2019-08-02 09:36:03

by He Zhe

Subject: [PATCH 2/2] perf: Fix writing to illegal memory in handling cpumap mask

From: He Zhe <[email protected]>

cpu_map__snprint_mask would write to illegal memory pointed by zalloc(0)
when there is only one cpu.

This patch fixes the calculation and adds sanity check against the input
parameters.

Signed-off-by: He Zhe <[email protected]>
---
tools/perf/util/cpumap.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 3acfbe3..39cce66 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -751,7 +751,10 @@ size_t cpu_map__snprint_mask(struct cpu_map *map, char *buf, size_t size)
unsigned char *bitmap;
int last_cpu = cpu_map__cpu(map, map->nr - 1);

- bitmap = zalloc((last_cpu + 7) / 8);
+ if (buf == NULL)
+ return 0;
+
+ bitmap = zalloc(last_cpu / 8 + 1);
if (bitmap == NULL) {
buf[0] = '\0';
return 0;
--
2.7.4

2019-08-08 13:38:09

by Arnaldo Carvalho de Melo

Subject: Re: [PATCH 2/2] perf: Fix writing to illegal memory in handling cpumap mask

Em Fri, Aug 02, 2019 at 04:29:52PM +0800, [email protected] escreveu:
> From: He Zhe <[email protected]>
>
> cpu_map__snprint_mask would write to illegal memory pointed by zalloc(0)
> when there is only one cpu.
>
> This patch fixes the calculation and adds sanity check against the input
> parameters.

Thanks, applied, and added the missing:

Fixes: 4400ac8a9a90 ("perf cpumap: Introduce cpu_map__snprint_mask()")

- Arnaldo

> Signed-off-by: He Zhe <[email protected]>
> ---
> tools/perf/util/cpumap.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
> index 3acfbe3..39cce66 100644
> --- a/tools/perf/util/cpumap.c
> +++ b/tools/perf/util/cpumap.c
> @@ -751,7 +751,10 @@ size_t cpu_map__snprint_mask(struct cpu_map *map, char *buf, size_t size)
> unsigned char *bitmap;
> int last_cpu = cpu_map__cpu(map, map->nr - 1);
>
> - bitmap = zalloc((last_cpu + 7) / 8);
> + if (buf == NULL)
> + return 0;
> +
> + bitmap = zalloc(last_cpu / 8 + 1);
> if (bitmap == NULL) {
> buf[0] = '\0';
> return 0;
> --
> 2.7.4

--

- Arnaldo

2019-08-08 20:35:56

by tip-bot for Vasyl Gomonovych

Subject: [tip:perf/urgent] perf cpumap: Fix writing to illegal memory in handling cpumap mask

Commit-ID: 5f5e25f1c7933a6e1673515c0b1d5acd82fea1ed
Gitweb: https://git.kernel.org/tip/5f5e25f1c7933a6e1673515c0b1d5acd82fea1ed
Author: He Zhe <[email protected]>
AuthorDate: Fri, 2 Aug 2019 16:29:52 +0800
Committer: Arnaldo Carvalho de Melo <[email protected]>
CommitDate: Thu, 8 Aug 2019 15:41:10 -0300

perf cpumap: Fix writing to illegal memory in handling cpumap mask

cpu_map__snprint_mask() would write to illegal memory pointed by
zalloc(0) when there is only one cpu.

This patch fixes the calculation and adds sanity check against the input
parameters.

Signed-off-by: He Zhe <[email protected]>
Cc: Alexander Shishkin <[email protected]>
Cc: Alexey Budankov <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Kan Liang <[email protected]>
Cc: Namhyung Kim <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Stephane Eranian <[email protected]>
Fixes: 4400ac8a9a90 ("perf cpumap: Introduce cpu_map__snprint_mask()")
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
---
tools/perf/util/cpumap.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
index 3acfbe34ebaf..39cce66b4ebc 100644
--- a/tools/perf/util/cpumap.c
+++ b/tools/perf/util/cpumap.c
@@ -751,7 +751,10 @@ size_t cpu_map__snprint_mask(struct cpu_map *map, char *buf, size_t size)
unsigned char *bitmap;
int last_cpu = cpu_map__cpu(map, map->nr - 1);

- bitmap = zalloc((last_cpu + 7) / 8);
+ if (buf == NULL)
+ return 0;
+
+ bitmap = zalloc(last_cpu / 8 + 1);
if (bitmap == NULL) {
buf[0] = '\0';
return 0;