From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-13.3 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id A5A73C43331 for ; Mon, 11 Nov 2019 15:41:53 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8037D206BB for ; Mon, 11 Nov 2019 15:41:53 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727021AbfKKPlw (ORCPT ); Mon, 11 Nov 2019 10:41:52 -0500 Received: from mga01.intel.com ([192.55.52.88]:2611 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726845AbfKKPlw (ORCPT ); Mon, 11 Nov 2019 10:41:52 -0500 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga101.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 11 Nov 2019 07:41:51 -0800 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.68,293,1569308400"; d="scan'208";a="354799704" Received: from linux.intel.com ([10.54.29.200]) by orsmga004.jf.intel.com with ESMTP; 11 Nov 2019 07:41:50 -0800 Received: from [10.252.3.28] (abudanko-mobl.ccr.corp.intel.com [10.252.3.28]) by linux.intel.com (Postfix) with ESMTP id 6CCB15802E4; Mon, 11 Nov 2019 07:41:48 -0800 (PST) Subject: Re: [RFC] perf session: Fix compression processing To: Jiri Olsa Cc: Arnaldo Carvalho de Melo , Peter Zijlstra , Ingo Molnar , Alexander Shishkin , Namhyung Kim , Andi Kleen , linux-kernel References: <20191103222441.GE8251@krava> <20191111145640.GB26980@krava> From: Alexey Budankov Organization: Intel Corp. Message-ID: <69782f54-f5f5-f89f-9c8d-172d4de331d0@linux.intel.com> Date: Mon, 11 Nov 2019 18:41:47 +0300 User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101 Thunderbird/60.9.1 MIME-Version: 1.0 In-Reply-To: <20191111145640.GB26980@krava> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 11.11.2019 17:56, Jiri Olsa wrote: > On Mon, Nov 11, 2019 at 05:38:49PM +0300, Alexey Budankov wrote: >> >> On 04.11.2019 1:24, Jiri Olsa wrote: >>> hi, >> >>> --- >>> The compressed data processing occasionally fails with: >>> $ perf report --stdio -vv >>> decomp (B): 44519 to 163000 >>> decomp (B): 48119 to 174800 >>> decomp (B): 65527 to 131072 >>> fetch_mmaped_event: head=0x1ffe0 event->header_size=0x28, mmap_size=0x20000: fuzzed perf.data? >>> Error: >>> failed to process sample >>> ... >>> >>> It's caused by recent fuzzer fix that does not take into account >>> that compressed data do not need to by fully present in the buffer, >>> so it's ok to just return NULL and not to fail. >>> >>> Fixes: 57fc032ad643 ("perf session: Avoid infinite loop when seeing invalid header.size") >>> Link: http://lkml.kernel.org/n/tip-q1biqscs4stcmc9bs1iokfro@git.kernel.org >>> Signed-off-by: Jiri Olsa >>> --- >>> tools/perf/util/session.c | 8 +++++--- >>> 1 file changed, 5 insertions(+), 3 deletions(-) >>> >>> diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c >>> index f07b8ecb91bc..3589ed14a629 100644 >>> --- a/tools/perf/util/session.c >>> +++ b/tools/perf/util/session.c >>> @@ -1959,7 +1959,7 @@ static int __perf_session__process_pipe_events(struct perf_session *session) >>> >>> static union perf_event * >>> fetch_mmaped_event(struct perf_session *session, >>> - u64 head, size_t mmap_size, char *buf) >>> + u64 head, size_t mmap_size, char *buf, bool decomp) >> >> bools in interface make code less transparent. >> >>> { >>> union perf_event *event; >>> >>> @@ -1979,6 +1979,8 @@ fetch_mmaped_event(struct perf_session *session, >>> /* We're not fetching the event so swap back again */ >>> if (session->header.needs_swap) >>> perf_event_header__bswap(&event->header); >>> + if (decomp) >>> + return NULL; >>> pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx: fuzzed perf.data?\n", >>> __func__, head, event->header.size, mmap_size); >>> return ERR_PTR(-EINVAL); >>> @@ -1997,7 +1999,7 @@ static int __perf_session__process_decomp_events(struct perf_session *session) >>> return 0; >>> >>> while (decomp->head < decomp->size && !session_done()) { >>> - union perf_event *event = fetch_mmaped_event(session, decomp->head, decomp->size, decomp->data); >>> + union perf_event *event = fetch_mmaped_event(session, decomp->head, decomp->size, decomp->data, true); >> >> It looks like this call can be skipped, at all, in this case. > > not sure what you mean, we are in decomp code no? Ok, it is inside "not fetching" branch. NULL return value means to proceed getting further over the trace. Checking record type == COMPRESSED at the higher level could probably be cleaner fix and also work faster. ~Alexey > > jirka > >