bpf.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Changbin Du <changbin.du@gmail.com>
To: Arnaldo Carvalho de Melo <acme@kernel.org>, Jiri Olsa <jolsa@kernel.org>
Cc: namhyung@kernel.org, Ingo Molnar <mingo@redhat.com>,
	Peter Zijlstra <peterz@infradead.org>,
	Alexei Starovoitov <ast@kernel.org>,
	rostedt@goodmis.org, Daniel Borkmann <daniel@iogearbox.net>,
	bpf@vger.kernel.org, linux-kernel@vger.kernel.org,
	netdev@vger.kernel.org, Changbin Du <changbin.du@gmail.com>
Subject: [PATCH 12/16] perf: top: fix global-buffer-overflow issue
Date: Sat, 16 Mar 2019 16:05:52 +0800	[thread overview]
Message-ID: <20190316080556.3075-13-changbin.du@gmail.com> (raw)
In-Reply-To: <20190316080556.3075-1-changbin.du@gmail.com>

The arrary str[] should have six elements.

=================================================================
==4322==ERROR: AddressSanitizer: global-buffer-overflow on address 0x56463844e300 at pc 0x564637e7ad0d bp 0x7f30c8c89d10 sp 0x7f30c8c89d00
READ of size 8 at 0x56463844e300 thread T9
    #0 0x564637e7ad0c in __ordered_events__flush util/ordered-events.c:316
    #1 0x564637e7b0e4 in ordered_events__flush util/ordered-events.c:338
    #2 0x564637c6a57d in process_thread /home/changbin/work/linux/tools/perf/builtin-top.c:1073
    #3 0x7f30d173a163 in start_thread (/lib/x86_64-linux-gnu/libpthread.so.0+0x8163)
    #4 0x7f30cfffbdee in __clone (/lib/x86_64-linux-gnu/libc.so.6+0x11adee)

0x56463844e300 is located 32 bytes to the left of global variable 'flags' defined in 'util/trace-event-parse.c:229:26' (0x56463844e320) of size 192
0x56463844e300 is located 0 bytes to the right of global variable 'str' defined in 'util/ordered-events.c:268:28' (0x56463844e2e0) of size 32
SUMMARY: AddressSanitizer: global-buffer-overflow util/ordered-events.c:316 in __ordered_events__flush
Shadow bytes around the buggy address:
  0x0ac947081c10: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac947081c20: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac947081c30: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac947081c40: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac947081c50: 00 00 00 00 00 00 00 00 f9 f9 f9 f9 00 00 00 00
=>0x0ac947081c60:[f9]f9 f9 f9 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac947081c70: 00 00 00 00 00 00 00 00 00 00 00 00 f9 f9 f9 f9
  0x0ac947081c80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac947081c90: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac947081ca0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  0x0ac947081cb0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Shadow byte legend (one shadow byte represents 8 application bytes):
  Addressable:           00
  Partially addressable: 01 02 03 04 05 06 07
  Heap left redzone:       fa
  Freed heap region:       fd
  Stack left redzone:      f1
  Stack mid redzone:       f2
  Stack right redzone:     f3
  Stack after return:      f5
  Stack use after scope:   f8
  Global redzone:          f9
  Global init order:       f6
  Poisoned by user:        f7
  Container overflow:      fc
  Array cookie:            ac
  Intra object redzone:    bb
  ASan internal:           fe
  Left alloca redzone:     ca
  Right alloca redzone:    cb
Thread T9 created by T0 here:
    #0 0x7f30d179de5f in __interceptor_pthread_create (/usr/lib/x86_64-linux-gnu/libasan.so.5+0x4ae5f)
    #1 0x564637c6b954 in __cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1253
    #2 0x564637c7173c in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1642
    #3 0x564637d85038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
    #4 0x564637d85577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
    #5 0x564637d8597b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
    #6 0x564637d860e9 in main /home/changbin/work/linux/tools/perf/perf.c:520
    #7 0x7f30cff0509a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)

Signed-off-by: Changbin Du <changbin.du@gmail.com>
---
 tools/perf/util/ordered-events.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c
index ea523d3b248f..989fed6f43b5 100644
--- a/tools/perf/util/ordered-events.c
+++ b/tools/perf/util/ordered-events.c
@@ -270,6 +270,8 @@ static int __ordered_events__flush(struct ordered_events *oe, enum oe_flush how,
 		"FINAL",
 		"ROUND",
 		"HALF ",
+		"TOP  ",
+		"TIME ",
 	};
 	int err;
 	bool show_progress = false;
-- 
2.19.1


  parent reply	other threads:[~2019-03-16  8:08 UTC|newest]

Thread overview: 25+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-03-16  8:05 [PATCH 00/16] fix some perf issues detected by ASan Changbin Du
2019-03-16  8:05 ` [PATCH 01/16] perf: add doc for how to build perf with Asan and UBSan Changbin Du
2019-03-18 10:07   ` Jiri Olsa
2019-03-18 20:08     ` Arnaldo Carvalho de Melo
2019-03-20 12:00       ` Changbin Du
2019-03-20 11:58     ` Changbin Du
2019-03-16  8:05 ` [PATCH 02/16] perf: list: fix memory leak in function is_event_supported Changbin Du
2019-03-16  8:05 ` [PATCH 03/16] perf: fix errors under optimization level '-Og' Changbin Du
2019-03-16  8:05 ` [PATCH 04/16] perf: fix an error in config template Changbin Du
2019-03-16  8:05 ` [PATCH 05/16] perf: fix a memory leak in collect_config Changbin Du
2019-03-16  8:05 ` [PATCH 06/16] perf: fix memory leak in print_sdt_events() Changbin Du
2019-03-16  8:05 ` [PATCH 07/16] perf: top: fix heap-use-after-free issue Changbin Du
2019-03-18 10:08   ` Jiri Olsa
2019-03-16  8:05 ` [PATCH 08/16] perf: top: fix error handing in cmd_top() Changbin Du
2019-03-16  8:05 ` [PATCH 09/16] perf: missed a map__put() in error case Changbin Du
2019-03-16  8:05 ` [PATCH 10/16] perf: remove map from names tree in __maps__remove Changbin Du
2019-03-16  8:05 ` [PATCH 11/16] perf: purge all maps from the names tree Changbin Du
2019-03-16  8:05 ` Changbin Du [this message]
2019-03-16  8:05 ` [PATCH 13/16] perf: free all counts in perf_evsel__exit Changbin Du
2019-03-18 19:39   ` Arnaldo Carvalho de Melo
2019-03-16  8:05 ` [PATCH 14/16] perf: fix a memory leak of cpu_map object Changbin Du
2019-03-16  8:05 ` [PATCH 15/16] perf: fix memory leak by expr__find_other Changbin Du
2019-03-16  8:05 ` [PATCH 16/16] perf: fix a memory leak in test__perf_evsel__tp_sched_test Changbin Du
2019-03-18 10:08 ` [PATCH 00/16] fix some perf issues detected by ASan Jiri Olsa
2019-03-18 16:16   ` Arnaldo Carvalho de Melo

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190316080556.3075-13-changbin.du@gmail.com \
    --to=changbin.du@gmail.com \
    --cc=acme@kernel.org \
    --cc=ast@kernel.org \
    --cc=bpf@vger.kernel.org \
    --cc=daniel@iogearbox.net \
    --cc=jolsa@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mingo@redhat.com \
    --cc=namhyung@kernel.org \
    --cc=netdev@vger.kernel.org \
    --cc=peterz@infradead.org \
    --cc=rostedt@goodmis.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).