• Athira Rajeev's avatar
    tools/perf: Fix out of bound access to cpu mask array · cbd7bfc7
    Athira Rajeev authored
    The cpu mask init code in "record__mmap_cpu_mask_init" function access
    "bits" array part of "struct mmap_cpu_mask".  The size of this array is
    the value from cpu__max_cpu().cpu.  This array is used to contain the
    cpumask value for each cpu. While setting bit for each cpu, it calls
    "set_bit" function which access index in "bits" array.
    
    If we provide a command line option to -C which is greater than the
    number of CPU's present in the system, the set_bit could access an array
    member which is out-of the array size. This is because currently, there
    is no boundary check for the CPU. This will result in seg fault:
    
    <<>>
      ./perf record -C 12341234 ls
      Perf can support 2048 CPUs. Consider raising MAX_NR_CPUS
      Segmentation fault (core dumped)
    <<>>
    
    Debugging with gdb, points to function flow as below:
    
    <<>>
      set_bit
      record__mmap_cpu_mask_init
      record__init_thread_default_masks
      record__init_thread_masks
      cmd_record
    <<>>
    
    Fix this by adding boundary check for the array.
    
    After the patch:
    
    <<>>
    ./perf record -C 12341234 ls
      Perf can support 2048 CPUs. Consider raising MAX_NR_CPUS
      Failed to initialize parallel data streaming masks
    <<>>
    
    With this fix, if -C is given a non-exsiting CPU, perf
    record will fail with:
    
    <<>>
      ./perf record -C 50 ls
      Failed to initialize parallel data streaming masks
    <<>>
    Reported-by: default avatarNageswara R Sastry <rnsastry@linux.ibm.com>
    Signed-off-by: default avatarAthira Jajeev <atrajeev@linux.vnet.ibm.com>
    Tested-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
    Tested-by: default avatarNageswara R Sastry <rnsastry@linux.ibm.com>
    Cc: Jiri Olsa <jolsa@kernel.org>
    Cc: Kajol Jain <kjain@linux.ibm.com>
    Cc: Madhavan Srinivasan <maddy@linux.vnet.ibm.com>
    Cc: Michael Ellerman <mpe@ellerman.id.au>
    Cc: linuxppc-dev@lists.ozlabs.org
    Link: https://lore.kernel.org/r/20220905141929.7171-2-atrajeev@linux.vnet.ibm.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
    cbd7bfc7
builtin-record.c 108 KB