[PATCH 3/3] perf session: Avoid infinite loop if an event is truncated

From: Petr Malat <oss@malat.biz>
To: linux-kernel@vger.kernel.org
Cc: Petr Malat <oss@malat.biz>, Peter Zijlstra <peterz@infradead.org>,
	Ingo Molnar <mingo@redhat.com>,
	Arnaldo Carvalho de Melo <acme@kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	Jiri Olsa <jolsa@redhat.com>, Namhyung Kim <namhyung@kernel.org>,
	Adrian Hunter <adrian.hunter@intel.com>,
	"Paul A. Clarke" <pc@us.ibm.com>,
	Kan Liang <kan.liang@linux.intel.com>,
	Alexey Budankov <alexey.budankov@linux.intel.com>
Subject: [PATCH 3/3] perf session: Avoid infinite loop if an event is truncated
Date: Tue, 24 Nov 2020 10:59:21 +0100	[thread overview]
Message-ID: <20201124095923.3683-3-oss@malat.biz> (raw)
In-Reply-To: <20201124095923.3683-1-oss@malat.biz>

If an event was truncated at the end of a perf.data file larger than
MAP_SIZE, the event reading code ended up in an infinite loop. Break
this loop by making sure the mapping window is always shifting
towards the end of the file.

Fixes: bb1835a3b86c ("perf session: Fix decompression of PERF_RECORD_COMPRESSED records")
Fixes: 57fc032ad643 ("perf session: Avoid infinite loop when seeing invalid header.size")
Signed-off-by: Petr Malat <oss@malat.biz>
---
 tools/perf/util/session.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index e57b0d09d196..b73b85d99628 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -2168,6 +2168,12 @@ reader__process_events(struct reader *rd, struct perf_session *session,
 		}
 
 		page_offset = page_size * (head / page_size);
+		if (!page_offset) {
+			pr_err("%#" PRIx64 " [%#x]: truncated event\n",
+					file_offset + head);
+			err = -EINVAL;
+			goto out;
+		}
 		file_offset += page_offset;
 		head -= page_offset;
 		goto remap;
-- 
2.20.1

