1. Patchew
  2. linux
  3. View series

[PATCH] perf buildid: Avoid copy of uninitialized memory

Ian Rogers posted 1 patch 2 years, 8 months ago
There is a newer version of this series
tools/perf/util/synthetic-events.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
[PATCH] perf buildid: Avoid copy of uninitialized memory
Posted by Ian Rogers 2 years, 8 months ago 
build_id__init only copies the buildid data up to size leaving the
rest of the data array uninitialized. Copying the full array during
synthesis means the written event contains uninitialized memory.  This
was detected by the Clang/LLVM memory sanitizer.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/util/synthetic-events.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
index 3ab6a92b1a6d..348d05e4ec03 100644
--- a/tools/perf/util/synthetic-events.c
+++ b/tools/perf/util/synthetic-events.c
@@ -2219,7 +2219,7 @@ int perf_event__synthesize_build_id(struct perf_tool *tool, struct dso *pos, u16
 
 	len = pos->long_name_len + 1;
 	len = PERF_ALIGN(len, NAME_ALIGN);
-	memcpy(&ev.build_id.build_id, pos->bid.data, sizeof(pos->bid.data));
+	memcpy(&ev.build_id.build_id, pos->bid.data, pos->bid.size);
 	ev.build_id.size = pos->bid.size;
 	ev.build_id.header.type = PERF_RECORD_HEADER_BUILD_ID;
 	ev.build_id.header.misc = misc | PERF_RECORD_MISC_BUILD_ID_SIZE;
-- 
2.39.0.314.g84b9a713c41-goog
Re: [PATCH] perf buildid: Avoid copy of uninitialized memory
Posted by Ian Rogers 2 years, 7 months ago 
On Fri, Jan 13, 2023 at 10:57 AM Ian Rogers <irogers@google.com> wrote:
>
> build_id__init only copies the buildid data up to size leaving the
> rest of the data array uninitialized. Copying the full array during
> synthesis means the written event contains uninitialized memory.  This
> was detected by the Clang/LLVM memory sanitizer.
>
> Signed-off-by: Ian Rogers <irogers@google.com>
> ---
>  tools/perf/util/synthetic-events.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> index 3ab6a92b1a6d..348d05e4ec03 100644
> --- a/tools/perf/util/synthetic-events.c
> +++ b/tools/perf/util/synthetic-events.c
> @@ -2219,7 +2219,7 @@ int perf_event__synthesize_build_id(struct perf_tool *tool, struct dso *pos, u16
>
>         len = pos->long_name_len + 1;
>         len = PERF_ALIGN(len, NAME_ALIGN);
> -       memcpy(&ev.build_id.build_id, pos->bid.data, sizeof(pos->bid.data));
> +       memcpy(&ev.build_id.build_id, pos->bid.data, pos->bid.size);

Ping. Should be an uncontroversial change to fix a copy of
uninitialized memory into the perf.data file during synthesis.

Thanks,
Ian

>         ev.build_id.size = pos->bid.size;
>         ev.build_id.header.type = PERF_RECORD_HEADER_BUILD_ID;
>         ev.build_id.header.misc = misc | PERF_RECORD_MISC_BUILD_ID_SIZE;
> --
> 2.39.0.314.g84b9a713c41-goog
>
Re: [PATCH] perf buildid: Avoid copy of uninitialized memory
Posted by Arnaldo Carvalho de Melo 2 years, 7 months ago 
Em Thu, Jan 19, 2023 at 08:08:13AM -0800, Ian Rogers escreveu:
> On Fri, Jan 13, 2023 at 10:57 AM Ian Rogers <irogers@google.com> wrote:
> >
> > build_id__init only copies the buildid data up to size leaving the
> > rest of the data array uninitialized. Copying the full array during
> > synthesis means the written event contains uninitialized memory.  This
> > was detected by the Clang/LLVM memory sanitizer.
> >
> > Signed-off-by: Ian Rogers <irogers@google.com>
> > ---
> >  tools/perf/util/synthetic-events.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> > index 3ab6a92b1a6d..348d05e4ec03 100644
> > --- a/tools/perf/util/synthetic-events.c
> > +++ b/tools/perf/util/synthetic-events.c
> > @@ -2219,7 +2219,7 @@ int perf_event__synthesize_build_id(struct perf_tool *tool, struct dso *pos, u16
> >
> >         len = pos->long_name_len + 1;
> >         len = PERF_ALIGN(len, NAME_ALIGN);
> > -       memcpy(&ev.build_id.build_id, pos->bid.data, sizeof(pos->bid.data));
> > +       memcpy(&ev.build_id.build_id, pos->bid.data, pos->bid.size);
> 
> Ping. Should be an uncontroversial change to fix a copy of
> uninitialized memory into the perf.data file during synthesis.

Indeed, applied.

- Arnaldo
Re: [PATCH] perf buildid: Avoid copy of uninitialized memory
Posted by Arnaldo Carvalho de Melo 2 years, 7 months ago 
Em Thu, Jan 19, 2023 at 01:29:30PM -0300, Arnaldo Carvalho de Melo escreveu:
> Em Thu, Jan 19, 2023 at 08:08:13AM -0800, Ian Rogers escreveu:
> > On Fri, Jan 13, 2023 at 10:57 AM Ian Rogers <irogers@google.com> wrote:
> > >
> > > build_id__init only copies the buildid data up to size leaving the
> > > rest of the data array uninitialized. Copying the full array during
> > > synthesis means the written event contains uninitialized memory.  This
> > > was detected by the Clang/LLVM memory sanitizer.
> > >
> > > Signed-off-by: Ian Rogers <irogers@google.com>
> > > ---
> > >  tools/perf/util/synthetic-events.c | 2 +-
> > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > >
> > > diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> > > index 3ab6a92b1a6d..348d05e4ec03 100644
> > > --- a/tools/perf/util/synthetic-events.c
> > > +++ b/tools/perf/util/synthetic-events.c
> > > @@ -2219,7 +2219,7 @@ int perf_event__synthesize_build_id(struct perf_tool *tool, struct dso *pos, u16
> > >
> > >         len = pos->long_name_len + 1;
> > >         len = PERF_ALIGN(len, NAME_ALIGN);
> > > -       memcpy(&ev.build_id.build_id, pos->bid.data, sizeof(pos->bid.data));
> > > +       memcpy(&ev.build_id.build_id, pos->bid.data, pos->bid.size);
> > 
> > Ping. Should be an uncontroversial change to fix a copy of
> > uninitialized memory into the perf.data file during synthesis.
> 
> Indeed, applied.

Humm, don't we better do it as:

+       memcpy(&ev.build_id.build_id, pos->bid.data, min(pos->bid.size, sizeof(pos->bid.data));

Lemme check what is setting that pos->bid.size....

Things like sysfs__read_build_id() that does such checks, but perhaps we
should be defensive and do it in this function as well?

- Arnaldo
Re: [PATCH] perf buildid: Avoid copy of uninitialized memory
Posted by Ian Rogers 2 years, 7 months ago 
On Thu, Jan 19, 2023 at 8:39 AM Arnaldo Carvalho de Melo
<acme@kernel.org> wrote:
>
> Em Thu, Jan 19, 2023 at 01:29:30PM -0300, Arnaldo Carvalho de Melo escreveu:
> > Em Thu, Jan 19, 2023 at 08:08:13AM -0800, Ian Rogers escreveu:
> > > On Fri, Jan 13, 2023 at 10:57 AM Ian Rogers <irogers@google.com> wrote:
> > > >
> > > > build_id__init only copies the buildid data up to size leaving the
> > > > rest of the data array uninitialized. Copying the full array during
> > > > synthesis means the written event contains uninitialized memory.  This
> > > > was detected by the Clang/LLVM memory sanitizer.
> > > >
> > > > Signed-off-by: Ian Rogers <irogers@google.com>
> > > > ---
> > > >  tools/perf/util/synthetic-events.c | 2 +-
> > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> > > > index 3ab6a92b1a6d..348d05e4ec03 100644
> > > > --- a/tools/perf/util/synthetic-events.c
> > > > +++ b/tools/perf/util/synthetic-events.c
> > > > @@ -2219,7 +2219,7 @@ int perf_event__synthesize_build_id(struct perf_tool *tool, struct dso *pos, u16
> > > >
> > > >         len = pos->long_name_len + 1;
> > > >         len = PERF_ALIGN(len, NAME_ALIGN);
> > > > -       memcpy(&ev.build_id.build_id, pos->bid.data, sizeof(pos->bid.data));
> > > > +       memcpy(&ev.build_id.build_id, pos->bid.data, pos->bid.size);
> > >
> > > Ping. Should be an uncontroversial change to fix a copy of
> > > uninitialized memory into the perf.data file during synthesis.
> >
> > Indeed, applied.
>
> Humm, don't we better do it as:
>
> +       memcpy(&ev.build_id.build_id, pos->bid.data, min(pos->bid.size, sizeof(pos->bid.data));
>
> Lemme check what is setting that pos->bid.size....
>
> Things like sysfs__read_build_id() that does such checks, but perhaps we
> should be defensive and do it in this function as well?

Defensive is good, another option would be an assert but they can be
compiled out. Do you want me to repost?

Thanks,
Ian
Re: [PATCH] perf buildid: Avoid copy of uninitialized memory
Posted by Arnaldo Carvalho de Melo 2 years, 7 months ago 
Em Thu, Jan 19, 2023 at 08:57:21AM -0800, Ian Rogers escreveu:
> On Thu, Jan 19, 2023 at 8:39 AM Arnaldo Carvalho de Melo
> <acme@kernel.org> wrote:
> >
> > Em Thu, Jan 19, 2023 at 01:29:30PM -0300, Arnaldo Carvalho de Melo escreveu:
> > > Em Thu, Jan 19, 2023 at 08:08:13AM -0800, Ian Rogers escreveu:
> > > > On Fri, Jan 13, 2023 at 10:57 AM Ian Rogers <irogers@google.com> wrote:
> > > > >
> > > > > build_id__init only copies the buildid data up to size leaving the
> > > > > rest of the data array uninitialized. Copying the full array during
> > > > > synthesis means the written event contains uninitialized memory.  This
> > > > > was detected by the Clang/LLVM memory sanitizer.
> > > > >
> > > > > Signed-off-by: Ian Rogers <irogers@google.com>
> > > > > ---
> > > > >  tools/perf/util/synthetic-events.c | 2 +-
> > > > >  1 file changed, 1 insertion(+), 1 deletion(-)
> > > > >
> > > > > diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> > > > > index 3ab6a92b1a6d..348d05e4ec03 100644
> > > > > --- a/tools/perf/util/synthetic-events.c
> > > > > +++ b/tools/perf/util/synthetic-events.c
> > > > > @@ -2219,7 +2219,7 @@ int perf_event__synthesize_build_id(struct perf_tool *tool, struct dso *pos, u16
> > > > >
> > > > >         len = pos->long_name_len + 1;
> > > > >         len = PERF_ALIGN(len, NAME_ALIGN);
> > > > > -       memcpy(&ev.build_id.build_id, pos->bid.data, sizeof(pos->bid.data));
> > > > > +       memcpy(&ev.build_id.build_id, pos->bid.data, pos->bid.size);
> > > >
> > > > Ping. Should be an uncontroversial change to fix a copy of
> > > > uninitialized memory into the perf.data file during synthesis.
> > >
> > > Indeed, applied.
> >
> > Humm, don't we better do it as:
> >
> > +       memcpy(&ev.build_id.build_id, pos->bid.data, min(pos->bid.size, sizeof(pos->bid.data));
> >
> > Lemme check what is setting that pos->bid.size....
> >
> > Things like sysfs__read_build_id() that does such checks, but perhaps we
> > should be defensive and do it in this function as well?
> 
> Defensive is good, another option would be an assert but they can be
> compiled out. Do you want me to repost?

Please.

- Arnaldo

Patchew 2.1-devel-b67e4c2

© 2016 - 2025 Red Hat, Inc.