[PATCH v1] perf parse-events: Avoid segv if PMU lookup fails for legacy cache terms

[PATCH v1] perf parse-events: Avoid segv if PMU lookup fails for legacy cache terms

[Ian Rogers]

libfuzzer found the following command could segv:
```
$ perf stat -e cpu/L2,L2/ true
```
This is because the L2 term rewrites the perf_event_attr type to
PERF_TYPE_HW_CACHE which then fails the PMU lookup for the second
legacy cache term.

The new failure is consistent with repeated hardware terms:
```
$ perf stat -e cpu/L2,L2/ true
event syntax error: 'cpu/L2,L2/'
                            \___ Failed to find PMU for type 3

Initial error:
event syntax error: 'cpu/L2,L2/'
                            \___ Failed to find PMU for type 3
Run 'perf list' for a list of valid events

 Usage: perf stat [<options>] [<command>]

    -e, --event <event>   event selector. use 'perf list' to list available events
$ perf stat -e cpu/cycles,cycles/ true
event syntax error: 'cpu/cycles,cycles/'
                                \___ Failed to find PMU for type 0

Initial error:
event syntax error: 'cpu/cycles,cycles/'
                                \___ Failed to find PMU for type 0
Run 'perf list' for a list of valid events

 Usage: perf stat [<options>] [<command>]

    -e, --event <event>   event selector. use 'perf list' to list available events
```

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/util/parse-events.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 5dcfbf316bf6..acde097e327c 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -1216,6 +1216,14 @@ static int config_term_pmu(struct perf_event_attr *attr,
 	if (term->type_term == PARSE_EVENTS__TERM_TYPE_LEGACY_CACHE) {
 		const struct perf_pmu *pmu = perf_pmus__find_by_type(attr->type);
 
+		if (!pmu) {
+			char *err_str;
+
+			if (asprintf(&err_str, "Failed to find PMU for type %d", attr->type) >= 0)
+				parse_events_error__handle(err, term->err_term,
+							   err_str, /*help=*/NULL);
+			return -EINVAL;
+		}
 		if (perf_pmu__supports_legacy_cache(pmu)) {
 			attr->type = PERF_TYPE_HW_CACHE;
 			return parse_events__decode_legacy_cache(term->config, pmu->type,
-- 
2.41.0.390.g38632f3daf-goog

Re: [PATCH v1] perf parse-events: Avoid segv if PMU lookup fails for legacy cache terms

[Arnaldo Carvalho de Melo]

Em Tue, Jul 11, 2023 at 11:52:50PM -0700, Ian Rogers escreveu:
> libfuzzer found the following command could segv:
> ```
> $ perf stat -e cpu/L2,L2/ true
> ```
> This is because the L2 term rewrites the perf_event_attr type to
> PERF_TYPE_HW_CACHE which then fails the PMU lookup for the second
> legacy cache term.
> 
> The new failure is consistent with repeated hardware terms:
> ```
> $ perf stat -e cpu/L2,L2/ true
> event syntax error: 'cpu/L2,L2/'
>                             \___ Failed to find PMU for type 3
> 
> Initial error:
> event syntax error: 'cpu/L2,L2/'
>                             \___ Failed to find PMU for type 3
> Run 'perf list' for a list of valid events
> 
>  Usage: perf stat [<options>] [<command>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list available events
> $ perf stat -e cpu/cycles,cycles/ true
> event syntax error: 'cpu/cycles,cycles/'
>                                 \___ Failed to find PMU for type 0
> 
> Initial error:
> event syntax error: 'cpu/cycles,cycles/'
>                                 \___ Failed to find PMU for type 0
> Run 'perf list' for a list of valid events
> 
>  Usage: perf stat [<options>] [<command>]
> 
>     -e, --event <event>   event selector. use 'perf list' to list available events
> ```

I added the Fixes as requested:

Fixes: 6fd1e5191591f9d5 ("perf parse-events: Support PMUs for legacy cache events")

Please check if the patch below helps a bit giving more info to the
user, but still a bit cryptic:

⬢[acme@toolbox perf-tools]$ perf stat -e cpu/L2,L2/ true
event syntax error: 'cpu/L2,L2/'
                            \___ Failed to find PMU for perf_event_attr.type 3 (PERF_TYPE_HW_CACHE)

Initial error:
event syntax error: 'cpu/L2,L2/'
                            \___ Failed to find PMU for perf_event_attr.type 3 (PERF_TYPE_HW_CACHE)
Run 'perf list' for a list of valid events

 Usage: perf stat [<options>] [<command>]

    -e, --event <event>   event selector. use 'perf list' to list available events
⬢[acme@toolbox perf-tools]$

And the other case is needs more patching, so better leave this for 6.6.


⬢[acme@toolbox perf-tools]$ perf stat -e cpu/cycles,cycles/ true
event syntax error: 'cpu/cycles,cycles/'
                                \___ Failed to find PMU for type 0

Initial error:
event syntax error: 'cpu/cycles,cycles/'
                                \___ Failed to find PMU for type 0
Run 'perf list' for a list of valid events

 Usage: perf stat [<options>] [<command>]

    -e, --event <event>   event selector. use 'perf list' to list available events
⬢[acme@toolbox perf-tools]$

- Arnaldo

diff --git a/tools/perf/util/evsel_fprintf.h b/tools/perf/util/evsel_fprintf.h
index c8a9fac2f2ddc0f2..044612774a962020 100644
--- a/tools/perf/util/evsel_fprintf.h
+++ b/tools/perf/util/evsel_fprintf.h
@@ -4,6 +4,7 @@
 
 #include <stdio.h>
 #include <stdbool.h>
+#include <linux/types.h>
 
 struct evsel;
 
@@ -45,6 +46,8 @@ int sample__fprintf_sym(struct perf_sample *sample, struct addr_location *al,
 
 typedef int (*attr__fprintf_f)(FILE *, const char *, const char *, void *);
 
+const char *stringify_perf_type_id(u64 value);
+
 int perf_event_attr__fprintf(FILE *fp, struct perf_event_attr *attr,
 			     attr__fprintf_f attr__fprintf, void *priv);
 #endif // __PERF_EVSEL_H
diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index acde097e327cce8c..8678469cf974070a 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -25,6 +25,7 @@
 #include "asm/bug.h"
 #include "util/parse-branch-options.h"
 #include "util/evsel_config.h"
+#include "util/evsel_fprintf.h"
 #include "util/event.h"
 #include "util/bpf-filter.h"
 #include "util/util.h"
@@ -1219,9 +1220,11 @@ static int config_term_pmu(struct perf_event_attr *attr,
 		if (!pmu) {
 			char *err_str;
 
-			if (asprintf(&err_str, "Failed to find PMU for type %d", attr->type) >= 0)
+			if (asprintf(&err_str, "Failed to find PMU for perf_event_attr.type %d (%s)", attr->type,
+				     stringify_perf_type_id(attr->type)) >= 0) {
 				parse_events_error__handle(err, term->err_term,
 							   err_str, /*help=*/NULL);
+			}
 			return -EINVAL;
 		}
 		if (perf_pmu__supports_legacy_cache(pmu)) {
diff --git a/tools/perf/util/perf_event_attr_fprintf.c b/tools/perf/util/perf_event_attr_fprintf.c
index 2247991451f3aa1b..ce97371eda027271 100644
--- a/tools/perf/util/perf_event_attr_fprintf.c
+++ b/tools/perf/util/perf_event_attr_fprintf.c
@@ -74,7 +74,7 @@ static void __p_read_format(char *buf, size_t size, u64 value)
 }
 
 #define ENUM_ID_TO_STR_CASE(x) case x: return (#x);
-static const char *stringify_perf_type_id(u64 value)
+const char *stringify_perf_type_id(u64 value)
 {
 	switch (value) {
 	ENUM_ID_TO_STR_CASE(PERF_TYPE_HARDWARE)

Re: [PATCH v1] perf parse-events: Avoid segv if PMU lookup fails for legacy cache terms

[Ian Rogers]

On Wed, Jul 12, 2023 at 12:27 PM Arnaldo Carvalho de Melo
<acme@kernel.org> wrote:
>
> Em Tue, Jul 11, 2023 at 11:52:50PM -0700, Ian Rogers escreveu:
> > libfuzzer found the following command could segv:
> > ```
> > $ perf stat -e cpu/L2,L2/ true
> > ```
> > This is because the L2 term rewrites the perf_event_attr type to
> > PERF_TYPE_HW_CACHE which then fails the PMU lookup for the second
> > legacy cache term.
> >
> > The new failure is consistent with repeated hardware terms:
> > ```
> > $ perf stat -e cpu/L2,L2/ true
> > event syntax error: 'cpu/L2,L2/'
> >                             \___ Failed to find PMU for type 3
> >
> > Initial error:
> > event syntax error: 'cpu/L2,L2/'
> >                             \___ Failed to find PMU for type 3
> > Run 'perf list' for a list of valid events
> >
> >  Usage: perf stat [<options>] [<command>]
> >
> >     -e, --event <event>   event selector. use 'perf list' to list available events
> > $ perf stat -e cpu/cycles,cycles/ true
> > event syntax error: 'cpu/cycles,cycles/'
> >                                 \___ Failed to find PMU for type 0
> >
> > Initial error:
> > event syntax error: 'cpu/cycles,cycles/'
> >                                 \___ Failed to find PMU for type 0
> > Run 'perf list' for a list of valid events
> >
> >  Usage: perf stat [<options>] [<command>]
> >
> >     -e, --event <event>   event selector. use 'perf list' to list available events
> > ```
>
> I added the Fixes as requested:
>
> Fixes: 6fd1e5191591f9d5 ("perf parse-events: Support PMUs for legacy cache events")
>
> Please check if the patch below helps a bit giving more info to the
> user, but still a bit cryptic:
>
> ⬢[acme@toolbox perf-tools]$ perf stat -e cpu/L2,L2/ true
> event syntax error: 'cpu/L2,L2/'
>                             \___ Failed to find PMU for perf_event_attr.type 3 (PERF_TYPE_HW_CACHE)
>
> Initial error:
> event syntax error: 'cpu/L2,L2/'
>                             \___ Failed to find PMU for perf_event_attr.type 3 (PERF_TYPE_HW_CACHE)
> Run 'perf list' for a list of valid events
>
>  Usage: perf stat [<options>] [<command>]
>
>     -e, --event <event>   event selector. use 'perf list' to list available events
> ⬢[acme@toolbox perf-tools]$
>
> And the other case is needs more patching, so better leave this for 6.6.
>
>
> ⬢[acme@toolbox perf-tools]$ perf stat -e cpu/cycles,cycles/ true
> event syntax error: 'cpu/cycles,cycles/'
>                                 \___ Failed to find PMU for type 0
>
> Initial error:
> event syntax error: 'cpu/cycles,cycles/'
>                                 \___ Failed to find PMU for type 0
> Run 'perf list' for a list of valid events
>
>  Usage: perf stat [<options>] [<command>]
>
>     -e, --event <event>   event selector. use 'perf list' to list available events
> ⬢[acme@toolbox perf-tools]$

The stringify looks good. Something strange is the value there is a
u64 by type is a __u32 in the perf_event_attr.

Thanks!
Ian

> - Arnaldo
>
> diff --git a/tools/perf/util/evsel_fprintf.h b/tools/perf/util/evsel_fprintf.h
> index c8a9fac2f2ddc0f2..044612774a962020 100644
> --- a/tools/perf/util/evsel_fprintf.h
> +++ b/tools/perf/util/evsel_fprintf.h
> @@ -4,6 +4,7 @@
>
>  #include <stdio.h>
>  #include <stdbool.h>
> +#include <linux/types.h>
>
>  struct evsel;
>
> @@ -45,6 +46,8 @@ int sample__fprintf_sym(struct perf_sample *sample, struct addr_location *al,
>
>  typedef int (*attr__fprintf_f)(FILE *, const char *, const char *, void *);
>
> +const char *stringify_perf_type_id(u64 value);
> +
>  int perf_event_attr__fprintf(FILE *fp, struct perf_event_attr *attr,
>                              attr__fprintf_f attr__fprintf, void *priv);
>  #endif // __PERF_EVSEL_H
> diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
> index acde097e327cce8c..8678469cf974070a 100644
> --- a/tools/perf/util/parse-events.c
> +++ b/tools/perf/util/parse-events.c
> @@ -25,6 +25,7 @@
>  #include "asm/bug.h"
>  #include "util/parse-branch-options.h"
>  #include "util/evsel_config.h"
> +#include "util/evsel_fprintf.h"
>  #include "util/event.h"
>  #include "util/bpf-filter.h"
>  #include "util/util.h"
> @@ -1219,9 +1220,11 @@ static int config_term_pmu(struct perf_event_attr *attr,
>                 if (!pmu) {
>                         char *err_str;
>
> -                       if (asprintf(&err_str, "Failed to find PMU for type %d", attr->type) >= 0)
> +                       if (asprintf(&err_str, "Failed to find PMU for perf_event_attr.type %d (%s)", attr->type,
> +                                    stringify_perf_type_id(attr->type)) >= 0) {
>                                 parse_events_error__handle(err, term->err_term,
>                                                            err_str, /*help=*/NULL);
> +                       }
>                         return -EINVAL;
>                 }
>                 if (perf_pmu__supports_legacy_cache(pmu)) {
> diff --git a/tools/perf/util/perf_event_attr_fprintf.c b/tools/perf/util/perf_event_attr_fprintf.c
> index 2247991451f3aa1b..ce97371eda027271 100644
> --- a/tools/perf/util/perf_event_attr_fprintf.c
> +++ b/tools/perf/util/perf_event_attr_fprintf.c
> @@ -74,7 +74,7 @@ static void __p_read_format(char *buf, size_t size, u64 value)
>  }
>
>  #define ENUM_ID_TO_STR_CASE(x) case x: return (#x);
> -static const char *stringify_perf_type_id(u64 value)
> +const char *stringify_perf_type_id(u64 value)
>  {
>         switch (value) {
>         ENUM_ID_TO_STR_CASE(PERF_TYPE_HARDWARE)