1. 12 Apr, 2023 30 commits
  2. 11 Apr, 2023 2 commits
    • Ian Rogers's avatar
      perf bperf: Avoid use after free via unrelated 'struct evsel' anonymous union field · e0137336
      Ian Rogers authored
      If bperf (perf tools that use BPF skels) sets evsel->leader_skel or
      evsel->follower_skel then it appears that evsel->bpf_skel is set and can
      trigger the following use-after-free:
      
      ==13575==ERROR: AddressSanitizer: heap-use-after-free on address 0x60c000014080 at pc 0x55684b939880 bp 0x7ffdfcf30d70 sp 0x7ffdfcf30d68
      READ of size 8 at 0x60c000014080 thread T0
           #0 0x55684b93987f in sample_filter_bpf__destroy tools/perf/bpf_skel/sample_filter.skel.h:44:11
           #1 0x55684b93987f in perf_bpf_filter__destroy tools/perf/util/bpf-filter.c:155:2
           #2 0x55684b98f71e in evsel__exit tools/perf/util/evsel.c:1521:2
           #3 0x55684b98a352 in evsel__delete tools/perf/util/evsel.c:1547:2
           #4 0x55684b981918 in evlist__purge tools/perf/util/evlist.c:148:3
           #5 0x55684b981918 in evlist__delete tools/perf/util/evlist.c:169:2
           #6 0x55684b887d60 in cmd_stat tools/perf/builtin-stat.c:2598:2
      ..
      0x60c000014080 is located 0 bytes inside of 128-byte region [0x60c000014080,0x60c000014100)
      freed by thread T0 here:
           #0 0x55684b780e86 in free compiler-rt/lib/asan/asan_malloc_linux.cpp:52:3
           #1 0x55684b9462da in bperf_cgroup_bpf__destroy tools/perf/bpf_skel/bperf_cgroup.skel.h:61:2
           #2 0x55684b9462da in bperf_cgrp__destroy tools/perf/util/bpf_counter_cgroup.c:282:2
           #3 0x55684b944c75 in bpf_counter__destroy tools/perf/util/bpf_counter.c:819:2
           #4 0x55684b98f716 in evsel__exit tools/perf/util/evsel.c:1520:2
           #5 0x55684b98a352 in evsel__delete tools/perf/util/evsel.c:1547:2
           #6 0x55684b981918 in evlist__purge tools/perf/util/evlist.c:148:3
           #7 0x55684b981918 in evlist__delete tools/perf/util/evlist.c:169:2
           #8 0x55684b887d60 in cmd_stat tools/perf/builtin-stat.c:2598:2
      ...
      previously allocated by thread T0 here:
           #0 0x55684b781338 in calloc compiler-rt/lib/asan/asan_malloc_linux.cpp:77:3
           #1 0x55684b944e25 in bperf_cgroup_bpf__open_opts tools/perf/bpf_skel/bperf_cgroup.skel.h:73:35
           #2 0x55684b944e25 in bperf_cgroup_bpf__open tools/perf/bpf_skel/bperf_cgroup.skel.h:97:9
           #3 0x55684b944e25 in bperf_load_program tools/perf/util/bpf_counter_cgroup.c:55:9
           #4 0x55684b944e25 in bperf_cgrp__load tools/perf/util/bpf_counter_cgroup.c:178:23
           #5 0x55684b889289 in __run_perf_stat tools/perf/builtin-stat.c:713:7
           #6 0x55684b889289 in run_perf_stat tools/perf/builtin-stat.c:949:8
           #7 0x55684b888029 in cmd_stat tools/perf/builtin-stat.c:2537:12
      
      Resolve by clearing 'evsel->bpf_skel' as part of bpf_counter__destroy().
      Suggested-by: default avatarNamhyung Kim <namhyung@kernel.org>
      Signed-off-by: default avatarIan Rogers <irogers@google.com>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Namhyung Kim <namhyung@kernel.org>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Cc: bpf@vger.kernel.org
      Link: http://lore.kernel.org/lkml/20230411051718.267228-1-irogers@google.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      e0137336
    • Ian Rogers's avatar
      perf evsel: Avoid SEGV if delete is called on NULL · cf57cf51
      Ian Rogers authored
      Seen in "perf stat --bpf-counters --for-each-cgroup test" running in a
      container:
      
        libbpf: Failed to bump RLIMIT_MEMLOCK (err = -1), you might need to do it explicitly!
        libbpf: Error in bpf_object__probe_loading():Operation not permitted(1). Couldn't load trivial BPF program. Make sure your kernel supports BPF (CONFIG_BPF_SYSCALL=y) and/or that RLIMIT_MEMLOCK is set to big enough value.
        libbpf: failed to load object 'bperf_cgroup_bpf'
        libbpf: failed to load BPF skeleton 'bperf_cgroup_bpf': -1
        Failed to load cgroup skeleton
      
          #0 0x55f28a650981 in list_empty tools/include/linux/list.h:189
          #1 0x55f28a6593b4 in evsel__exit util/evsel.c:1518
          #2 0x55f28a6596af in evsel__delete util/evsel.c:1544
          #3 0x55f28a89d166 in bperf_cgrp__destroy util/bpf_counter_cgroup.c:283
          #4 0x55f28a899e9a in bpf_counter__destroy util/bpf_counter.c:816
          #5 0x55f28a659455 in evsel__exit util/evsel.c:1520
          #6 0x55f28a6596af in evsel__delete util/evsel.c:1544
          #7 0x55f28a640d4d in evlist__purge util/evlist.c:148
          #8 0x55f28a640ea6 in evlist__delete util/evlist.c:169
          #9 0x55f28a4efbf2 in cmd_stat tools/perf/builtin-stat.c:2598
          #10 0x55f28a6050c2 in run_builtin tools/perf/perf.c:330
          #11 0x55f28a605633 in handle_internal_command tools/perf/perf.c:384
          #12 0x55f28a6059fb in run_argv tools/perf/perf.c:428
          #13 0x55f28a6061d3 in main tools/perf/perf.c:562
      Signed-off-by: default avatarIan Rogers <irogers@google.com>
      Acked-by: default avatarNamhyung Kim <namhyung@kernel.org>
      Cc: Adrian Hunter <adrian.hunter@intel.com>
      Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
      Cc: Florian Fischer <florian.fischer@muhq.space>
      Cc: Ingo Molnar <mingo@redhat.com>
      Cc: Jiri Olsa <jolsa@kernel.org>
      Cc: Kan Liang <kan.liang@linux.intel.com>
      Cc: Mark Rutland <mark.rutland@arm.com>
      Cc: Peter Zijlstra <peterz@infradead.org>
      Link: https://lore.kernel.org/r/20230410205659.3131608-1-irogers@google.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
      cf57cf51
  3. 10 Apr, 2023 8 commits