From: Arnaldo Carvalho de Melo <acme@kernel.org>
To: Ingo Molnar <mingo@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>, Namhyung Kim <namhyung@kernel.org>,
Clark Williams <williams@redhat.com>,
linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org,
Changbin Du <changbin.du@gmail.com>,
Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Peter Zijlstra <peterz@infradead.org>,
Steven Rostedt <rostedt@goodmis.org>,
Arnaldo Carvalho de Melo <acme@redhat.com>
Subject: [PATCH 16/44] perf top: Delete the evlist before perf_session, fixing heap-use-after-free issue
Date: Thu, 21 Mar 2019 15:51:14 -0300 [thread overview]
Message-ID: <20190321185142.11441-17-acme@kernel.org> (raw)
In-Reply-To: <20190321185142.11441-1-acme@kernel.org>
From: Changbin Du <changbin.du@gmail.com>
The evlist should be destroyed before the perf session.
Detected with gcc's ASan:
=================================================================
==27350==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b000002e38 at pc 0x5611da276999 bp 0x7ffce8f1d1a0 sp 0x7ffce8f1d190
WRITE of size 8 at 0x62b000002e38 thread T0
#0 0x5611da276998 in __list_del /home/work/linux/tools/include/linux/list.h:89
#1 0x5611da276d4a in __list_del_entry /home/work/linux/tools/include/linux/list.h:102
#2 0x5611da276e77 in list_del_init /home/work/linux/tools/include/linux/list.h:145
#3 0x5611da2781cd in thread__put util/thread.c:130
#4 0x5611da2cc0a8 in __thread__zput util/thread.h:68
#5 0x5611da2d2dcb in hist_entry__delete util/hist.c:1148
#6 0x5611da2cdf91 in hists__delete_entry util/hist.c:337
#7 0x5611da2ce19e in hists__delete_entries util/hist.c:365
#8 0x5611da2db2ab in hists__delete_all_entries util/hist.c:2639
#9 0x5611da2db325 in hists_evsel__exit util/hist.c:2651
#10 0x5611da1c5352 in perf_evsel__exit util/evsel.c:1304
#11 0x5611da1c5390 in perf_evsel__delete util/evsel.c:1309
#12 0x5611da1b35f0 in perf_evlist__purge util/evlist.c:124
#13 0x5611da1b38e2 in perf_evlist__delete util/evlist.c:148
#14 0x5611da069781 in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1645
#15 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
#16 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
#17 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
#18 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520
#19 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
#20 0x5611d9ff35c9 in _start (/home/work/linux/tools/perf/perf+0x3e95c9)
0x62b000002e38 is located 11320 bytes inside of 27448-byte region [0x62b000000200,0x62b000006d38)
freed by thread T0 here:
#0 0x7fdccb04ab70 in free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xedb70)
#1 0x5611da260df4 in perf_session__delete util/session.c:201
#2 0x5611da063de5 in __cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1300
#3 0x5611da06973c in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1642
#4 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
#5 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
#6 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
#7 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520
#8 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
previously allocated by thread T0 here:
#0 0x7fdccb04b138 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xee138)
#1 0x5611da26010c in zalloc util/util.h:23
#2 0x5611da260824 in perf_session__new util/session.c:118
#3 0x5611da0633a6 in __cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1192
#4 0x5611da06973c in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1642
#5 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302
#6 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354
#7 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398
#8 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520
#9 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a)
SUMMARY: AddressSanitizer: heap-use-after-free /home/work/linux/tools/include/linux/list.h:89 in __list_del
Shadow bytes around the buggy address:
0x0c567fff8570: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c567fff8580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c567fff8590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c567fff85a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c567fff85b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x0c567fff85c0: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd
0x0c567fff85d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c567fff85e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c567fff85f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c567fff8600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x0c567fff8610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==27350==ABORTING
Signed-off-by: Changbin Du <changbin.du@gmail.com>
Reviewed-by: Jiri Olsa <jolsa@kernel.org>
Cc: Alexei Starovoitov <ast@kernel.org>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Steven Rostedt (VMware) <rostedt@goodmis.org>
Link: http://lkml.kernel.org/r/20190316080556.3075-8-changbin.du@gmail.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/builtin-top.c | 42 ++++++++++++++++++----------------------
1 file changed, 19 insertions(+), 23 deletions(-)
diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
index 231a90daa958..614f278235fa 100644
--- a/tools/perf/builtin-top.c
+++ b/tools/perf/builtin-top.c
@@ -1189,23 +1189,19 @@ static int __cmd_top(struct perf_top *top)
pthread_t thread, thread_process;
int ret;
- top->session = perf_session__new(NULL, false, NULL);
- if (top->session == NULL)
- return -1;
-
if (!top->annotation_opts.objdump_path) {
ret = perf_env__lookup_objdump(&top->session->header.env,
&top->annotation_opts.objdump_path);
if (ret)
- goto out_delete;
+ return ret;
}
ret = callchain_param__setup_sample_type(&callchain_param);
if (ret)
- goto out_delete;
+ return ret;
if (perf_session__register_idle_thread(top->session) < 0)
- goto out_delete;
+ return ret;
if (top->nr_threads_synthesize > 1)
perf_set_multithreaded();
@@ -1227,13 +1223,18 @@ static int __cmd_top(struct perf_top *top)
if (perf_hpp_list.socket) {
ret = perf_env__read_cpu_topology_map(&perf_env);
- if (ret < 0)
- goto out_err_cpu_topo;
+ if (ret < 0) {
+ char errbuf[BUFSIZ];
+ const char *err = str_error_r(-ret, errbuf, sizeof(errbuf));
+
+ ui__error("Could not read the CPU topology map: %s\n", err);
+ return ret;
+ }
}
ret = perf_top__start_counters(top);
if (ret)
- goto out_delete;
+ return ret;
top->session->evlist = top->evlist;
perf_session__set_id_hdr_size(top->session);
@@ -1252,7 +1253,7 @@ static int __cmd_top(struct perf_top *top)
ret = -1;
if (pthread_create(&thread_process, NULL, process_thread, top)) {
ui__error("Could not create process thread.\n");
- goto out_delete;
+ return ret;
}
if (pthread_create(&thread, NULL, (use_browser > 0 ? display_thread_tui :
@@ -1296,19 +1297,7 @@ static int __cmd_top(struct perf_top *top)
out_join_thread:
pthread_cond_signal(&top->qe.cond);
pthread_join(thread_process, NULL);
-out_delete:
- perf_session__delete(top->session);
- top->session = NULL;
-
return ret;
-
-out_err_cpu_topo: {
- char errbuf[BUFSIZ];
- const char *err = str_error_r(-ret, errbuf, sizeof(errbuf));
-
- ui__error("Could not read the CPU topology map: %s\n", err);
- goto out_delete;
-}
}
static int
@@ -1639,10 +1628,17 @@ int cmd_top(int argc, const char **argv)
signal(SIGWINCH, winch_sig);
}
+ top.session = perf_session__new(NULL, false, NULL);
+ if (top.session == NULL) {
+ status = -1;
+ goto out_delete_evlist;
+ }
+
status = __cmd_top(&top);
out_delete_evlist:
perf_evlist__delete(top.evlist);
+ perf_session__delete(top.session);
return status;
}
--
2.20.1
next prev parent reply other threads:[~2019-03-21 18:53 UTC|newest]
Thread overview: 45+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-03-21 18:50 [GIT PULL 00/44] perf/core fixes and improvements Arnaldo Carvalho de Melo
2019-03-21 18:50 ` [PATCH 01/44] perf list: Filter metrics too Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 02/44] perf record: Allow to limit number of reported perf.data files Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 03/44] perf record: Clarify help for --switch-output Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 04/44] perf report: Show all sort keys in help output Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 05/44] perf report: Indicate JITed code better in report Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 06/44] perf script: Support relative time Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 07/44] perf stat: Fix --no-scale Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 08/44] perf stat: Improve scaling Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 09/44] perf vendor events: Remove P8 HW events which are not supported Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 10/44] perf tools: Add doc about how to build perf with Asan and UBSan Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 11/44] perf list: Don't forget to drop the reference to the allocated thread_map Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 12/44] perf tools: Fix errors under optimization level '-Og' Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 13/44] perf config: Fix an error in the config template documentation Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 14/44] perf config: Fix a memory leak in collect_config() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 15/44] perf build-id: Fix memory leak in print_sdt_events() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` Arnaldo Carvalho de Melo [this message]
2019-03-21 18:51 ` [PATCH 17/44] perf top: Fix error handling in cmd_top() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 18/44] perf hist: Add missing map__put() in error case Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 19/44] perf map: Remove map from 'names' tree in __maps__remove() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 20/44] perf maps: Purge all maps from the 'names' tree Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 21/44] perf top: Fix global-buffer-overflow issue Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 22/44] perf evsel: Free evsel->counts in perf_evsel__exit() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 23/44] perf tests: Fix a memory leak of cpu_map object in the openat_syscall_event_on_all_cpus test Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 24/44] perf tests: Fix memory leak by expr__find_other() in test__expr() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 25/44] perf tests: Fix a memory leak in test__perf_evsel__tp_sched_test() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 26/44] perf record: Replace option --bpf-event with --no-bpf-event Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 27/44] tools lib bpf: Introduce bpf_program__get_prog_info_linear() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 28/44] bpftool: use bpf_program__get_prog_info_linear() in prog.c:do_dump() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 29/44] perf bpf: Synthesize bpf events with bpf_program__get_prog_info_linear() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 30/44] perf bpf: Make synthesize_bpf_events() receive perf_session pointer instead of perf_tool Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 31/44] perf bpf: Save bpf_prog_info in a rbtree in perf_env Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 32/44] perf bpf: Save bpf_prog_info information as headers to perf.data Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 33/44] perf bpf: Save BTF in a rbtree in perf_env Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 34/44] perf bpf: Save BTF information as headers to perf.data Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 35/44] perf top: Add option --no-bpf-event Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 36/44] perf feature detection: Add -lopcodes to feature-libbfd Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 37/44] perf symbols: Introduce DSO_BINARY_TYPE__BPF_PROG_INFO Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 38/44] perf bpf: Process PERF_BPF_EVENT_PROG_LOAD for annotation Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 39/44] perf build: Check what binutils's 'disassembler()' signature to use Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 40/44] perf annotate: Enable annotation of BPF programs Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 41/44] perf evlist: Introduce side band thread Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 42/44] perf tools: Save bpf_prog_info and BTF of new BPF programs Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 43/44] perf bpf: Extract logic to create program names from perf_event__synthesize_one_bpf_prog() Arnaldo Carvalho de Melo
2019-03-21 18:51 ` [PATCH 44/44] perf bpf: Show more BPF program info in print_bpf_prog_info() Arnaldo Carvalho de Melo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190321185142.11441-17-acme@kernel.org \
--to=acme@kernel.org \
--cc=acme@redhat.com \
--cc=ast@kernel.org \
--cc=changbin.du@gmail.com \
--cc=daniel@iogearbox.net \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=namhyung@kernel.org \
--cc=peterz@infradead.org \
--cc=rostedt@goodmis.org \
--cc=williams@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.