perf session: Avoid infinite loop when seeing invalid header.size (57fc032a) · Commits · 戴 / test

Vince reported that when fuzzing the userland perf tool with a bogus perf.data file he got into a infinite loop in 'perf report'. Changing the return of fetch_mmaped_event() to ERR_PTR(-EINVAL) for that case gets us out of that infinite loop. Reported-by:

Vince Weaver <vincent.weaver@maine.edu> Tested-by:

Vince Weaver <vincent.weaver@maine.edu> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com> Cc: Jiri Olsa <jolsa@kernel.org> Cc: Namhyung Kim <namhyung@kernel.org> Cc: Peter Zijlstra <peterz@infradead.org> Link: https://lkml.kernel.org/r/20190726211415.GE24867@kernel.org Signed-off-by:

Arnaldo Carvalho de Melo <acme@redhat.com>

tools/perf/util/session.c

+10 −1

Original line number	Diff line number	Diff line
		// SPDX-License-Identifier: GPL-2.0
		#include <errno.h>
		#include <inttypes.h>
		#include <linux/err.h>
		#include <linux/kernel.h>
		#include <linux/zalloc.h>
		#include <traceevent/event-parse.h>
		@@ -1955,7 +1956,9 @@ fetch_mmaped_event(struct perf_session *session,
		/* We're not fetching the event so swap back again */
		if (session->header.needs_swap)
		perf_event_header__bswap(&event->header);
		return NULL;
		pr_debug("%s: head=%#" PRIx64 " event->header_size=%#x, mmap_size=%#zx: fuzzed perf.data?\n",
		__func__, head, event->header.size, mmap_size);
		return ERR_PTR(-EINVAL);
		}

		return event;
		@@ -1973,6 +1976,9 @@ static int __perf_session__process_decomp_events(struct perf_session *session)
		while (decomp->head < decomp->size && !session_done()) {
		union perf_event *event = fetch_mmaped_event(session, decomp->head, decomp->size, decomp->data);

		if (IS_ERR(event))
		return PTR_ERR(event);

		if (!event)
		break;

		@@ -2072,6 +2078,9 @@ remap:

		more:
		event = fetch_mmaped_event(session, head, mmap_size, buf);
		if (IS_ERR(event))
		return PTR_ERR(event);

		if (!event) {
		if (mmaps[map_idx]) {
		munmap(mmaps[map_idx], mmap_size);

Admin message