Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753555AbcD0PfH (ORCPT ); Wed, 27 Apr 2016 11:35:07 -0400 Received: from terminus.zytor.com ([198.137.202.10]:51054 "EHLO terminus.zytor.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753087AbcD0PfB (ORCPT ); Wed, 27 Apr 2016 11:35:01 -0400 Date: Wed, 27 Apr 2016 08:34:23 -0700 From: tip-bot for Wang Nan Message-ID: Cc: lizefan@huawei.com, mingo@kernel.org, wangnan0@huawei.com, hpa@zytor.com, acme@redhat.com, peterz@infradead.org, linux-kernel@vger.kernel.org, tglx@linutronix.de Reply-To: linux-kernel@vger.kernel.org, tglx@linutronix.de, peterz@infradead.org, acme@redhat.com, hpa@zytor.com, mingo@kernel.org, wangnan0@huawei.com, lizefan@huawei.com In-Reply-To: <1461637738-62722-2-git-send-email-wangnan0@huawei.com> References: <1461637738-62722-2-git-send-email-wangnan0@huawei.com> To: linux-tip-commits@vger.kernel.org Subject: [tip:perf/core] perf evlist: Enforce ring buffer reading Git-Commit-ID: b04b7023751bf6519eee64467b6477f0e7fb82a1 X-Mailer: tip-git-log-daemon Robot-ID: Robot-Unsubscribe: Contact to get blacklisted from these emails MIME-Version: 1.0 Content-Transfer-Encoding: 8bit Content-Type: text/plain; charset=UTF-8 Content-Disposition: inline Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 3224 Lines: 98 Commit-ID: b04b7023751bf6519eee64467b6477f0e7fb82a1 Gitweb: http://git.kernel.org/tip/b04b7023751bf6519eee64467b6477f0e7fb82a1 Author: Wang Nan AuthorDate: Tue, 26 Apr 2016 02:28:54 +0000 Committer: Arnaldo Carvalho de Melo CommitDate: Tue, 26 Apr 2016 10:56:08 -0300 perf evlist: Enforce ring buffer reading Don't read broken data after 'head' pointer. Following commits will feed perf_evlist__mmap_read() with some 'head' pointers not maintained by kernel. If 'head' pointer breaks an event, we should avoid reading from the broken event. This can happen in backward ring buffer. For example: old head | | V V +---+------+----------+----+-----+--+ |..E|D....D|C........C|B..B|A....|E.| +---+------+----------+----+-----+--+ 'old' pointer points to the beginning of 'A' and trying read from it, but 'A' has been overwritten. In this case, don't try to read from 'A', simply return NULL. Signed-off-by: Wang Nan Cc: Peter Zijlstra Cc: Zefan Li Cc: pi3orama@163.com Link: http://lkml.kernel.org/r/1461637738-62722-2-git-send-email-wangnan0@huawei.com Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/evlist.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/tools/perf/util/evlist.c b/tools/perf/util/evlist.c index 6fb5725..85271e5 100644 --- a/tools/perf/util/evlist.c +++ b/tools/perf/util/evlist.c @@ -684,6 +684,7 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx) struct perf_mmap *md = &evlist->mmap[idx]; u64 head; u64 old = md->prev; + int diff; unsigned char *data = md->base + page_size; union perf_event *event = NULL; @@ -694,6 +695,7 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx) return NULL; head = perf_mmap__read_head(md); + diff = head - old; if (evlist->overwrite) { /* * If we're further behind than half the buffer, there's a chance @@ -703,7 +705,6 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx) * * In either case, truncate and restart at head. */ - int diff = head - old; if (diff > md->mask / 2 || diff < 0) { fprintf(stderr, "WARNING: failed to keep up with mmap data.\n"); @@ -711,15 +712,21 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx) * head points to a known good entry, start there. */ old = head; + diff = 0; } } - if (old != head) { + if (diff >= (int)sizeof(event->header)) { size_t size; event = (union perf_event *)&data[old & md->mask]; size = event->header.size; + if (size < sizeof(event->header) || diff < (int)size) { + event = NULL; + goto broken_event; + } + /* * Event straddles the mmap boundary -- header should always * be inside due to u64 alignment of output. @@ -743,6 +750,7 @@ union perf_event *perf_evlist__mmap_read(struct perf_evlist *evlist, int idx) old += size; } +broken_event: md->prev = old; return event;