddaqirICTEZEQD5ahsVgFS7ldSIISBxyoSeQmVbXrTQsjHHZmGPj/uGQCT9iPNnRXtayjKPWzcflFi0ptMsxvfXTf06ZKzLhXUrEoA1HmYLqElym/Rb/848fzToMPGkQ/HX+6ybHxyHEzhrbL7MHvxVRWByV6c5fiG5jl+N9AVxvdFzoCMgKK/97lXYICvlmS1tpqayqXcGqeKROoiixSwXpsKhVyyi0pSYu2WtxrogYTmRpDqIb0bgSmBDxpA6l8ukPt07d4tigiqMFCl2POnmBiXuMWKbSw5GnHmTaYkSjyFwVXrt7yyHhb7V6qC5CJPV55qns8O11+fQA8l3tOZxGj0IJArTXSEbemgfN/6Kk23qK4H9jF50+Q1+1vMYtOsGbsdLUjDtLXa4a02go9Nbwk6Jz145opdSzPp4fF8Eg56aLg33bfAnCuNYVVTeq8Rc/PPCA84Wcnh17hclw4w7bLm5giRDUeeS3yEeyro3CVTJ8b9ZOggprxEzXv2ah23KK5EDULMkpdQyoMIjsmwfN7JmoqxUwlr9ph6FYXtVoREI14JfYteWsw X-Microsoft-Antispam-PRVS: X-Exchange-Antispam-Report-Test: UriScan:; X-Exchange-Antispam-Report-CFA-Test: BCL:0;PCL:0;RULEID:(9101521026)(6040130)(601004)(2401047)(5005006)(8121501046)(3002001)(10201501046)(6041046)(6043046);SRVR:DB6PR0801MB1302;BCL:0;PCL:0;RULEID:;SRVR:DB6PR0801MB1302; X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1302;4:QMORLg6gEaY1TpkE0bLOt9vsngULDQD6TY0Tvc1EmTumhAT0ugbnGsbQ+uteAQG/U1ak+1oQ8T/Fu6NTQAyhAGaqcEzUkHIebRasyeh5MgHKTKHS50yHGbwLLiJAi/U6uOSrhzM4OnPS9+hRth5AQ6c9nIuLlw9U1NDQvMSapP8bZlD3f791HhTeA/jpz8Srg2rqqq3blAN4mgrlpdoxMhogAaqFAMGIFIOHdJ1Tkiqy38s8w2WyRVEnJ8nRfa+wicaFA/xevbLuLu4j8yFlLjuw4+BzsSBUHXxSj532IBG4zAD0K5FonNJ5d52auy6WIZ8x+0G2hy9FILonLY7Lsksde2Zp0YWnctuNhWjbw0hQQFZy6avsIsidCoT1lCm36gF5Va4sKgncN80seoUpNGUjxTGfwARA6gMWBnw9NqIx4buOc/5yL3B/nO9mZ7P4mpPVNy1l3hH4pW2sxdyZqA== X-Forefront-PRVS: 0917DFAC67 X-Forefront-Antispam-Report: SFV:NSPM;SFS:(10019020)(4630300001)(6069001)(6009001)(42186005)(5003940100001)(92566002)(66066001)(5008740100001)(33646002)(76506005)(86362001)(77096005)(53416004)(229853001)(81166005)(36756003)(19580405001)(4001430100002)(230783001)(5004730100002)(19580395003)(2906002)(50986999)(48376002)(50466002)(47776003)(1096002)(50226001)(5001770100001)(3846002)(189998001)(107886002)(586003)(4326007)(6116002);DIR:OUT;SFP:1102;SCL:1;SRVR:DB6PR0801MB1302;H:localhost.sw.ru;FPR:;SPF:None;MLV:sfv;LANG:en; X-Microsoft-Exchange-Diagnostics: =?us-ascii?Q?1;DB6PR0801MB1302;23:rHAwk6Lhss1Q2dehhfXkqP5kAThH3Rm8TD24Wx5?= =?us-ascii?Q?/pPu054kAqF+GENjxjM4PCo7a4zVldCog95b0Ay+GEB8XP1N+9gHPPIjgcxL?= =?us-ascii?Q?vLkYd7g4gDu/yCCS1Jwahfly7Z7imkxJ8KXufopD5WWuM8v5u3bnlT4FKYst?= =?us-ascii?Q?rXUTHLI+2XOARBGUzMS5zxcF1Ebfk7TFBdcaqtKFrkbCgq0SLTHCbUfa4j8y?= =?us-ascii?Q?Fv4m4+QcbSMixgbuy+2apXJyyoSjd4SQ9sVSsWe7tzhTy+g13MG2MnFswlRu?= =?us-ascii?Q?1WoF6xYQVFz6zuv8cTAqN6bjZXU2ZbtMxo6XXg0xJioB+M59MvbfMCBImmuu?= =?us-ascii?Q?9oqDaFBC0SO/rRHfdLH+MqJ4AHMq9gLK120xBN9ZNGdvy1reE+shShEivI/8?= =?us-ascii?Q?tRzHCR8Wr+ltIGK99N2LmUAvKoC1lcqY2sJ+reIGKew1QoCdzPbXqiO1NwW4?= =?us-ascii?Q?vHDj6uSgcDnkRvMnDD9CpsWJfdDlS5LE+nYZLePbzbDNVXWVZrgCfRJj+qrb?= =?us-ascii?Q?nkM3H2dYdkQ/NWNQgu/Dsu6LtM/vF7eZBIW4Qr6Qlr482LbQDysZWM5xvWbx?= =?us-ascii?Q?INKI52GtRSFfCeRt9rcDG0Fz/mX3UpT7oWwpki3kEKfL5tsDMJPanhV+Dmeh?= =?us-ascii?Q?ZN8F4SYOpCrcCVhRDSouPnPsI53R1cAp/0YV9YP4xBxLAX5meL8EoCTr6EfM?= =?us-ascii?Q?ZEbe7KScsDZO2SM9cAemw4oqTsW9vu1m59eBr1bEg550OsOi7oZpar0jb1hr?= =?us-ascii?Q?f6RKVUfqqA2ZYrj715vDRzXJoYFZt1gqPWwDvEuJivhv/wgpdM1Wjs3fbmgb?= =?us-ascii?Q?ggAH+bEbTLBOIicefqyDEqSUKRCxX2DtsqLnINUeuClLDEtdB5d2RDOxVwCq?= =?us-ascii?Q?Ed7w/Ez7o0m4EIAANEjSgnS/T6NilcLoIAYw/EK6oAV5sn0LBiTr4M8Y/sVq?= =?us-ascii?Q?jpHeZi6JH9zuVli5eJFgT1BZS66WJXZHKLUrK8ZJHJA=3D=3D?= X-Microsoft-Exchange-Diagnostics: 1;DB6PR0801MB1302;5:PYRGz2njK4QmQKviKGOuUuB6pCfhWUVBE0Q79me3Xgv87iqqZhYGbfwwm6QEbpiazREYXNWmDkdCxuiNE86pc6WJ3U31ODLdYDT98F3Yjv+UEe6VYZMRtFCVf/AoTR8PzufFKwSGbKega1ZteqSAHDNp8LW6dPCspByyb+FvnrDR/PvCvmSwUrvhlAuBZFrm;24:04QFK7kEQPqDc2+dFs9bUeqqQbL+hoRq84JefAwQ0GQ93cT8uV13llJgVvJYWdQw+sGdub3X1VLMk3e4IrXI0z9ns/j51jkGoqiJB6xe+H0=;7:1LyvaHcflwzd/BaiEo26Mre1iDmepkCLJgllXGp4WG6M8MjxOZWGHqIMPwtYxDe/Fobmub1D70QGqLmn8ort2TPd0VgcW8jhA7pc0V76YUS0+NkllH7g6GU+hj9+T0JP60whRIIlzP4e1dO15tq+MheqmUUjRM/as4NGc+nhrRXm77vHQCW5KBS0k+llZd/OcrYS8h8HrjXwemLtl/Z0zWailLYyzCLmS6bG0rm1sh4=;20:skDZoX1d5RcOodwDdCXtVRQBxzc6d5OpucS4AEEK96RDhYrj5+FhrjiAG+Mhhf0TSTSDPOnDmSWlRE0Ccv+brx9zKeeqbV1Hu6amwDd6y5Grq30/8r46cyg3ZrGn9jQrxi3m5+V/V7H75yM8zN7b8yUwlqGj0N/CyN/NAEdfIqU= SpamDiagnosticOutput: 1:23 SpamDiagnosticMetadata: NSPM X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Apr 2016 08:17:09.6169 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-Transport-CrossTenantHeadersStamped: DB6PR0801MB1302 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org write_buildid() increments 'name_len' with intention to take into account trailing zero byte. However, 'name_len' was already incremented in machine__write_buildid_table() before. So this leads to out-of-bounds read in do_write(): $ ./perf record sleep 0 [ perf record: Woken up 1 times to write data ] ================================================================= ==15899==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000099fc92 at pc 0x7f1aa9c7eab5 bp 0x7fff940f84d0 sp 0x7fff940f7c78 READ of size 19 at 0x00000099fc92 thread T0 #0 0x7f1aa9c7eab4 (/usr/lib/gcc/x86_64-pc-linux-gnu/5.3.0/libasan.so.2+0x44ab4) #1 0x649c5b in do_write util/header.c:67 #2 0x649c5b in write_padded util/header.c:82 #3 0x57e8bc in write_buildid util/build-id.c:239 #4 0x57e8bc in machine__write_buildid_table util/build-id.c:278 ... 0x00000099fc92 is located 0 bytes to the right of global variable '*.LC99' defined in 'util/symbol.c' (0x99fc80) of size 18 '*.LC99' is ascii string '[kernel.kallsyms]' ... Shadow bytes around the buggy address: 0x00008012bf80: f9 f9 f9 f9 00 00 00 00 00 00 03 f9 f9 f9 f9 f9 =>0x00008012bf90: 00 00[02]f9 f9 f9 f9 f9 00 00 00 00 00 05 f9 f9 0x00008012bfa0: f9 f9 f9 f9 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 Signed-off-by: Andrey Ryabinin --- tools/perf/util/build-id.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c index 0573c2e..a1ff68b 100644 --- a/tools/perf/util/build-id.c +++ b/tools/perf/util/build-id.c @@ -235,7 +235,7 @@ static int write_buildid(const char *name, size_t name_len, u8 *build_id, if (err < 0) return err; - return write_padded(fd, name, name_len + 1, len); + return write_padded(fd, name, name_len, len); } static int machine__write_buildid_table(struct machine *machine, int fd) -- 2.7.3