From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753219AbcD0P3h (ORCPT ); Wed, 27 Apr 2016 11:29:37 -0400 Received: from terminus.zytor.com ([198.137.202.10]:50624 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752431AbcD0P3f (ORCPT ); Wed, 27 Apr 2016 11:29:35 -0400 Date: Wed, 27 Apr 2016 08:28:55 -0700 From: tip-bot for Andrey Ryabinin Message-ID: Cc: acme@redhat.com, alexander.shishkin@linux.intel.com, tglx@linutronix.de, hpa@zytor.com, aryabinin@virtuozzo.com, linux-kernel@vger.kernel.org, mingo@kernel.org, peterz@infradead.org Reply-To: mingo@kernel.org, peterz@infradead.org, linux-kernel@vger.kernel.org, aryabinin@virtuozzo.com, hpa@zytor.com, tglx@linutronix.de, acme@redhat.com, alexander.shishkin@linux.intel.com In-Reply-To: <1461053847-5633-1-git-send-email-aryabinin@virtuozzo.com> References: <1461053847-5633-1-git-send-email-aryabinin@virtuozzo.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:perf/core] perf buildid: Fix off-by-one in write_buildid() Git-Commit-ID: 70a2cba972e5e4a5d850e4179381f1cd344c6828 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Commit-ID: 70a2cba972e5e4a5d850e4179381f1cd344c6828 Gitweb: http://git.kernel.org/tip/70a2cba972e5e4a5d850e4179381f1cd344c6828 Author: Andrey Ryabinin AuthorDate: Tue, 19 Apr 2016 11:17:27 +0300 Committer: Arnaldo Carvalho de Melo CommitDate: Mon, 25 Apr 2016 12:49:16 -0300 perf buildid: Fix off-by-one in write_buildid() write_buildid() increments 'name_len' with intention to take into account trailing zero byte. However, 'name_len' was already incremented in machine__write_buildid_table() before. So this leads to out-of-bounds read in do_write(): $ ./perf record sleep 0 [ perf record: Woken up 1 times to write data ] ================================================================= ==15899==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000099fc92 at pc 0x7f1aa9c7eab5 bp 0x7fff940f84d0 sp 0x7fff940f7c78 READ of size 19 at 0x00000099fc92 thread T0 #0 0x7f1aa9c7eab4 (/usr/lib/gcc/x86_64-pc-linux-gnu/5.3.0/libasan.so.2+0x44ab4) #1 0x649c5b in do_write util/header.c:67 #2 0x649c5b in write_padded util/header.c:82 #3 0x57e8bc in write_buildid util/build-id.c:239 #4 0x57e8bc in machine__write_buildid_table util/build-id.c:278 ... 0x00000099fc92 is located 0 bytes to the right of global variable '*.LC99' defined in 'util/symbol.c' (0x99fc80) of size 18 '*.LC99' is ascii string '[kernel.kallsyms]' ... Shadow bytes around the buggy address: 0x00008012bf80: f9 f9 f9 f9 00 00 00 00 00 00 03 f9 f9 f9 f9 f9 =>0x00008012bf90: 00 00[02]f9 f9 f9 f9 f9 00 00 00 00 00 05 f9 f9 0x00008012bfa0: f9 f9 f9 f9 00 03 f9 f9 f9 f9 f9 f9 00 00 00 00 Signed-off-by: Andrey Ryabinin Cc: Alexander Shishkin Cc: Peter Zijlstra Link: http://lkml.kernel.org/r/1461053847-5633-1-git-send-email-aryabinin@virtuozzo.com [ Remove the off-by one at the origin, to keep len(s) == strlen(s) assumption ] Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/build-id.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/build-id.c b/tools/perf/util/build-id.c index 0573c2e..b6ecf87 100644 --- a/tools/perf/util/build-id.c +++ b/tools/perf/util/build-id.c @@ -261,14 +261,14 @@ static int machine__write_buildid_table(struct machine *machine, int fd) if (dso__is_vdso(pos)) { name = pos->short_name; - name_len = pos->short_name_len + 1; + name_len = pos->short_name_len; } else if (dso__is_kcore(pos)) { machine__mmap_name(machine, nm, sizeof(nm)); name = nm; - name_len = strlen(nm) + 1; + name_len = strlen(nm); } else { name = pos->long_name; - name_len = pos->long_name_len + 1; + name_len = pos->long_name_len; } in_kernel = pos->kernel ||