diff options
| author | Jiri Olsa <jolsa@redhat.com> | 2013-10-02 15:46:39 +0200 |
|---|---|---|
| committer | Arnaldo Carvalho de Melo <acme@redhat.com> | 2013-10-11 12:17:40 -0300 |
| commit | a65cb4b9f8a777a715371c63c0525408048cea3e (patch) | |
| tree | 283b133e3f2e10fb308d668695806f5d1bdf3e3f /tools/perf/util/evsel.c | |
| parent | b81a48ea877e1a104dace1392d92f708ff208f97 (diff) | |
| download | linux-a65cb4b9f8a777a715371c63c0525408048cea3e.tar.bz2 | |
perf evlist: Fix perf_evlist__mmap_read event overflow
The perf_evlist__mmap_read used 'union perf_event' as a placeholder for
event crossing the mmap boundary.
This is ok for sample shorter than ~PATH_MAX. However we could grow up
to the maximum sample size which is 16 bits max.
I hit this overflow issue when using 'perf top -G dwarf' which produces
sample with the size around 8192 bytes. We could configure any valid
sample size here using: '-G dwarf,size'.
Using array with sample max size instead for the event placeholder. Also
adding another safe check for the dynamic size of the user stack.
TODO: The 'struct perf_mmap' is quite big now, maybe we could use some
lazy allocation for event_copy size.
Signed-off-by: Jiri Olsa <jolsa@redhat.com>
Acked-by: David Ahern <dsahern@gmail.com>
Cc: Corey Ashford <cjashfor@linux.vnet.ibm.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Frederic Weisbecker <fweisbec@gmail.com>
Cc: Ingo Molnar <mingo@elte.hu>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Paul Mackerras <paulus@samba.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/1380721599-24285-1-git-send-email-jolsa@redhat.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Diffstat (limited to 'tools/perf/util/evsel.c')
| -rw-r--r-- | tools/perf/util/evsel.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c index abe69af58b62..bfebc1ea3c51 100644 --- a/tools/perf/util/evsel.c +++ b/tools/perf/util/evsel.c @@ -1456,6 +1456,9 @@ int perf_evsel__parse_sample(struct perf_evsel *evsel, union perf_event *event, array = (void *)array + sz; OVERFLOW_CHECK_u64(array); data->user_stack.size = *array++; + if (WARN_ONCE(data->user_stack.size > sz, + "user stack dump failure\n")) + return -EFAULT; } } |