From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1753992AbcKRSDJ (ORCPT <rfc822;w@1wt.eu>);
        Fri, 18 Nov 2016 13:03:09 -0500
Received: from mail-yb0-f193.google.com ([209.85.213.193]:34740 "EHLO
        mail-yb0-f193.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752936AbcKRSDF (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Fri, 18 Nov 2016 13:03:05 -0500
From: Vince Weaver <vincent.weaver@maine.edu>
X-Google-Original-From: Vince Weaver <vince@maine.edu>
Date: Fri, 18 Nov 2016 13:02:58 -0500 (EST)
X-X-Sender: vince@macbook-air
To: Alexander Shishkin <alexander.shishkin@linux.intel.com>
cc: Vince Weaver <vincent.weaver@maine.edu>,
        "linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
        Peter Zijlstra <peterz@infradead.org>, Ingo Molnar <mingo@redhat.com>,
        Arnaldo Carvalho de Melo <acme@kernel.org>,
        "dvyukov@google.com" <dvyukov@google.com>
Subject: Re: perf: fuzzer KASAN: global-out-of-bounds in match_token
In-Reply-To: <877f81f264.fsf@ashishki-desk.ger.corp.intel.com>
Message-ID: <alpine.DEB.2.20.1611181259170.16531@macbook-air>
References: <alpine.DEB.2.20.1611171521350.12680@macbook-air> <alpine.DEB.2.20.1611171536500.12680@macbook-air> <alpine.DEB.2.20.1611171706470.12680@macbook-air> <alpine.DEB.2.20.1611172149260.14035@macbook-air>
 <877f81f264.fsf@ashishki-desk.ger.corp.intel.com>
User-Agent: Alpine 2.20 (DEB 67 2015-01-07)
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, 18 Nov 2016, Alexander Shishkin wrote:

> From 139306c3bcf7abf49c51a8e56131aaae51222594 Mon Sep 17 00:00:00 2001
> From: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Date: Fri, 18 Nov 2016 13:24:55 +0200
> Subject: [PATCH] perf: Fix address filter parser
> 
> The token table passed into match_token() must be null-terminated, which
> it currently is not in the perf's address filter string parser, as caught
> by Vince's perf_fuzzer and KASAN. It doesn't blow up otherwise because of
> the alignment padding of the table to the next element in the .rodata,
> which is luck.

I can confirm that with this patch applied I no longer get the 
token-parsing KASAN messages.

This is even after I enhanced the perf_fuzzer to generate more realistic 
address-filters.

As an aside, is there any better documentation on what a "proper" address 
filter looks like?  In kernel/events/core.c it says

 * ACTION RANGE_SPEC
 * where ACTION is one of the
 *  * "filter": limit the trace to this region
 *  * "start": start tracing from this address
 *  * "stop": stop tracing at this address/region;
 * RANGE_SPEC is
 *  * for kernel addresses: <start address>[/<size>]
 *  * for object files:     <start address>[/<size>]@</path/to/object/file>

Does each action always get a range?

Are the ranges hex? decimal?  can they have a leading 0x?
Are the sizes hex? decimal?
What's the path to object file for?  What kind of object file?

Vince