perf: fix pipe mode read code

In __perf_session__process_pipe_events(), there is a risk we could read more than what a union perf_event struct can hold. This could happen when perf is reading a file which contains new and unknown record types which are larger than anything the tool already knows about (i.e. part of union perf_event).

In general, perf is supposed to skip records it does not understand, but in pipe mode, those have to be read and ignored. They cannot just be skipped. In the current code, the backing for the read is provided by union perf_event. There is no check for the size limit thus there is a risk of buffer overrun:

     union perf_event event;
     void *p;

     size = event->header.size;

     p = &event;
     p += sizeof(struct perf_event_header);
     if (size - sizeof(struct perf_event_header)) {
       err = readn(self->fd, p, size - sizeof(struct perf_event_header));

It should be noted that the same problem may occur with known record types if they have a variable size body (not captured in union perf_event).

We fix this by allocating a buffer based on the size reported in the header. We reuse the buffer as much as we can. We realloc in case it becomes too small. In the  common case, the performance impact is negligible.

Signed-off-by Stephane Eranian <[email protected]>

---

tools/perf/util/session.c +8 -2

index b5ca255..7f078a6 100644
@@ -972,8 +972,9 @@ volatile int session_done;
  static int __perf_session__process_pipe_events(struct perf_session *self,
                                               struct perf_tool *tool)
  {
-       union perf_event event;
-       uint32_t size;
+       union perf_event *event;
+       uint32_t size, cur_size = 0;
+       void *buf = NULL;
        int skip = 0;
        u64 head;
        int err;

@@ -982,8 +983,14 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
        perf_tool__fill_defaults(tool);
 
        head = 0;
+       cur_size = sizeof(union perf_event);
+
+       buf = malloc(cur_size);
+       if (!buf)
+               return -errno;

 more:
-       err = readn(self->fd, &event, sizeof(struct perf_event_header));
+       event = buf;
+       err = readn(self->fd, event, sizeof(struct perf_event_header)); if (err <= 0) {
               if (err == 0)
                       goto done;

tools/perf/util/session.c +14 -5

@@ -993,13 +1000,22 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
        }
 
        if (self->header.needs_swap)
-               perf_event_header__bswap(&event.header);
+               perf_event_header__bswap(&event->header);
 
-       size = event.header.size;
+       size = event->header.size;
        if (size == 0)
                size = 8;
 
-       p = &event;
+       if (size > cur_size) {
+               buf = realloc(buf, size);
+               if (!buf) {
+                       pr_err("failed to allocate memory to read event\n");
+                       goto out_err;
+               }
+               cur_size = size;
+               event = buf;
+       }
+       p = event;
        p += sizeof(struct perf_event_header);
 
        if (size - sizeof(struct perf_event_header)) {

@@ -1015,9 +1031,9 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
                }
        }
 
-       if ((skip = perf_session__process_event(self, &event, tool, head)) < 0) {
+       if ((skip = perf_session__process_event(self, event, tool, head)) < 0) {
                dump_printf("%#" PRIx64 " [%#x]: skipping unknown header type: %d\n",
-                           head, event.header.size, event.header.type);
+                           head, event->header.size, event->header.type);
                /*
                 * assume we lost track of the stream, check alignment, and
                 * increment a single u64 in the hope to catch on again 'soon'.

@@ -1038,6 +1054,7 @@ static int __perf_session__process_pipe_events(struct perf_session *self,

 done:
       err = 0;
 out_err:
+       free(buf); perf_session__warn_about_errors(self, tool); perf_session_free_sample_buffers(self); return err;

Any comment on this patch?

Quoted 76 lines · Stephane Eranian

In __perf_session__process_pipe_events(), there is a risk we could read more than what a union perf_event struct can hold. This could happen when perf is reading a file which contains new and unknown record types which are larger than anything the tool already knows about (i.e. part of union perf_event).

In general, perf is supposed to skip records it does not understand, but in pipe mode, those have to be read and ignored. They cannot just be skipped. In the current code, the backing for the read is provided by union perf_event. There is no check for the size limit thus there is a risk of buffer overrun:

      union perf_event event;
      void *p;

      size = event->header.size;

      p =&event;
      p += sizeof(struct perf_event_header);
      if (size - sizeof(struct perf_event_header)) {
        err = readn(self->fd, p, size - sizeof(struct perf_event_header));

It should be noted that the same problem may occur with known record types if they have a variable size body (not captured in union perf_event).

We fix this by allocating a buffer based on the size reported in the header. We reuse the buffer as much as we can. We realloc in case it becomes too small. In the common case, the performance impact is negligible.

Signed-off-by Stephane Eranian<[email protected]>

---

tools/perf/util/session.c +11 -4

index b5ca255..7f078a6 100644
@@ -972,8 +972,9 @@ volatile int session_done;
  static int __perf_session__process_pipe_events(struct perf_session *self,
                                               struct perf_tool *tool)
  {
-       union perf_event event;
-       uint32_t size;
+       union perf_event *event;
+       uint32_t size, cur_size = 0;
+       void *buf = NULL;
        int skip = 0;
        u64 head;
        int err;

@@ -982,8 +983,14 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
        perf_tool__fill_defaults(tool);
 
        head = 0;
+       cur_size = sizeof(union perf_event);
+
+       buf = malloc(cur_size);
+       if (!buf)
+               return -errno;
  more:
-       err = readn(self->fd,&event, sizeof(struct perf_event_header));
+       event = buf;
+       err = readn(self->fd, event, sizeof(struct perf_event_header));
        if (err<= 0) {
                if (err == 0)
                        goto done;

@@ -993,13 +1000,22 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
        }
 
        if (self->header.needs_swap)
-               perf_event_header__bswap(&event.header);
+               perf_event_header__bswap(&event->header);
 

tools/perf/util/session.c static int __perf_session__process_pipe_events(struct perf_session *self, · line 1010

Quoted 8 lines

tools/perf/util/session.c +3 -2

-       size = event.header.size;
+       size = event->header.size;
        if (size == 0)
                size = 8;
 
-       p =&event;
+       if (size>  cur_size) {
+               buf = realloc(buf, size);

tools/perf/util/session.c static int __perf_session__process_pipe_events(struct perf_session *self, · line 1011

Quoted 1 line

tools/perf/util/session.c +1 -0

+               if (!buf) {

Quoted 30 lines

tools/perf/util/session.c +10 -2

+                       pr_err("failed to allocate memory to read event\n");
+                       goto out_err;
+               }
+               cur_size = size;
+               event = buf;
+       }
+       p = event;
        p += sizeof(struct perf_event_header);
 
        if (size - sizeof(struct perf_event_header)) {

@@ -1015,9 +1031,9 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
                }
        }
 
-       if ((skip = perf_session__process_event(self,&event, tool, head))<  0) {
+       if ((skip = perf_session__process_event(self, event, tool, head))<  0) {
                dump_printf("%#" PRIx64 " [%#x]: skipping unknown header type: %d\n",
-                           head, event.header.size, event.header.type);
+                           head, event->header.size, event->header.type);
                /*
                 * assume we lost track of the stream, check alignment, and
                 * increment a single u64 in the hope to catch on again 'soon'.

@@ -1038,6 +1054,7 @@ static int __perf_session__process_pipe_events(struct perf_session *self,
  done:
        err = 0;
  out_err:
+       free(buf);
        perf_session__warn_about_errors(self, tool);
        perf_session_free_sample_buffers(self);
        return err;

Quoted 91 lines · Stephane Eranian

Any comment on this patch?

Quoted 86 lines · Stephane Eranian

In __perf_session__process_pipe_events(), there is a risk we could read more than what a union perf_event struct can hold. This could happen when perf is reading a file which contains new and unknown record types which are larger than anything the tool already knows about (i.e. part of union perf_event).

In general, perf is supposed to skip records it does not understand, but in pipe mode, those have to be read and ignored. They cannot just be skipped. In the current code, the backing for the read is provided by union perf_event. There is no check for the size limit thus there is a risk of buffer overrun:

     union perf_event event;
     void *p;

     size = event->header.size;

     p =&event;
     p += sizeof(struct perf_event_header);
     if (size - sizeof(struct perf_event_header)) {
       err = readn(self->fd, p, size - sizeof(struct perf_event_header));

It should be noted that the same problem may occur with known record types if they have a variable size body (not captured in union perf_event).

We fix this by allocating a buffer based on the size reported in the header. We reuse the buffer as much as we can. We realloc in case it becomes too small. In the  common case, the performance impact is negligible.

Signed-off-by Stephane Eranian<[email protected]>

---

tools/perf/util/session.c +0 -0

index b5ca255..7f078a6 100644
@@ -972,8 +972,9 @@ volatile int session_done;

 static int __perf_session__process_pipe_events(struct perf_session *self,
                                              struct perf_tool *tool) {
-       union perf_event event;
-       uint32_t size;
+       union perf_event *event;
+       uint32_t size, cur_size = 0;
+       void *buf = NULL;
       int skip = 0;
       u64 head;
       int err;

tools/perf/util/session.c +5 -0

@@ -982,8 +983,14 @@ static int
 __perf_session__process_pipe_events(struct perf_session *self,
        perf_tool__fill_defaults(tool);
 
        head = 0;
+       cur_size = sizeof(union perf_event);
+
+       buf = malloc(cur_size);
+       if (!buf)
+               return -errno;

 more:
-       err = readn(self->fd,&event, sizeof(struct perf_event_header));

+       event = buf;
+       err = readn(self->fd, event, sizeof(struct perf_event_header)); if (err<= 0) {
               if (err == 0)
                       goto done;

tools/perf/util/session.c +2 -2

@@ -993,13 +1000,22 @@ static int
 __perf_session__process_pipe_events(struct perf_session *self,
        }
 
        if (self->header.needs_swap)
-               perf_event_header__bswap(&event.header);
+               perf_event_header__bswap(&event->header);
 
-       size = event.header.size;
+       size = event->header.size;
        if (size == 0)
                size = 8;
 

Quoted 3 lines

tools/perf/util/session.c static int · line 1011

Quoted 3 lines

tools/perf/util/session.c +2 -1

-       p =&event;
+       if (size>  cur_size) {
+               buf = realloc(buf, size);

Arnaldo pointed out recently this leaks memory if realloc failed. Need to save buf before the call ...

Quoted 1 line

tools/perf/util/session.c static int __perf_session__process_pipe_events(struct perf_session *self, · line 1011

Quoted 1 line

tools/perf/util/session.c +1 -0

+               if (!buf) {

... and free on this leg.

David

Quoted 40 lines

Quoted 40 lines

tools/perf/util/session.c +7 -0

+                       pr_err("failed to allocate memory to read
 event\n");
+                       goto out_err;
+               }
+               cur_size = size;
+               event = buf;
+       }
+       p = event;
        p += sizeof(struct perf_event_header);

       if (size - sizeof(struct perf_event_header)) {

tools/perf/util/session.c +1 -1

@@ -1015,9 +1031,9 @@ static int
 __perf_session__process_pipe_events(struct perf_session *self,
                }
        }
 
-       if ((skip = perf_session__process_event(self,&event, tool,
 head))<  0) {
 
+       if ((skip = perf_session__process_event(self, event, tool,
 head))<  0) {

               dump_printf("%#" PRIx64 " [%#x]: skipping unknown header
type: %d\n",
-                           head, event.header.size, event.header.type);
+                           head, event->header.size, event->header.type);
               /*
                * assume we lost track of the stream, check alignment, and
                * increment a single u64 in the hope to catch on again 'soon'.

tools/perf/util/session.c +0 -0

@@ -1038,6 +1054,7 @@ static int
 __perf_session__process_pipe_events(struct perf_session *self,

 done:
       err = 0;
 out_err:
+       free(buf); perf_session__warn_about_errors(self, tool); perf_session_free_sample_buffers(self); return err;