2022-09-24 12:25:47

by Leo Yan

[permalink] [raw]
Subject: [PATCH] perf record: Fix segmentation fault in record__read_lost_samples()

Commit a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
causes segmentation fault when run the "perf mem record" command in
unprivileged mode, the output log is:

$ ./perf mem record --all-user -o perf_test.data -- ./test_program
Error:
Access to performance monitoring and observability operations is limited.
Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
access to performance monitoring and observability operations for processes
without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability.
More information can be found at 'Perf events and tool security' document:
https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
perf_event_paranoid setting is 4:
-1: Allow use of (almost) all events by all users
Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
>= 0: Disallow raw and ftrace function tracepoint access
>= 1: Disallow CPU event access
>= 2: Disallow kernel profiling
To make the adjusted perf_event_paranoid setting permanent preserve it
in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
perf: Segmentation fault
Obtained 16 stack frames.
./perf(dump_stack+0x31) [0x55b7aa1e8070]
./perf(sighandler_dump_stack+0x36) [0x55b7aa1e815e]
./perf(+0xc9120) [0x55b7aa0a9120]
/lib/x86_64-linux-gnu/libc.so.6(+0x4251f) [0x7fd03ef8151f]
./perf(+0xccaca) [0x55b7aa0acaca]
./perf(+0xcf4ab) [0x55b7aa0af4ab]
./perf(cmd_record+0xd50) [0x55b7aa0b28df]
./perf(+0x112f77) [0x55b7aa0f2f77]
./perf(cmd_mem+0x53b) [0x55b7aa0f406c]
./perf(+0x19979c) [0x55b7aa17979c]
./perf(+0x199a37) [0x55b7aa179a37]
./perf(+0x199b95) [0x55b7aa179b95]
./perf(main+0x2c7) [0x55b7aa179fbd]
/lib/x86_64-linux-gnu/libc.so.6(+0x29d8f) [0x7fd03ef68d8f]
/lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x7f) [0x7fd03ef68e3f]
./perf(_start+0x24) [0x55b7aa089974]
Segmentation fault (core dumped)

In the unprivileged mode perf fails to open PMU event, the function
record__open() returns error and "session->evlist" is NULL; this leads
to segmentation fault when iterates "session->evlist" in the function
record__read_lost_samples().

This patch checks "session->evlist" in record__read_lost_samples(), if
"session->evlist" is NULL then the function directly bails out to avoid
segmentation fault.

Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
Signed-off-by: Leo Yan <[email protected]>
---
tools/perf/builtin-record.c | 4 ++++
1 file changed, 4 insertions(+)

diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
index 02e38f50a138..012b46dd4999 100644
--- a/tools/perf/builtin-record.c
+++ b/tools/perf/builtin-record.c
@@ -1888,6 +1888,10 @@ static void record__read_lost_samples(struct record *rec)
struct perf_record_lost_samples *lost;
struct evsel *evsel;

+ /* No any event is opened, directly bail out */
+ if (!session->evlist)
+ return;
+
lost = zalloc(PERF_SAMPLE_MAX_SIZE);
if (lost == NULL) {
pr_debug("Memory allocation failed\n");
--
2.34.1


2022-09-24 17:01:48

by Namhyung Kim

[permalink] [raw]
Subject: Re: [PATCH] perf record: Fix segmentation fault in record__read_lost_samples()

Hi Leo,

On Sat, Sep 24, 2022 at 4:34 AM Leo Yan <[email protected]> wrote:
>
> Commit a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> causes segmentation fault when run the "perf mem record" command in
> unprivileged mode, the output log is:
>
> $ ./perf mem record --all-user -o perf_test.data -- ./test_program
> Error:
> Access to performance monitoring and observability operations is limited.
> Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
> access to performance monitoring and observability operations for processes
> without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability.
> More information can be found at 'Perf events and tool security' document:
> https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
> perf_event_paranoid setting is 4:
> -1: Allow use of (almost) all events by all users
> Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
> >= 0: Disallow raw and ftrace function tracepoint access
> >= 1: Disallow CPU event access
> >= 2: Disallow kernel profiling
> To make the adjusted perf_event_paranoid setting permanent preserve it
> in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
> perf: Segmentation fault
> Obtained 16 stack frames.
> ./perf(dump_stack+0x31) [0x55b7aa1e8070]
> ./perf(sighandler_dump_stack+0x36) [0x55b7aa1e815e]
> ./perf(+0xc9120) [0x55b7aa0a9120]
> /lib/x86_64-linux-gnu/libc.so.6(+0x4251f) [0x7fd03ef8151f]
> ./perf(+0xccaca) [0x55b7aa0acaca]
> ./perf(+0xcf4ab) [0x55b7aa0af4ab]
> ./perf(cmd_record+0xd50) [0x55b7aa0b28df]
> ./perf(+0x112f77) [0x55b7aa0f2f77]
> ./perf(cmd_mem+0x53b) [0x55b7aa0f406c]
> ./perf(+0x19979c) [0x55b7aa17979c]
> ./perf(+0x199a37) [0x55b7aa179a37]
> ./perf(+0x199b95) [0x55b7aa179b95]
> ./perf(main+0x2c7) [0x55b7aa179fbd]
> /lib/x86_64-linux-gnu/libc.so.6(+0x29d8f) [0x7fd03ef68d8f]
> /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x7f) [0x7fd03ef68e3f]
> ./perf(_start+0x24) [0x55b7aa089974]
> Segmentation fault (core dumped)
>
> In the unprivileged mode perf fails to open PMU event, the function
> record__open() returns error and "session->evlist" is NULL; this leads
> to segmentation fault when iterates "session->evlist" in the function
> record__read_lost_samples().
>
> This patch checks "session->evlist" in record__read_lost_samples(), if
> "session->evlist" is NULL then the function directly bails out to avoid
> segmentation fault.
>
> Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> Signed-off-by: Leo Yan <[email protected]>

Thanks for the fix and sorry for the inconvenience.
Actually I sent the same fix a few weeks ago.

https://lore.kernel.org/r/[email protected]

Thanks,
Namhyung


> ---
> tools/perf/builtin-record.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
> index 02e38f50a138..012b46dd4999 100644
> --- a/tools/perf/builtin-record.c
> +++ b/tools/perf/builtin-record.c
> @@ -1888,6 +1888,10 @@ static void record__read_lost_samples(struct record *rec)
> struct perf_record_lost_samples *lost;
> struct evsel *evsel;
>
> + /* No any event is opened, directly bail out */
> + if (!session->evlist)
> + return;
> +
> lost = zalloc(PERF_SAMPLE_MAX_SIZE);
> if (lost == NULL) {
> pr_debug("Memory allocation failed\n");
> --
> 2.34.1
>

2022-09-25 01:22:58

by Leo Yan

[permalink] [raw]
Subject: Re: [PATCH] perf record: Fix segmentation fault in record__read_lost_samples()

Hi Namhyung,

On Sat, Sep 24, 2022 at 09:52:09AM -0700, Namhyung Kim wrote:

[...]

> > In the unprivileged mode perf fails to open PMU event, the function
> > record__open() returns error and "session->evlist" is NULL; this leads
> > to segmentation fault when iterates "session->evlist" in the function
> > record__read_lost_samples().
> >
> > This patch checks "session->evlist" in record__read_lost_samples(), if
> > "session->evlist" is NULL then the function directly bails out to avoid
> > segmentation fault.
> >
> > Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> > Signed-off-by: Leo Yan <[email protected]>
>
> Thanks for the fix and sorry for the inconvenience.
> Actually I sent the same fix a few weeks ago.
>
> https://lore.kernel.org/r/[email protected]

Thanks a lot for the info and fix. The patch in above link looks good
to me! Please ignore this one.

Leo

2022-09-26 14:48:25

by Arnaldo Carvalho de Melo

[permalink] [raw]
Subject: Re: [PATCH] perf record: Fix segmentation fault in record__read_lost_samples()

Em Sun, Sep 25, 2022 at 09:12:37AM +0800, Leo Yan escreveu:
> Hi Namhyung,
>
> On Sat, Sep 24, 2022 at 09:52:09AM -0700, Namhyung Kim wrote:
>
> [...]
>
> > > In the unprivileged mode perf fails to open PMU event, the function
> > > record__open() returns error and "session->evlist" is NULL; this leads
> > > to segmentation fault when iterates "session->evlist" in the function
> > > record__read_lost_samples().
> > >
> > > This patch checks "session->evlist" in record__read_lost_samples(), if
> > > "session->evlist" is NULL then the function directly bails out to avoid
> > > segmentation fault.
> > >
> > > Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> > > Signed-off-by: Leo Yan <[email protected]>
> >
> > Thanks for the fix and sorry for the inconvenience.
> > Actually I sent the same fix a few weeks ago.
> >
> > https://lore.kernel.org/r/[email protected]
>
> Thanks a lot for the info and fix. The patch in above link looks good
> to me! Please ignore this one.

Took that as an Acked-by: Leo, thanks!

- Arnaldo

2022-09-26 14:54:20

by Arnaldo Carvalho de Melo

[permalink] [raw]
Subject: Re: [PATCH] perf record: Fix segmentation fault in record__read_lost_samples()

Em Sat, Sep 24, 2022 at 09:52:09AM -0700, Namhyung Kim escreveu:
> Hi Leo,
>
> On Sat, Sep 24, 2022 at 4:34 AM Leo Yan <[email protected]> wrote:
> >
> > Commit a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> > causes segmentation fault when run the "perf mem record" command in
> > unprivileged mode, the output log is:
> >
> > $ ./perf mem record --all-user -o perf_test.data -- ./test_program
> > Error:
> > Access to performance monitoring and observability operations is limited.
> > Consider adjusting /proc/sys/kernel/perf_event_paranoid setting to open
> > access to performance monitoring and observability operations for processes
> > without CAP_PERFMON, CAP_SYS_PTRACE or CAP_SYS_ADMIN Linux capability.
> > More information can be found at 'Perf events and tool security' document:
> > https://www.kernel.org/doc/html/latest/admin-guide/perf-security.html
> > perf_event_paranoid setting is 4:
> > -1: Allow use of (almost) all events by all users
> > Ignore mlock limit after perf_event_mlock_kb without CAP_IPC_LOCK
> > >= 0: Disallow raw and ftrace function tracepoint access
> > >= 1: Disallow CPU event access
> > >= 2: Disallow kernel profiling
> > To make the adjusted perf_event_paranoid setting permanent preserve it
> > in /etc/sysctl.conf (e.g. kernel.perf_event_paranoid = <setting>)
> > perf: Segmentation fault
> > Obtained 16 stack frames.
> > ./perf(dump_stack+0x31) [0x55b7aa1e8070]
> > ./perf(sighandler_dump_stack+0x36) [0x55b7aa1e815e]
> > ./perf(+0xc9120) [0x55b7aa0a9120]
> > /lib/x86_64-linux-gnu/libc.so.6(+0x4251f) [0x7fd03ef8151f]
> > ./perf(+0xccaca) [0x55b7aa0acaca]
> > ./perf(+0xcf4ab) [0x55b7aa0af4ab]
> > ./perf(cmd_record+0xd50) [0x55b7aa0b28df]
> > ./perf(+0x112f77) [0x55b7aa0f2f77]
> > ./perf(cmd_mem+0x53b) [0x55b7aa0f406c]
> > ./perf(+0x19979c) [0x55b7aa17979c]
> > ./perf(+0x199a37) [0x55b7aa179a37]
> > ./perf(+0x199b95) [0x55b7aa179b95]
> > ./perf(main+0x2c7) [0x55b7aa179fbd]
> > /lib/x86_64-linux-gnu/libc.so.6(+0x29d8f) [0x7fd03ef68d8f]
> > /lib/x86_64-linux-gnu/libc.so.6(__libc_start_main+0x7f) [0x7fd03ef68e3f]
> > ./perf(_start+0x24) [0x55b7aa089974]
> > Segmentation fault (core dumped)
> >
> > In the unprivileged mode perf fails to open PMU event, the function
> > record__open() returns error and "session->evlist" is NULL; this leads
> > to segmentation fault when iterates "session->evlist" in the function
> > record__read_lost_samples().
> >
> > This patch checks "session->evlist" in record__read_lost_samples(), if
> > "session->evlist" is NULL then the function directly bails out to avoid
> > segmentation fault.
> >
> > Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> > Signed-off-by: Leo Yan <[email protected]>
>
> Thanks for the fix and sorry for the inconvenience.
> Actually I sent the same fix a few weeks ago.
>
> https://lore.kernel.org/r/[email protected]

collecting it now, and adding that Fixes from Leo's patch, ok?

- Arnaldo

> Thanks,
> Namhyung
>
>
> > ---
> > tools/perf/builtin-record.c | 4 ++++
> > 1 file changed, 4 insertions(+)
> >
> > diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
> > index 02e38f50a138..012b46dd4999 100644
> > --- a/tools/perf/builtin-record.c
> > +++ b/tools/perf/builtin-record.c
> > @@ -1888,6 +1888,10 @@ static void record__read_lost_samples(struct record *rec)
> > struct perf_record_lost_samples *lost;
> > struct evsel *evsel;
> >
> > + /* No any event is opened, directly bail out */
> > + if (!session->evlist)
> > + return;
> > +
> > lost = zalloc(PERF_SAMPLE_MAX_SIZE);
> > if (lost == NULL) {
> > pr_debug("Memory allocation failed\n");
> > --
> > 2.34.1
> >

--

- Arnaldo

2022-09-26 16:25:53

by Leo Yan

[permalink] [raw]
Subject: Re: [PATCH] perf record: Fix segmentation fault in record__read_lost_samples()

On Mon, Sep 26, 2022 at 01:59:29PM +0100, Arnaldo Carvalho de Melo wrote:

[...]

> > > Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> > > Signed-off-by: Leo Yan <[email protected]>
> >
> > Thanks for the fix and sorry for the inconvenience.
> > Actually I sent the same fix a few weeks ago.
> >
> > https://lore.kernel.org/r/[email protected]
>
> collecting it now, and adding that Fixes from Leo's patch, ok?

Yeah, I think it's good to add Fixes tag. Just remind, actually
Namhyung has mentioned Fixed tag in above link:

"I didn't add a Fixes tag as it's not sent to Linus yet. But in case you want it.

Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
"

Thanks,
Leo

2022-09-26 19:23:04

by Arnaldo Carvalho de Melo

[permalink] [raw]
Subject: Re: [PATCH] perf record: Fix segmentation fault in record__read_lost_samples()

Em Mon, Sep 26, 2022 at 10:54:43PM +0800, Leo Yan escreveu:
> On Mon, Sep 26, 2022 at 01:59:29PM +0100, Arnaldo Carvalho de Melo wrote:
>
> [...]
>
> > > > Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> > > > Signed-off-by: Leo Yan <[email protected]>
> > >
> > > Thanks for the fix and sorry for the inconvenience.
> > > Actually I sent the same fix a few weeks ago.
> > >
> > > https://lore.kernel.org/r/[email protected]
> >
> > collecting it now, and adding that Fixes from Leo's patch, ok?
>
> Yeah, I think it's good to add Fixes tag. Just remind, actually
> Namhyung has mentioned Fixed tag in above link:
>
> "I didn't add a Fixes tag as it's not sent to Linus yet. But in case you want it.
>
> Fixes: a49aa8a54e86 ("perf record: Read and inject LOST_SAMPLES events")
> "

I'll add it.

Sometimes I think about combining fixes with patches in my tree that
didn't made it into Linus tree yet, so that we avoid having problems
with 'git bisect', but I also try not to rebase acme/perf/core.

Perhaps in the future 'git bisect' will look at Fixes: tags :-)

- Arnaldo