[PATCH v4] perf tools: perf_event_paranoid and kptr_restrict may crash on 'perf top'

[PATCH v4] perf tools: perf_event_paranoid and kptr_restrict may crash on 'perf top'

[Jackie Liu]

After install the libelf-dev package and compiling perf, kptr_restrict=2
and perf_event_paranoid=3 will cause perf top to crash, because the
value of /proc/kallsyms cannot be obtained, which leads to
info->jited_ksyms == NULL. In order to solve this problem, Add a
judgment before use.

v3->v4:
Fix memory leaks in more places

v2->v3:
free info_linear memory and move code above, don't do those extra btf
checks.

Suggested-by: Jiri Olsa <jolsa@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
---
 tools/perf/util/bpf-event.c | 13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
index 57d58c81a5f8..cdecda1ddd36 100644
--- a/tools/perf/util/bpf-event.c
+++ b/tools/perf/util/bpf-event.c
@@ -196,25 +196,32 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
 	}
 
 	if (info_linear->info_len < offsetof(struct bpf_prog_info, prog_tags)) {
+		free(info_linear);
 		pr_debug("%s: the kernel is too old, aborting\n", __func__);
 		return -2;
 	}
 
 	info = &info_linear->info;
+	if (!info->jited_ksyms) {
+		free(info_linear);
+		return -1;
+	}
 
 	/* number of ksyms, func_lengths, and tags should match */
 	sub_prog_cnt = info->nr_jited_ksyms;
 	if (sub_prog_cnt != info->nr_prog_tags ||
-	    sub_prog_cnt != info->nr_jited_func_lens)
+	    sub_prog_cnt != info->nr_jited_func_lens) {
+		free(info_linear);
 		return -1;
+	}
 
 	/* check BTF func info support */
 	if (info->btf_id && info->nr_func_info && info->func_info_rec_size) {
 		/* btf func info number should be same as sub_prog_cnt */
 		if (sub_prog_cnt != info->nr_func_info) {
 			pr_debug("%s: mismatch in BPF sub program count and BTF function info count, aborting\n", __func__);
-			err = -1;
-			goto out;
+			free(info_linear);
+			return -1;
 		}
 		if (btf__get_from_id(info->btf_id, &btf)) {
 			pr_debug("%s: failed to get BTF of id %u, aborting\n", __func__, info->btf_id);
-- 
2.25.1

Re: [PATCH v4] perf tools: perf_event_paranoid and kptr_restrict may crash on 'perf top'

[Jiri Olsa]

On Tue, Mar 16, 2021 at 09:24:53AM +0800, Jackie Liu wrote:
> After install the libelf-dev package and compiling perf, kptr_restrict=2
> and perf_event_paranoid=3 will cause perf top to crash, because the
> value of /proc/kallsyms cannot be obtained, which leads to
> info->jited_ksyms == NULL. In order to solve this problem, Add a
> judgment before use.
> 
> v3->v4:
> Fix memory leaks in more places

Acked-by: Jiri Olsa <jolsa@redhat.com>

thanks,
jirka

> 
> v2->v3:
> free info_linear memory and move code above, don't do those extra btf
> checks.
> 
> Suggested-by: Jiri Olsa <jolsa@redhat.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
> ---
>  tools/perf/util/bpf-event.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
> index 57d58c81a5f8..cdecda1ddd36 100644
> --- a/tools/perf/util/bpf-event.c
> +++ b/tools/perf/util/bpf-event.c
> @@ -196,25 +196,32 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
>  	}
>  
>  	if (info_linear->info_len < offsetof(struct bpf_prog_info, prog_tags)) {
> +		free(info_linear);
>  		pr_debug("%s: the kernel is too old, aborting\n", __func__);
>  		return -2;
>  	}
>  
>  	info = &info_linear->info;
> +	if (!info->jited_ksyms) {
> +		free(info_linear);
> +		return -1;
> +	}
>  
>  	/* number of ksyms, func_lengths, and tags should match */
>  	sub_prog_cnt = info->nr_jited_ksyms;
>  	if (sub_prog_cnt != info->nr_prog_tags ||
> -	    sub_prog_cnt != info->nr_jited_func_lens)
> +	    sub_prog_cnt != info->nr_jited_func_lens) {
> +		free(info_linear);
>  		return -1;
> +	}
>  
>  	/* check BTF func info support */
>  	if (info->btf_id && info->nr_func_info && info->func_info_rec_size) {
>  		/* btf func info number should be same as sub_prog_cnt */
>  		if (sub_prog_cnt != info->nr_func_info) {
>  			pr_debug("%s: mismatch in BPF sub program count and BTF function info count, aborting\n", __func__);
> -			err = -1;
> -			goto out;
> +			free(info_linear);
> +			return -1;
>  		}
>  		if (btf__get_from_id(info->btf_id, &btf)) {
>  			pr_debug("%s: failed to get BTF of id %u, aborting\n", __func__, info->btf_id);
> -- 
> 2.25.1
> 

Re: [PATCH v4] perf tools: perf_event_paranoid and kptr_restrict may crash on 'perf top'

[Arnaldo Carvalho de Melo]

Em Tue, Mar 16, 2021 at 09:24:53AM +0800, Jackie Liu escreveu:
> After install the libelf-dev package and compiling perf, kptr_restrict=2
> and perf_event_paranoid=3 will cause perf top to crash, because the
> value of /proc/kallsyms cannot be obtained, which leads to
> info->jited_ksyms == NULL. In order to solve this problem, Add a
> judgment before use.
> 
> v3->v4:
> Fix memory leaks in more places
> 
> v2->v3:
> free info_linear memory and move code above, don't do those extra btf
> checks.

Applied, edited the commit message to:

----
    perf top: Fix BPF support related crash with perf_event_paranoid=3 + kptr_restrict

    After installing the libelf-dev package and compiling perf, if we have
    kptr_restrict=2 and perf_event_paranoid=3 'perf top' will crash because
    the value of /proc/kallsyms cannot be obtained, which leads to
    info->jited_ksyms == NULL. In order to solve this problem, Add a
    check before use.

    Also plug some leaks on the error path.
----
 
> Suggested-by: Jiri Olsa <jolsa@redhat.com>
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Signed-off-by: Jackie Liu <liuyun01@kylinos.cn>
> ---
>  tools/perf/util/bpf-event.c | 13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
> index 57d58c81a5f8..cdecda1ddd36 100644
> --- a/tools/perf/util/bpf-event.c
> +++ b/tools/perf/util/bpf-event.c
> @@ -196,25 +196,32 @@ static int perf_event__synthesize_one_bpf_prog(struct perf_session *session,
>  	}
>  
>  	if (info_linear->info_len < offsetof(struct bpf_prog_info, prog_tags)) {
> +		free(info_linear);
>  		pr_debug("%s: the kernel is too old, aborting\n", __func__);
>  		return -2;
>  	}
>  
>  	info = &info_linear->info;
> +	if (!info->jited_ksyms) {
> +		free(info_linear);
> +		return -1;
> +	}
>  
>  	/* number of ksyms, func_lengths, and tags should match */
>  	sub_prog_cnt = info->nr_jited_ksyms;
>  	if (sub_prog_cnt != info->nr_prog_tags ||
> -	    sub_prog_cnt != info->nr_jited_func_lens)
> +	    sub_prog_cnt != info->nr_jited_func_lens) {
> +		free(info_linear);
>  		return -1;
> +	}
>  
>  	/* check BTF func info support */
>  	if (info->btf_id && info->nr_func_info && info->func_info_rec_size) {
>  		/* btf func info number should be same as sub_prog_cnt */
>  		if (sub_prog_cnt != info->nr_func_info) {
>  			pr_debug("%s: mismatch in BPF sub program count and BTF function info count, aborting\n", __func__);
> -			err = -1;
> -			goto out;
> +			free(info_linear);
> +			return -1;
>  		}
>  		if (btf__get_from_id(info->btf_id, &btf)) {
>  			pr_debug("%s: failed to get BTF of id %u, aborting\n", __func__, info->btf_id);
> -- 
> 2.25.1
> 

-- 

- Arnaldo