[PATCH v3] perf tools: perf_event_paranoid and kptr_restrict may crash on 'perf top'

[PATCH v3] perf tools: perf_event_paranoid and kptr_restrict may crash on 'perf top'

[Jackie Liu]

After install the libelf-dev package and compiling perf, kptr_restrict=2
and perf_event_paranoid=3 will cause perf top to crash, because the
value of /proc/kallsyms cannot be obtained, which leads to
info->jited_ksyms == NULL. In order to solve this problem, Add a
judgment before use.

V2->V3:
free info_linear memory and move code above, don't do those extra btf
checks.

Suggested-by: Jiri Olsa <jolsa@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
---
 tools/perf/util/bpf-event.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index 57d58c81a5f8..3c03c782bac6 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -201,12 +201,18 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
 	}
 
 	info = &info_linear->info;
+	if (!info->jited_ksyms) {
+		free(info_linear);
+		return -1;
+	}
 
 	/* number of ksyms, func_lengths, and tags should match */
 	sub_prog_cnt = info->nr_jited_ksyms;
 	if (sub_prog_cnt != info->nr_prog_tags ||
-	    sub_prog_cnt != info->nr_jited_func_lens)
+	    sub_prog_cnt != info->nr_jited_func_lens) {
+		free(info_linear);
 		return -1;
+	}
 
 	/* check BTF func info support */
 	if (info->btf_id && info->nr_func_info && info->func_info_rec_size) {
-- 
2.25.1

Re: [PATCH v3] perf tools: perf_event_paranoid and kptr_restrict may crash on 'perf top'

[Jiri Olsa]

On Sat, Mar 13, 2021 at 02:02:46PM +0800, Jackie Liu wrote:
> After install the libelf-dev package and compiling perf, kptr_restrict=2
> and perf_event_paranoid=3 will cause perf top to crash, because the
> value of /proc/kallsyms cannot be obtained, which leads to
> info->jited_ksyms == NULL. In order to solve this problem, Add a
> judgment before use.
> 
> V2->V3:
> free info_linear memory and move code above, don't do those extra btf
> checks.
> 
> Suggested-by: Jiri Olsa <jolsa@redhat.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
> ---
>  tools/perf/util/bpf-event.c | 8 +++++++-
>  1 file changed, 7 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
> index 57d58c81a5f8..3c03c782bac6 100644
> --- a/tools/perf/util/bpf-event.c
> +++ b/tools/perf/util/bpf-event.c
> @@ -201,12 +201,18 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
>  	}

seems like the previous check miss free(info_linear) as well?
  
>  	info = &info_linear->info;
> +	if (!info->jited_ksyms) {
> +		free(info_linear);
> +		return -1;
> +	}
>  
>  	/* number of ksyms, func_lengths, and tags should match */
>  	sub_prog_cnt = info->nr_jited_ksyms;
>  	if (sub_prog_cnt != info->nr_prog_tags ||
> -	    sub_prog_cnt != info->nr_jited_func_lens)
> +	    sub_prog_cnt != info->nr_jited_func_lens) {
> +		free(info_linear);
>  		return -1;
> +	}
>  
>  	/* check BTF func info support */
>  	if (info->btf_id && info->nr_func_info && info->func_info_rec_size) {
> -- 
> 2.25.1
>