This is a note to let you know that I've just added the patch titled
perf tools: Incorrect use of snprintf results in SEGV
to the 3.0-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
perf-tools-incorrect-use-of-snprintf-results-in-segv.patch
and it can be found in the queue-3.0 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <[email protected]> know about it.
>From b832796caa1fda8516464a003c8c7cc547bc20c2 Mon Sep 17 00:00:00 2001
From: Anton Blanchard <[email protected]>
Date: Wed, 7 Mar 2012 11:42:49 +1100
Subject: perf tools: Incorrect use of snprintf results in SEGV
From: Anton Blanchard <[email protected]>
commit b832796caa1fda8516464a003c8c7cc547bc20c2 upstream.
I have a workload where perf top scribbles over the stack and we SEGV.
What makes it interesting is that an snprintf is causing this.
The workload is a c++ gem that has method names over 3000 characters
long, but snprintf is designed to avoid overrunning buffers. So what
went wrong?
The problem is we assume snprintf returns the number of characters
written:
ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", self->level);
...
ret += repsep_snprintf(bf + ret, size - ret, "%s", self->ms.sym->name);
Unfortunately this is not how snprintf works. snprintf returns the
number of characters that would have been written if there was enough
space. In the above case, if the first snprintf returns a value larger
than size, we pass a negative size into the second snprintf and happily
scribble over the stack. If you have 3000 character c++ methods thats a
lot of stack to trample.
This patch fixes repsep_snprintf by clamping the value at size - 1 which
is the maximum snprintf can write before adding the NULL terminator.
I get the sinking feeling that there are a lot of other uses of snprintf
that have this same bug, we should audit them all.
Cc: David Ahern <[email protected]>
Cc: Eric B Munson <[email protected]>
Cc: Frederic Weisbecker <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Paul Mackerras <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Yanmin Zhang <[email protected]>
Link: http://lkml.kernel.org/r/20120307114249.44275ca3@kryten
Signed-off-by: Anton Blanchard <[email protected]>
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
---
tools/perf/util/sort.c | 3 +++
1 file changed, 3 insertions(+)
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -122,6 +122,9 @@ static int repsep_snprintf(char *bf, siz
}
}
va_end(ap);
+
+ if (n >= (int)size)
+ return size - 1;
return n;
}
Patches currently in stable-queue which might be from [email protected] are
queue-3.0/afs-read-of-file-returns-ebadmsg.patch
queue-3.0/perf-tools-incorrect-use-of-snprintf-results-in-segv.patch
queue-3.0/afs-remote-abort-can-cause-bug-in-rxrpc-code.patch
--
To unsubscribe from this list: send the line "unsubscribe stable" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
