Re: [PATCH 5/5] perf tools: Fix NULL pointer deference when vdso not found

[Hekuang <hekuang@huawei.com>]

在 2016/6/23 10:02, Wangnan (F) 写道:
> Hi,
>
> This patch fixes a real crash problem when we do 'perf report'
> on an arm64 platform with arm32 program.
> It is introduced by commit f9b2bdf228 ("perf tools: Find vdso
> with the consider of cross-platform"). From dmesg report, perf
> crashes in dso__type() because dso is NULL.
>
> Still don't know why on x86 it never crash, but it is obviously

This is because the fault only occured while
dso_type==DSO__TYPE_32BIT, run 64bit executable won't enter the
fault branch, but if we run a 32bit executable on x86_64, this
bug can be reproduced easily.

   # file ~/hello
   ~/hello: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked (uses shared libs), for GNU/Linux 4.5.0, not stripped

   # perf record -g hello
   Segmentation fault

Thank you.

> that we need to check the return vaule from __dso__find(): it can
> be NULL.
>
> So please consider pulling.
>
> Thank you.
>
> On 2016/6/22 14:57, He Kuang wrote:
>> We should check if 'dso' is a null pointer before passing it to the
>> function dso__type(), otherwise a segfault will be raised in
>> dso__data_get_fd(). In function machine__find_vdso(), the return value
>> checking of 'dso' is missed and this patch fixes this issue.
>>
>> Signed-off-by: He Kuang <hekuang@huawei.com>
>> ---
>>   tools/perf/util/vdso.c | 2 +-
>>   1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/tools/perf/util/vdso.c b/tools/perf/util/vdso.c
>> index 8f81c41..7bdcad4 100644
>> --- a/tools/perf/util/vdso.c
>> +++ b/tools/perf/util/vdso.c
>> @@ -296,7 +296,7 @@ static struct dso *machine__find_vdso(struct 
>> machine *machine,
>>           if (!dso) {
>>               dso = __dsos__find(&machine->dsos, DSO__NAME_VDSO,
>>                          true);
>> -            if (dso_type != dso__type(dso, machine))
>> +            if (dso && dso_type != dso__type(dso, machine))
>>                   dso = NULL;
>>           }
>>           break;
>
>
>