Skip to contentSkip to conversation

perf util: Fix bad memory access in trace info.

PATCH New [email protected] 2 participants 2 messages Aug 29, 2018 – Sep 6, 2018 perf events

lore
Share & tools
lore
#0 lore raw

PATCH 1/1 perf util: Fix bad memory access in trace info.

From: Chris Phlipot <[email protected]>

In the write to the output_fd in the error condition of record_saved_cmdline(), we are writing 8 bytes from a memory location on the stack that contains a primitive that is only 4 bytes in size. Change the primitive to 8 bytes in size to match the size of the write in order to avoid reading unknown memory from the stack.

---
 tools/perf/util/trace-event-info.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/trace-event-info.c +1 -1
index c85d0d1a65ed..7b0ca7cbb7de 100644
@@ -377,7 +377,7 @@ static int record_ftrace_printk(void)
 
 static int record_saved_cmdline(void)
 {
-	unsigned int size;
+	unsigned long long size;
 	char *path;
 	struct stat st;
 	int ret, err = 0;
Signature · 1 line
2.17.1
#1 lore raw
perf util: Fix bad memory access in trace info.
Commit-ID:  a72f64261359b7451f8478f2a2bf357b4e6c757f
Gitweb:     https://git.kernel.org/tip/a72f64261359b7451f8478f2a2bf357b4e6c757f
Author:     Chris Phlipot <[email protected]>
AuthorDate: Tue, 28 Aug 2018 23:19:54 -0700
Committer:  Arnaldo Carvalho de Melo <[email protected]>
CommitDate: Thu, 30 Aug 2018 14:50:50 -0300

perf util: Fix bad memory access in trace info.

In the write to the output_fd in the error condition of record_saved_cmdline(), we are writing 8 bytes from a memory location on the stack that contains a primitive that is only 4 bytes in size. Change the primitive to 8 bytes in size to match the size of the write in order to avoid reading unknown memory from the stack.

---
 tools/perf/util/trace-event-info.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
tools/perf/util/trace-event-info.c +1 -1
index c85d0d1a65ed..7b0ca7cbb7de 100644
@@ -377,7 +377,7 @@ out:
 
 static int record_saved_cmdline(void)
 {
-	unsigned int size;
+	unsigned long long size;
 	char *path;
 	struct stat st;
 	int ret, err = 0;