• Yang Jihong's avatar
    perf/core: Fix perf_output_begin parameter is incorrectly invoked in perf_event_bpf_output · eb81a2ed
    Yang Jihong authored
    syzkaller reportes a KASAN issue with stack-out-of-bounds.
    The call trace is as follows:
      dump_stack+0x9c/0xd3
      print_address_description.constprop.0+0x19/0x170
      __kasan_report.cold+0x6c/0x84
      kasan_report+0x3a/0x50
      __perf_event_header__init_id+0x34/0x290
      perf_event_header__init_id+0x48/0x60
      perf_output_begin+0x4a4/0x560
      perf_event_bpf_output+0x161/0x1e0
      perf_iterate_sb_cpu+0x29e/0x340
      perf_iterate_sb+0x4c/0xc0
      perf_event_bpf_event+0x194/0x2c0
      __bpf_prog_put.constprop.0+0x55/0xf0
      __cls_bpf_delete_prog+0xea/0x120 [cls_bpf]
      cls_bpf_delete_prog_work+0x1c/0x30 [cls_bpf]
      process_one_work+0x3c2/0x730
      worker_thread+0x93/0x650
      kthread+0x1b8/0x210
      ret_from_fork+0x1f/0x30
    
    commit 267fb273 ("perf: Reduce stack usage of perf_output_begin()")
    use on-stack struct perf_sample_data of the caller function.
    
    However, perf_event_bpf_output uses incorrect parameter to convert
    small-sized data (struct perf_bpf_event) into large-sized data
    (struct perf_sample_data), which causes memory overwriting occurs in
    __perf_event_header__init_id.
    
    Fixes: 267fb273 ("perf: Reduce stack usage of perf_output_begin()")
    Signed-off-by: default avatarYang Jihong <yangjihong1@huawei.com>
    Signed-off-by: default avatarPeter Zijlstra (Intel) <peterz@infradead.org>
    Link: https://lkml.kernel.org/r/20230314044735.56551-1-yangjihong1@huawei.com
    eb81a2ed
core.c 330 KB