mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-06 02:50:43 +00:00
perf session: Fix perf_session__peek_event()
perf_session__peek_event() generally leverages there being a single mmap of the perf.data file, however on 32-bit platforms when there is more that 32MiB of data, then there are multiple mmaps, so perf_session__peek_event() reads from the file. In that case a couple of bugs were exposed (note how the seg. fault appears with >32M of data): $ perf record --per-thread -e intel_bts// ../rtit-tests/loopy 1000000 [ perf record: Woken up 13 times to write data ] [ perf record: Captured and wrote 24.568 MB perf.data ] $ perf script > /dev/null $ perf record --per-thread -e intel_bts// ../rtit-tests/loopy 10000000 [ perf record: Woken up 136 times to write data ] [ perf record: Captured and wrote 270.794 MB perf.data ] $ perf script > /dev/null Segmentation fault (core dumped) The wrong address was being passed to the readn() function and the buffer size was not being checked. Signed-off-by: Adrian Hunter <adrian.hunter@intel.com> Cc: Jiri Olsa <jolsa@redhat.com> Cc: Namhyung Kim <namhyung@gmail.com> Link: http://lkml.kernel.org/r/1432040746-1755-5-git-send-email-adrian.hunter@intel.com Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
parent
05b41775e2
commit
554e92ed8f
1 changed files with 3 additions and 3 deletions
|
@ -1182,7 +1182,7 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
|
|||
return -1;
|
||||
|
||||
if (lseek(fd, file_offset, SEEK_SET) == (off_t)-1 ||
|
||||
readn(fd, &buf, hdr_sz) != (ssize_t)hdr_sz)
|
||||
readn(fd, buf, hdr_sz) != (ssize_t)hdr_sz)
|
||||
return -1;
|
||||
|
||||
event = (union perf_event *)buf;
|
||||
|
@ -1190,12 +1190,12 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
|
|||
if (session->header.needs_swap)
|
||||
perf_event_header__bswap(&event->header);
|
||||
|
||||
if (event->header.size < hdr_sz)
|
||||
if (event->header.size < hdr_sz || event->header.size > buf_sz)
|
||||
return -1;
|
||||
|
||||
rest = event->header.size - hdr_sz;
|
||||
|
||||
if (readn(fd, &buf, rest) != (ssize_t)rest)
|
||||
if (readn(fd, buf, rest) != (ssize_t)rest)
|
||||
return -1;
|
||||
|
||||
if (session->header.needs_swap)
|
||||
|
|
Loading…
Reference in a new issue