Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1524981

Re: perf: fuzzer KASAN: global-out-of-bounds in match_token

Show all headers | View raw

On Thu, 17 Nov 2016, Vince Weaver wrote:

> On Thu, 17 Nov 2016, Vince Weaver wrote:
> > > 
> > > [  911.507365] ==================================================================
> > > [  911.514824] BUG: KASAN: global-out-of-bounds in match_token+0x268/0x310 at addr ffffffffb14ad058
> > > [  911.523912] Read of size 8 by task perf_fuzzer/20662
> > > [  911.528945] Address belongs to variable if_tokens+0x78/0xa0

I managed to create a short reproducer that reliably causes the issue on 
my skylake test machine.



/* simplified perf_fuzzer test case */
/* that triggers BUG: KASAN: global-out-of-bounds in match_token+0x288 */
/* on a skylake machine running Linux 4.9-rc5 */
/* by Vince Weaver <vincent.weaver _at_ maine.edu> */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <linux/perf_event.h>


int perf_event_open(struct perf_event_attr *hw_event_uptr,
	pid_t pid, int cpu, int group_fd, unsigned long flags) {

	return syscall(__NR_perf_event_open,hw_event_uptr, pid, cpu,
		group_fd, flags);
}

int main(int argc, char **argv) {

	int fd7;
	struct perf_event_attr pe7;

	char filter[]="(((to&733)&&common_type&605)||common_flags<386922879890793102)";

	memset(&pe7,0,sizeof(struct perf_event_attr));
	pe7.type=7;		/* intel_pt */
	pe7.size=72;
	pe7.config=0x200ULL;	/* bit 10 = tsc */
	pe7.read_format=PERF_FORMAT_TOTAL_TIME_ENABLED; /* 1 */
	pe7.disabled=1;
	pe7.pinned=1;
	pe7.comm_exec=1;

	fd7=perf_event_open(&pe7,
				0, /* current thread */
				0, /* Only cpu 0 */
				-1, /* group leader */
				PERF_FLAG_FD_NO_GROUP /*1*/ );

	ioctl(fd7, PERF_EVENT_IOC_SET_FILTER , &filter);

	return 0;
}

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

perf: fuzzer KASAN: global-out-of-bounds in match_token Vince Weaver <vincent.weaver@maine.edu> - 2016-11-17 21:30 +0100
  Re: perf: fuzzer KASAN: global-out-of-bounds in match_token Vince Weaver <vincent.weaver@maine.edu> - 2016-11-17 21:40 +0100
    Re: perf: fuzzer KASAN: global-out-of-bounds in match_token Vince Weaver <vincent.weaver@maine.edu> - 2016-11-17 23:20 +0100
      Re: perf: fuzzer KASAN: global-out-of-bounds in match_token Vince Weaver <vincent.weaver@maine.edu> - 2016-11-18 04:00 +0100
        Re: perf: fuzzer KASAN: global-out-of-bounds in match_token Ingo Molnar <mingo@kernel.org> - 2016-11-18 09:30 +0100
        Re: perf: fuzzer KASAN: global-out-of-bounds in match_token Alexander Shishkin <alexander.shishkin@linux.intel.com> - 2016-11-18 12:50 +0100
          Re: perf: fuzzer KASAN: global-out-of-bounds in match_token Vince Weaver <vincent.weaver@maine.edu> - 2016-11-18 19:10 +0100
          [tip:perf/urgent] perf/core: Fix address filter parser tip-bot for Alexander Shishkin <tipbot@zytor.com> - 2016-11-21 11:40 +0100
  Re: perf: fuzzer KASAN: global-out-of-bounds in match_token Andi Kleen <andi@firstfloor.org> - 2016-11-18 00:20 +0100

csiph-web