From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-2.7 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,MAILING_LIST_MULTI,SPF_PASS,USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id CF260C282DF for ; Fri, 19 Apr 2019 18:36:05 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 91F4E20449 for ; Fri, 19 Apr 2019 18:36:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1555698965; bh=GGJGLZaY7YRaS/R/VIkpOwcPmU/mXnQqTpK4G0cmjzM=; h=Date:From:To:Subject:References:In-Reply-To:List-ID:From; b=OfzK6OdK1cQuwDmvZ2lcWbAGKxmtPb8lUZ1QuX4O6V3b9rn432hqKTAWgniN0bTVX ubCnzlksz8lf3P7clfssaFzCea8Chpc8iynGNhsE02sThNfqx54X8HdoPaJLhD30N5 ebA/h5CPQyznlbJe0Y0MqBhKQu/+FgIHRyYmRrqI= Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1728398AbfDSSgE (ORCPT ); Fri, 19 Apr 2019 14:36:04 -0400 Received: from mail.kernel.org ([198.145.29.99]:53868 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727437AbfDSS3P (ORCPT ); Fri, 19 Apr 2019 14:29:15 -0400 Received: from localhost (c-73-47-72-35.hsd1.nh.comcast.net [73.47.72.35]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id 913F7222B0; Fri, 19 Apr 2019 13:35:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1555680918; bh=GGJGLZaY7YRaS/R/VIkpOwcPmU/mXnQqTpK4G0cmjzM=; h=Date:From:To:Subject:References:In-Reply-To:From; b=LlecedajqQxOHeskZKrjgGMCxOh+EwZ3EP4sj4OFc5WniMI9WT5p5WlW1LXXgyOZ2 YtKD2n5Yr4OiFJvDAHPhMvSGIwjDWU5GiZJsQeLhEI3fuiHAtSjJUJMINnTBm2yS5z Zrj47RrzIy0SV//Q7MCg3jT4ZxTDiJtDhGWoapsY= Date: Fri, 19 Apr 2019 09:35:17 -0400 From: Sasha Levin To: Greg Kroah-Hartman , linux-kernel@vger.kernel.org, stable@vger.kernel.org, Changbin Du , Jiri Olsa , Alexei Starovoitov , Daniel Borkmann , Namhyung Kim , Peter Zijlstra , "Steven Rostedt (VMware)" , Arnaldo Carvalho de Melo Subject: Re: [PATCH 5.0 39/93] perf top: Delete the evlist before perf_session, fixing heap-use-after-free issue Message-ID: <20190419133517.GE17719@sasha-vm> References: <20190418160436.781762249@linuxfoundation.org> <20190418160441.339477070@linuxfoundation.org> <20190418193143.aq2i7g2upngge7e6@xps.therub.org> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8; format=flowed Content-Disposition: inline Content-Transfer-Encoding: 8bit In-Reply-To: <20190418193143.aq2i7g2upngge7e6@xps.therub.org> User-Agent: Mutt/1.10.1 (2018-07-13) Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Apr 18, 2019 at 02:31:43PM -0500, Dan Rue wrote: >On Thu, Apr 18, 2019 at 07:57:17PM +0200, Greg Kroah-Hartman wrote: >> [ Upstream commit 0dba9e4be95b59e77060645ca8e37ca3231061f5 ] >> >> The evlist should be destroyed before the perf session. >> >> Detected with gcc's ASan: >> >> ================================================================= >> ==27350==ERROR: AddressSanitizer: heap-use-after-free on address 0x62b000002e38 at pc 0x5611da276999 bp 0x7ffce8f1d1a0 sp 0x7ffce8f1d190 >> WRITE of size 8 at 0x62b000002e38 thread T0 >> #0 0x5611da276998 in __list_del /home/work/linux/tools/include/linux/list.h:89 >> #1 0x5611da276d4a in __list_del_entry /home/work/linux/tools/include/linux/list.h:102 >> #2 0x5611da276e77 in list_del_init /home/work/linux/tools/include/linux/list.h:145 >> #3 0x5611da2781cd in thread__put util/thread.c:130 >> #4 0x5611da2cc0a8 in __thread__zput util/thread.h:68 >> #5 0x5611da2d2dcb in hist_entry__delete util/hist.c:1148 >> #6 0x5611da2cdf91 in hists__delete_entry util/hist.c:337 >> #7 0x5611da2ce19e in hists__delete_entries util/hist.c:365 >> #8 0x5611da2db2ab in hists__delete_all_entries util/hist.c:2639 >> #9 0x5611da2db325 in hists_evsel__exit util/hist.c:2651 >> #10 0x5611da1c5352 in perf_evsel__exit util/evsel.c:1304 >> #11 0x5611da1c5390 in perf_evsel__delete util/evsel.c:1309 >> #12 0x5611da1b35f0 in perf_evlist__purge util/evlist.c:124 >> #13 0x5611da1b38e2 in perf_evlist__delete util/evlist.c:148 >> #14 0x5611da069781 in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1645 >> #15 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302 >> #16 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354 >> #17 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398 >> #18 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520 >> #19 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a) >> #20 0x5611d9ff35c9 in _start (/home/work/linux/tools/perf/perf+0x3e95c9) >> >> 0x62b000002e38 is located 11320 bytes inside of 27448-byte region [0x62b000000200,0x62b000006d38) >> freed by thread T0 here: >> #0 0x7fdccb04ab70 in free (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xedb70) >> #1 0x5611da260df4 in perf_session__delete util/session.c:201 >> #2 0x5611da063de5 in __cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1300 >> #3 0x5611da06973c in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1642 >> #4 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302 >> #5 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354 >> #6 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398 >> #7 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520 >> #8 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a) >> >> previously allocated by thread T0 here: >> #0 0x7fdccb04b138 in calloc (/usr/lib/x86_64-linux-gnu/libasan.so.5+0xee138) >> #1 0x5611da26010c in zalloc util/util.h:23 >> #2 0x5611da260824 in perf_session__new util/session.c:118 >> #3 0x5611da0633a6 in __cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1192 >> #4 0x5611da06973c in cmd_top /home/changbin/work/linux/tools/perf/builtin-top.c:1642 >> #5 0x5611da17d038 in run_builtin /home/changbin/work/linux/tools/perf/perf.c:302 >> #6 0x5611da17d577 in handle_internal_command /home/changbin/work/linux/tools/perf/perf.c:354 >> #7 0x5611da17d97b in run_argv /home/changbin/work/linux/tools/perf/perf.c:398 >> #8 0x5611da17e0e9 in main /home/changbin/work/linux/tools/perf/perf.c:520 >> #9 0x7fdcc970f09a in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x2409a) >> >> SUMMARY: AddressSanitizer: heap-use-after-free /home/work/linux/tools/include/linux/list.h:89 in __list_del >> Shadow bytes around the buggy address: >> 0x0c567fff8570: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> 0x0c567fff8580: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> 0x0c567fff8590: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> 0x0c567fff85a0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> 0x0c567fff85b0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> =>0x0c567fff85c0: fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd fd >> 0x0c567fff85d0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> 0x0c567fff85e0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> 0x0c567fff85f0: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> 0x0c567fff8600: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> 0x0c567fff8610: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd >> Shadow byte legend (one shadow byte represents 8 application bytes): >> Addressable: 00 >> Partially addressable: 01 02 03 04 05 06 07 >> Heap left redzone: fa >> Freed heap region: fd >> Stack left redzone: f1 >> Stack mid redzone: f2 >> Stack right redzone: f3 >> Stack after return: f5 >> Stack use after scope: f8 >> Global redzone: f9 >> Global init order: f6 >> Poisoned by user: f7 >> Container overflow: fc >> Array cookie: ac >> Intra object redzone: bb >> ASan internal: fe >> Left alloca redzone: ca >> Right alloca redzone: cb >> ==27350==ABORTING > >I'm seeing the following build error as a result of this patch being >backported to 5.0: > > builtin-top.c: In function ‘__cmd_top’: > builtin-top.c:1241:3: error: label ‘out_delete’ used but not defined > goto out_delete; > ^~~~ > CC builtin-script.o > >Dropping this patch from 5.0 (along with ad59b96f965a ("perf data: Don't store >auxtrace index for directory data file") does fix the perf build. Now dropped, thanks again! -- Thanks, Sasha