Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1216573 > unrolled thread

[PATCH] perf tools: Fix potential array out of bounce accessing

Started byWang Nan <wangnan0@huawei.com>
First post2015-09-01 05:40 +0200
Last post2015-09-02 09:30 +0200
Articles 5 — 5 participants

Back to article view | Back to linux.kernel

Contents

  [PATCH] perf tools: Fix potential array out of bounce accessing Wang Nan <wangnan0@huawei.com> - 2015-09-01 05:40 +0200
    Re: [PATCH] perf tools: Fix potential array out of bounce accessing Matt Fleming <matt@codeblueprint.co.uk> - 2015-09-01 10:50 +0200
    Re: [PATCH] perf tools: Fix potential array out of bounce accessing Jiri Olsa <jolsa@redhat.com> - 2015-09-01 12:10 +0200
    RE: [PATCH] perf tools: Fix potential array out of bounce accessing 平松雅巳 / HIRAMATU，MASAMI   <masami.hiramatsu.pt@hitachi.com> - 2015-09-01 13:20 +0200
    [tip:perf/urgent] perf dwarf:   Fix potential array out of bounds access tip-bot for Wang Nan <tipbot@zytor.com> - 2015-09-02 09:30 +0200

#1216573 — [PATCH] perf tools: Fix potential array out of bounce accessing

FromWang Nan <wangnan0@huawei.com>
Date2015-09-01 05:40 +0200
Subject[PATCH] perf tools: Fix potential array out of bounce accessing
Message-ID<q3KAq-2Z8-7@gated-at.bofh.it>
There is a problem in dwarf-regs.c of sh, sparc and x86 that it is
possible to make an out-of-bound array accessing when searching
register names. This patch fixes it by replacing '<=' to '<', so when
register (number == XXX_MAX_REGS), get_arch_regstr() returns NULL.

Signed-off-by: Wang Nan <wangnan0@huawei.com>
Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Matt Fleming <matt@console-pimps.org>
Cc: Jiri Olsa <jolsa@kernel.org>
---
 tools/perf/arch/sh/util/dwarf-regs.c    | 2 +-
 tools/perf/arch/sparc/util/dwarf-regs.c | 2 +-
 tools/perf/arch/x86/util/dwarf-regs.c   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/perf/arch/sh/util/dwarf-regs.c b/tools/perf/arch/sh/util/dwarf-regs.c
index 0d0897f..f8dfa89 100644
--- a/tools/perf/arch/sh/util/dwarf-regs.c
+++ b/tools/perf/arch/sh/util/dwarf-regs.c
@@ -51,5 +51,5 @@ const char *sh_regs_table[SH_MAX_REGS] = {
 /* Return architecture dependent register string (for kprobe-tracer) */
 const char *get_arch_regstr(unsigned int n)
 {
-	return (n <= SH_MAX_REGS) ? sh_regs_table[n] : NULL;
+	return (n < SH_MAX_REGS) ? sh_regs_table[n] : NULL;
 }
diff --git a/tools/perf/arch/sparc/util/dwarf-regs.c b/tools/perf/arch/sparc/util/dwarf-regs.c
index 92eda41..b704fdb 100644
--- a/tools/perf/arch/sparc/util/dwarf-regs.c
+++ b/tools/perf/arch/sparc/util/dwarf-regs.c
@@ -39,5 +39,5 @@ const char *sparc_regs_table[SPARC_MAX_REGS] = {
  */
 const char *get_arch_regstr(unsigned int n)
 {
-	return (n <= SPARC_MAX_REGS) ? sparc_regs_table[n] : NULL;
+	return (n < SPARC_MAX_REGS) ? sparc_regs_table[n] : NULL;
 }
diff --git a/tools/perf/arch/x86/util/dwarf-regs.c b/tools/perf/arch/x86/util/dwarf-regs.c
index be22dd4..a08de0a 100644
--- a/tools/perf/arch/x86/util/dwarf-regs.c
+++ b/tools/perf/arch/x86/util/dwarf-regs.c
@@ -71,5 +71,5 @@ const char *x86_64_regs_table[X86_64_MAX_REGS] = {
 /* Return architecture dependent register string (for kprobe-tracer) */
 const char *get_arch_regstr(unsigned int n)
 {
-	return (n <= ARCH_MAX_REGS) ? arch_regs_table[n] : NULL;
+	return (n < ARCH_MAX_REGS) ? arch_regs_table[n] : NULL;
 }
-- 
1.8.3.4

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [next] | [standalone]

#1216696

FromMatt Fleming <matt@codeblueprint.co.uk>
Date2015-09-01 10:50 +0200
Message-ID<q3Pqr-1sL-29@gated-at.bofh.it>
In reply to#1216573
On Tue, 01 Sep, at 03:29:44AM, Wang Nan wrote:
> There is a problem in dwarf-regs.c of sh, sparc and x86 that it is
> possible to make an out-of-bound array accessing when searching
> register names. This patch fixes it by replacing '<=' to '<', so when
> register (number == XXX_MAX_REGS), get_arch_regstr() returns NULL.
> 
> Signed-off-by: Wang Nan <wangnan0@huawei.com>
> Cc: Arnaldo Carvalho de Melo <acme@redhat.com>
> Cc: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
> Cc: David S. Miller <davem@davemloft.net>
> Cc: Matt Fleming <matt@console-pimps.org>
> Cc: Jiri Olsa <jolsa@kernel.org>
> ---
>  tools/perf/arch/sh/util/dwarf-regs.c    | 2 +-
>  tools/perf/arch/sparc/util/dwarf-regs.c | 2 +-
>  tools/perf/arch/x86/util/dwarf-regs.c   | 2 +-
>  3 files changed, 3 insertions(+), 3 deletions(-)

Hmm, I wonder how that bug was introduced. I guess copy and paste is
probably to blame. Good catch.

Reviewed-by: Matt Fleming <matt.fleming@intel.com>

-- 
Matt Fleming, Intel Open Source Technology Center
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1216738

FromJiri Olsa <jolsa@redhat.com>
Date2015-09-01 12:10 +0200
Message-ID<q3QFQ-3qt-19@gated-at.bofh.it>
In reply to#1216573
On Tue, Sep 01, 2015 at 03:29:44AM +0000, Wang Nan wrote:
> There is a problem in dwarf-regs.c of sh, sparc and x86 that it is
> possible to make an out-of-bound array accessing when searching
> register names. This patch fixes it by replacing '<=' to '<', so when
> register (number == XXX_MAX_REGS), get_arch_regstr() returns NULL.
> 

Acked-by: Jiri Olsa <jolsa@kernel.org>

thanks,
jirka
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1216778

From平松雅巳 / HIRAMATU，MASAMI <masami.hiramatsu.pt@hitachi.com>
Date2015-09-01 13:20 +0200
Message-ID<q3RLA-4Wc-17@gated-at.bofh.it>
In reply to#1216573
PiBGcm9tOiBXYW5nIE5hbiBbbWFpbHRvOndhbmduYW4wQGh1YXdlaS5jb21dDQo+IA0KPiBUaGVy
ZSBpcyBhIHByb2JsZW0gaW4gZHdhcmYtcmVncy5jIG9mIHNoLCBzcGFyYyBhbmQgeDg2IHRoYXQg
aXQgaXMNCj4gcG9zc2libGUgdG8gbWFrZSBhbiBvdXQtb2YtYm91bmQgYXJyYXkgYWNjZXNzaW5n
IHdoZW4gc2VhcmNoaW5nDQo+IHJlZ2lzdGVyIG5hbWVzLiBUaGlzIHBhdGNoIGZpeGVzIGl0IGJ5
IHJlcGxhY2luZyAnPD0nIHRvICc8Jywgc28gd2hlbg0KPiByZWdpc3RlciAobnVtYmVyID09IFhY
WF9NQVhfUkVHUyksIGdldF9hcmNoX3JlZ3N0cigpIHJldHVybnMgTlVMTC4NCg0KT29wcywgcmln
aHQhDQoNCkFja2VkLWJ5OiBNYXNhbWkgSGlyYW1hdHN1IDxtYXNhbWkuaGlyYW1hdHN1LnB0QGhp
dGFjaGkuY29tPg0KDQpUaGFuayB5b3UhDQoNCj4gDQo+IFNpZ25lZC1vZmYtYnk6IFdhbmcgTmFu
IDx3YW5nbmFuMEBodWF3ZWkuY29tPg0KPiBDYzogQXJuYWxkbyBDYXJ2YWxobyBkZSBNZWxvIDxh
Y21lQHJlZGhhdC5jb20+DQo+IENjOiBNYXNhbWkgSGlyYW1hdHN1IDxtYXNhbWkuaGlyYW1hdHN1
LnB0QGhpdGFjaGkuY29tPg0KPiBDYzogRGF2aWQgUy4gTWlsbGVyIDxkYXZlbUBkYXZlbWxvZnQu
bmV0Pg0KPiBDYzogTWF0dCBGbGVtaW5nIDxtYXR0QGNvbnNvbGUtcGltcHMub3JnPg0KPiBDYzog
SmlyaSBPbHNhIDxqb2xzYUBrZXJuZWwub3JnPg0KPiAtLS0NCj4gIHRvb2xzL3BlcmYvYXJjaC9z
aC91dGlsL2R3YXJmLXJlZ3MuYyAgICB8IDIgKy0NCj4gIHRvb2xzL3BlcmYvYXJjaC9zcGFyYy91
dGlsL2R3YXJmLXJlZ3MuYyB8IDIgKy0NCj4gIHRvb2xzL3BlcmYvYXJjaC94ODYvdXRpbC9kd2Fy
Zi1yZWdzLmMgICB8IDIgKy0NCj4gIDMgZmlsZXMgY2hhbmdlZCwgMyBpbnNlcnRpb25zKCspLCAz
IGRlbGV0aW9ucygtKQ0KPiANCj4gZGlmZiAtLWdpdCBhL3Rvb2xzL3BlcmYvYXJjaC9zaC91dGls
L2R3YXJmLXJlZ3MuYyBiL3Rvb2xzL3BlcmYvYXJjaC9zaC91dGlsL2R3YXJmLXJlZ3MuYw0KPiBp
bmRleCAwZDA4OTdmLi5mOGRmYTg5IDEwMDY0NA0KPiAtLS0gYS90b29scy9wZXJmL2FyY2gvc2gv
dXRpbC9kd2FyZi1yZWdzLmMNCj4gKysrIGIvdG9vbHMvcGVyZi9hcmNoL3NoL3V0aWwvZHdhcmYt
cmVncy5jDQo+IEBAIC01MSw1ICs1MSw1IEBAIGNvbnN0IGNoYXIgKnNoX3JlZ3NfdGFibGVbU0hf
TUFYX1JFR1NdID0gew0KPiAgLyogUmV0dXJuIGFyY2hpdGVjdHVyZSBkZXBlbmRlbnQgcmVnaXN0
ZXIgc3RyaW5nIChmb3Iga3Byb2JlLXRyYWNlcikgKi8NCj4gIGNvbnN0IGNoYXIgKmdldF9hcmNo
X3JlZ3N0cih1bnNpZ25lZCBpbnQgbikNCj4gIHsNCj4gLQlyZXR1cm4gKG4gPD0gU0hfTUFYX1JF
R1MpID8gc2hfcmVnc190YWJsZVtuXSA6IE5VTEw7DQo+ICsJcmV0dXJuIChuIDwgU0hfTUFYX1JF
R1MpID8gc2hfcmVnc190YWJsZVtuXSA6IE5VTEw7DQo+ICB9DQo+IGRpZmYgLS1naXQgYS90b29s
cy9wZXJmL2FyY2gvc3BhcmMvdXRpbC9kd2FyZi1yZWdzLmMgYi90b29scy9wZXJmL2FyY2gvc3Bh
cmMvdXRpbC9kd2FyZi1yZWdzLmMNCj4gaW5kZXggOTJlZGE0MS4uYjcwNGZkYiAxMDA2NDQNCj4g
LS0tIGEvdG9vbHMvcGVyZi9hcmNoL3NwYXJjL3V0aWwvZHdhcmYtcmVncy5jDQo+ICsrKyBiL3Rv
b2xzL3BlcmYvYXJjaC9zcGFyYy91dGlsL2R3YXJmLXJlZ3MuYw0KPiBAQCAtMzksNSArMzksNSBA
QCBjb25zdCBjaGFyICpzcGFyY19yZWdzX3RhYmxlW1NQQVJDX01BWF9SRUdTXSA9IHsNCj4gICAq
Lw0KPiAgY29uc3QgY2hhciAqZ2V0X2FyY2hfcmVnc3RyKHVuc2lnbmVkIGludCBuKQ0KPiAgew0K
PiAtCXJldHVybiAobiA8PSBTUEFSQ19NQVhfUkVHUykgPyBzcGFyY19yZWdzX3RhYmxlW25dIDog
TlVMTDsNCj4gKwlyZXR1cm4gKG4gPCBTUEFSQ19NQVhfUkVHUykgPyBzcGFyY19yZWdzX3RhYmxl
W25dIDogTlVMTDsNCj4gIH0NCj4gZGlmZiAtLWdpdCBhL3Rvb2xzL3BlcmYvYXJjaC94ODYvdXRp
bC9kd2FyZi1yZWdzLmMgYi90b29scy9wZXJmL2FyY2gveDg2L3V0aWwvZHdhcmYtcmVncy5jDQo+
IGluZGV4IGJlMjJkZDQuLmEwOGRlMGEgMTAwNjQ0DQo+IC0tLSBhL3Rvb2xzL3BlcmYvYXJjaC94
ODYvdXRpbC9kd2FyZi1yZWdzLmMNCj4gKysrIGIvdG9vbHMvcGVyZi9hcmNoL3g4Ni91dGlsL2R3
YXJmLXJlZ3MuYw0KPiBAQCAtNzEsNSArNzEsNSBAQCBjb25zdCBjaGFyICp4ODZfNjRfcmVnc190
YWJsZVtYODZfNjRfTUFYX1JFR1NdID0gew0KPiAgLyogUmV0dXJuIGFyY2hpdGVjdHVyZSBkZXBl
bmRlbnQgcmVnaXN0ZXIgc3RyaW5nIChmb3Iga3Byb2JlLXRyYWNlcikgKi8NCj4gIGNvbnN0IGNo
YXIgKmdldF9hcmNoX3JlZ3N0cih1bnNpZ25lZCBpbnQgbikNCj4gIHsNCj4gLQlyZXR1cm4gKG4g
PD0gQVJDSF9NQVhfUkVHUykgPyBhcmNoX3JlZ3NfdGFibGVbbl0gOiBOVUxMOw0KPiArCXJldHVy
biAobiA8IEFSQ0hfTUFYX1JFR1MpID8gYXJjaF9yZWdzX3RhYmxlW25dIDogTlVMTDsNCj4gIH0N
Cj4gLS0NCj4gMS44LjMuNA0KDQo=
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [next] | [standalone]

#1217365 — [tip:perf/urgent] perf dwarf: Fix potential array out of bounds access

Fromtip-bot for Wang Nan <tipbot@zytor.com>
Date2015-09-02 09:30 +0200
Subject[tip:perf/urgent] perf dwarf: Fix potential array out of bounds access
Message-ID<q4aEy-6H0-7@gated-at.bofh.it>
In reply to#1216573
Commit-ID:  3b27d13940c3710a1128527c43719cb0bb05d73b
Gitweb:     http://git.kernel.org/tip/3b27d13940c3710a1128527c43719cb0bb05d73b
Author:     Wang Nan <wangnan0@huawei.com>
AuthorDate: Tue, 1 Sep 2015 03:29:44 +0000
Committer:  Arnaldo Carvalho de Melo <acme@redhat.com>
CommitDate: Tue, 1 Sep 2015 11:33:48 -0300

perf dwarf: Fix potential array out of bounds access

There is a problem in the dwarf-regs.c files for sh, sparc and x86 where
it is possible to make an out-of-bounds array access when searching for
register names.

This patch fixes it by replacing '<=' to '<', so when register (number
== XXX_MAX_REGS), get_arch_regstr() will return NULL.

Signed-off-by: Wang Nan <wangnan0@huawei.com>
Reviewed-by: Matt Fleming <matt@console-pimps.org>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: David S. Miller <davem@davemloft.net>
Cc: Zefan Li <lizefan@huawei.com>
Cc: pi3orama@huawei.com
Link: http://lkml.kernel.org/r/1441078184-105038-1-git-send-email-wangnan0@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
 tools/perf/arch/sh/util/dwarf-regs.c    | 2 +-
 tools/perf/arch/sparc/util/dwarf-regs.c | 2 +-
 tools/perf/arch/x86/util/dwarf-regs.c   | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/tools/perf/arch/sh/util/dwarf-regs.c b/tools/perf/arch/sh/util/dwarf-regs.c
index 0d0897f..f8dfa89 100644
--- a/tools/perf/arch/sh/util/dwarf-regs.c
+++ b/tools/perf/arch/sh/util/dwarf-regs.c
@@ -51,5 +51,5 @@ const char *sh_regs_table[SH_MAX_REGS] = {
 /* Return architecture dependent register string (for kprobe-tracer) */
 const char *get_arch_regstr(unsigned int n)
 {
-	return (n <= SH_MAX_REGS) ? sh_regs_table[n] : NULL;
+	return (n < SH_MAX_REGS) ? sh_regs_table[n] : NULL;
 }
diff --git a/tools/perf/arch/sparc/util/dwarf-regs.c b/tools/perf/arch/sparc/util/dwarf-regs.c
index 92eda41..b704fdb 100644
--- a/tools/perf/arch/sparc/util/dwarf-regs.c
+++ b/tools/perf/arch/sparc/util/dwarf-regs.c
@@ -39,5 +39,5 @@ const char *sparc_regs_table[SPARC_MAX_REGS] = {
  */
 const char *get_arch_regstr(unsigned int n)
 {
-	return (n <= SPARC_MAX_REGS) ? sparc_regs_table[n] : NULL;
+	return (n < SPARC_MAX_REGS) ? sparc_regs_table[n] : NULL;
 }
diff --git a/tools/perf/arch/x86/util/dwarf-regs.c b/tools/perf/arch/x86/util/dwarf-regs.c
index be22dd4..a08de0a 100644
--- a/tools/perf/arch/x86/util/dwarf-regs.c
+++ b/tools/perf/arch/x86/util/dwarf-regs.c
@@ -71,5 +71,5 @@ const char *x86_64_regs_table[X86_64_MAX_REGS] = {
 /* Return architecture dependent register string (for kprobe-tracer) */
 const char *get_arch_regstr(unsigned int n)
 {
-	return (n <= ARCH_MAX_REGS) ? arch_regs_table[n] : NULL;
+	return (n < ARCH_MAX_REGS) ? arch_regs_table[n] : NULL;
 }
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web