Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Sun, 3 Nov 2019 23:24:41 +0100
From:   Jiri Olsa <jolsa@redhat.com>
To:     Alexey Budankov <alexey.budankov@linux.intel.com>,
        Arnaldo Carvalho de Melo <acme@kernel.org>
Cc:     Peter Zijlstra <peterz@infradead.org>,
        Ingo Molnar <mingo@redhat.com>,
        Alexander Shishkin <alexander.shishkin@linux.intel.com>,
        Namhyung Kim <namhyung@kernel.org>,
        Andi Kleen <ak@linux.intel.com>,
        linux-kernel <linux-kernel@vger.kernel.org>
Subject: [RFC] perf session: Fix compression processing
Message-ID: <20191103222441.GE8251@krava>
MIME-Version: 1.0
User-Agent: Mutt/1.12.1 (2019-06-15)
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

hi,
I'm not sure I follow everything on compression,
so I might have missed something, but patch below
fixes the issue for me.

jirka


---
The compressed data processing occasionally fails with:
  $ perf report --stdio -vv
  decomp (B): 44519 to 163000
  decomp (B): 48119 to 174800
  decomp (B): 65527 to 131072
  fetch_mmaped_event: head=3D0x1ffe0 event->header_size=3D0x28, mmap_size=
=3D0x20000: fuzzed perf.data?
  Error:
  failed to process sample
  ...

It's caused by recent fuzzer fix that does not take into account
that compressed data do not need to by fully present in the buffer,
so it's ok to just return NULL and not to fail.

Fixes: 57fc032ad643 ("perf session: Avoid infinite loop when seeing invalid=
 header.size")
Link: http://lkml.kernel.org/n/tip-q1biqscs4stcmc9bs1iokfro@git.kernel.org
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 tools/perf/util/session.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
index f07b8ecb91bc..3589ed14a629 100644
--- a/tools/perf/util/session.c
+++ b/tools/perf/util/session.c
@@ -1959,7 +1959,7 @@ static int __perf_session__process_pipe_events(struct=
 perf_session *session)
=20
 static union perf_event *
 fetch_mmaped_event(struct perf_session *session,
-=09=09   u64 head, size_t mmap_size, char *buf)
+=09=09   u64 head, size_t mmap_size, char *buf, bool decomp)
 {
 =09union perf_event *event;
=20
@@ -1979,6 +1979,8 @@ fetch_mmaped_event(struct perf_session *session,
 =09=09/* We're not fetching the event so swap back again */
 =09=09if (session->header.needs_swap)
 =09=09=09perf_event_header__bswap(&event->header);
+=09=09if (decomp)
+=09=09=09return NULL;
 =09=09pr_debug("%s: head=3D%#" PRIx64 " event->header_size=3D%#x, mmap_siz=
e=3D%#zx: fuzzed perf.data?\n",
 =09=09=09 __func__, head, event->header.size, mmap_size);
 =09=09return ERR_PTR(-EINVAL);
@@ -1997,7 +1999,7 @@ static int __perf_session__process_decomp_events(stru=
ct perf_session *session)
 =09=09return 0;
=20
 =09while (decomp->head < decomp->size && !session_done()) {
-=09=09union perf_event *event =3D fetch_mmaped_event(session, decomp->head=
, decomp->size, decomp->data);
+=09=09union perf_event *event =3D fetch_mmaped_event(session, decomp->head=
, decomp->size, decomp->data, true);
=20
 =09=09if (IS_ERR(event))
 =09=09=09return PTR_ERR(event);
@@ -2100,7 +2102,7 @@ reader__process_events(struct reader *rd, struct perf=
_session *session,
 =09}
=20
 more:
-=09event =3D fetch_mmaped_event(session, head, mmap_size, buf);
+=09event =3D fetch_mmaped_event(session, head, mmap_size, buf, false);
 =09if (IS_ERR(event))
 =09=09return PTR_ERR(event);
=20
--=20
2.21.0