Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Date:   Thu, 7 Nov 2019 10:42:26 +0100
From:   Jiri Olsa <jolsa@redhat.com>
To:     Leo Yan <leo.yan@linaro.org>
Cc:     Arnaldo Carvalho de Melo <acme@kernel.org>,
        Peter Zijlstra <peterz@infradead.org>,
        Ingo Molnar <mingo@redhat.com>,
        Mark Rutland <mark.rutland@arm.com>,
        Alexander Shishkin <alexander.shishkin@linux.intel.com>,
        Namhyung Kim <namhyung@kernel.org>,
        linux-kernel@vger.kernel.org,
        Naresh Kamboju <naresh.kamboju@linaro.org>
Subject: Re: [PATCH v2] perf tests: Fix out of bounds memory access
Message-ID: <20191107094226.GC14657@krava>
References: <20191107020244.2427-1-leo.yan@linaro.org>
MIME-Version: 1.0
In-Reply-To: <20191107020244.2427-1-leo.yan@linaro.org>
User-Agent: Mutt/1.12.1 (2019-06-15)
Content-Type: text/plain; charset=WINDOWS-1252
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On Thu, Nov 07, 2019 at 10:02:44AM +0800, Leo Yan wrote:
> The test case 'Read backward ring buffer' failed on 32-bit architectures
> which were found by LKFT perf testing.  The test failed on arm32 x15
> device, qemu_arm32, qemu_i386, and found intermittent failure on i386;
> the failure log is as below:
>=20
>   50: Read backward ring buffer                  :
>   --- start ---
>   test child forked, pid 510
>   Using CPUID GenuineIntel-6-9E-9
>   mmap size 1052672B
>   mmap size 8192B
>   Finished reading overwrite ring buffer: rewind
>   free(): invalid next size (fast)
>   test child interrupted
>   ---- end ----
>   Read backward ring buffer: FAILED!
>=20
> The log hints there have issue for memory usage, thus free() reports
> error 'invalid next size' and directly exit for the case.  Finally, this
> issue is root caused as out of bounds memory access for the data array
> 'evsel->id'.
>=20
> The backward ring buffer test invokes do_test() twice.  'evsel->id' is
> allocated at the first call with the flow:
>=20
>   test__backward_ring_buffer()
>     `-> do_test()
> =09  `-> evlist__mmap()
> =09        `-> evlist__mmap_ex()
> =09              `-> perf_evsel__alloc_id()
>=20
> So 'evsel->id' is allocated with one item, and it will be used in
> function perf_evlist__id_add():
>=20
>    evsel->id[0] =3D id
>    evsel->ids   =3D 1
>=20
> At the second call for do_test(), it skips to initialize 'evsel->id'
> and reuses the array which is allocated in the first call.  But
> 'evsel->ids' contains the stale value.  Thus:
>=20
>    evsel->id[1] =3D id    -> out of bound access
>    evsel->ids   =3D 2
>=20
> To fix this issue, we will use evlist__open() and evlist__close() pair
> functions to prepare and cleanup context for evlist; so 'evsel->id' and
> 'evsel->ids' can be initialized properly when invoke do_test() and avoid
> the out of bounds memory access.

right, we need to solve this on libperf level, so it's possible
to call mmap/munmap multiple time without close/open.. I'll try
to send something, but meanwhile this is good workaround

Reviewed-by: Jiri Olsa <jolsa@kernel.org>

thanks,
jirka

>=20
> Signed-off-by: Leo Yan <leo.yan@linaro.org>
> ---
>  tools/perf/tests/backward-ring-buffer.c | 9 +++++++++
>  1 file changed, 9 insertions(+)
>=20
> diff --git a/tools/perf/tests/backward-ring-buffer.c b/tools/perf/tests/b=
ackward-ring-buffer.c
> index 338cd9faa835..5128f727c0ef 100644
> --- a/tools/perf/tests/backward-ring-buffer.c
> +++ b/tools/perf/tests/backward-ring-buffer.c
> @@ -147,6 +147,15 @@ int test__backward_ring_buffer(struct test *test __m=
aybe_unused, int subtest __m
>  =09=09goto out_delete_evlist;
>  =09}
> =20
> +=09evlist__close(evlist);
> +
> +=09err =3D evlist__open(evlist);
> +=09if (err < 0) {
> +=09=09pr_debug("perf_evlist__open: %s\n",
> +=09=09=09 str_error_r(errno, sbuf, sizeof(sbuf)));
> +=09=09goto out_delete_evlist;
> +=09}
> +
>  =09err =3D do_test(evlist, 1, &sample_count, &comm_count);
>  =09if (err !=3D TEST_OK)
>  =09=09goto out_delete_evlist;
> --=20
> 2.17.1
>=20