Commit 554e92ed authored by Adrian Hunter's avatar Adrian Hunter Committed by Arnaldo Carvalho de Melo

perf session: Fix perf_session__peek_event()

perf_session__peek_event() generally leverages there being a single mmap
of the perf.data file, however on 32-bit platforms when there is more
that 32MiB of data, then there are multiple mmaps, so
perf_session__peek_event() reads from the file.

In that case a couple of bugs were exposed (note how the seg. fault
appears with >32M of data):

   $ perf record --per-thread -e intel_bts// ../rtit-tests/loopy 1000000
   [ perf record: Woken up 13 times to write data ]
   [ perf record: Captured and wrote 24.568 MB perf.data ]
   $ perf script > /dev/null
   $ perf record --per-thread -e intel_bts// ../rtit-tests/loopy 10000000
   [ perf record: Woken up 136 times to write data ]
   [ perf record: Captured and wrote 270.794 MB perf.data ]
   $ perf script > /dev/null
   Segmentation fault (core dumped)

The wrong address was being passed to the readn() function and the
buffer size was not being checked.
Signed-off-by: default avatarAdrian Hunter <adrian.hunter@intel.com>
Cc: Jiri Olsa <jolsa@redhat.com>
Cc: Namhyung Kim <namhyung@gmail.com>
Link: http://lkml.kernel.org/r/1432040746-1755-5-git-send-email-adrian.hunter@intel.comSigned-off-by: default avatarArnaldo Carvalho de Melo <acme@redhat.com>
parent 05b41775
...@@ -1182,7 +1182,7 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset, ...@@ -1182,7 +1182,7 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
return -1; return -1;
if (lseek(fd, file_offset, SEEK_SET) == (off_t)-1 || if (lseek(fd, file_offset, SEEK_SET) == (off_t)-1 ||
readn(fd, &buf, hdr_sz) != (ssize_t)hdr_sz) readn(fd, buf, hdr_sz) != (ssize_t)hdr_sz)
return -1; return -1;
event = (union perf_event *)buf; event = (union perf_event *)buf;
...@@ -1190,12 +1190,12 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset, ...@@ -1190,12 +1190,12 @@ int perf_session__peek_event(struct perf_session *session, off_t file_offset,
if (session->header.needs_swap) if (session->header.needs_swap)
perf_event_header__bswap(&event->header); perf_event_header__bswap(&event->header);
if (event->header.size < hdr_sz) if (event->header.size < hdr_sz || event->header.size > buf_sz)
return -1; return -1;
rest = event->header.size - hdr_sz; rest = event->header.size - hdr_sz;
if (readn(fd, &buf, rest) != (ssize_t)rest) if (readn(fd, buf, rest) != (ssize_t)rest)
return -1; return -1;
if (session->header.needs_swap) if (session->header.needs_swap)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment