mirror of
https://github.com/torvalds/linux
synced 2024-09-30 08:20:40 +00:00
769e6a1e15
ui_browser__show() is capturing the input title that is stack allocated
memory in hist_browser__run().
Avoid a use after return by strdup-ing the string.
Committer notes:
Further explanation from Ian Rogers:
My command line using tui is:
$ sudo bash -c 'rm /tmp/asan.log*; export
ASAN_OPTIONS="log_path=/tmp/asan.log"; /tmp/perf/perf mem record -a
sleep 1; /tmp/perf/perf mem report'
I then go to the perf annotate view and quit. This triggers the asan
error (from the log file):
```
==1254591==ERROR: AddressSanitizer: stack-use-after-return on address
0x7f2813331920 at pc 0x7f28180
65991 bp 0x7fff0a21c750 sp 0x7fff0a21bf10
READ of size 80 at 0x7f2813331920 thread T0
#0 0x7f2818065990 in __interceptor_strlen
../../../../src/libsanitizer/sanitizer_common/sanitizer_common_interceptors.inc:461
#1 0x7f2817698251 in SLsmg_write_wrapped_string
(/lib/x86_64-linux-gnu/libslang.so.2+0x98251)
#2 0x7f28176984b9 in SLsmg_write_nstring
(/lib/x86_64-linux-gnu/libslang.so.2+0x984b9)
#3 0x55c94045b365 in ui_browser__write_nstring ui/browser.c:60
#4 0x55c94045c558 in __ui_browser__show_title ui/browser.c:266
#5 0x55c94045c776 in ui_browser__show ui/browser.c:288
#6 0x55c94045c06d in ui_browser__handle_resize ui/browser.c:206
#7 0x55c94047979b in do_annotate ui/browsers/hists.c:2458
#8 0x55c94047fb17 in evsel__hists_browse ui/browsers/hists.c:3412
#9 0x55c940480a0c in perf_evsel_menu__run ui/browsers/hists.c:3527
#10 0x55c940481108 in __evlist__tui_browse_hists ui/browsers/hists.c:3613
#11 0x55c9404813f7 in evlist__tui_browse_hists ui/browsers/hists.c:3661
#12 0x55c93ffa253f in report__browse_hists tools/perf/builtin-report.c:671
#13 0x55c93ffa58ca in __cmd_report tools/perf/builtin-report.c:1141
#14 0x55c93ffaf159 in cmd_report tools/perf/builtin-report.c:1805
#15 0x55c94000c05c in report_events tools/perf/builtin-mem.c:374
#16 0x55c94000d96d in cmd_mem tools/perf/builtin-mem.c:516
#17 0x55c9400e44ee in run_builtin tools/perf/perf.c:350
#18 0x55c9400e4a5a in handle_internal_command tools/perf/perf.c:403
#19 0x55c9400e4e22 in run_argv tools/perf/perf.c:447
#20 0x55c9400e53ad in main tools/perf/perf.c:561
#21 0x7f28170456c9 in __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
#22 0x7f2817045784 in __libc_start_main_impl ../csu/libc-start.c:360
#23 0x55c93ff544c0 in _start (/tmp/perf/perf+0x19a4c0) (BuildId:
84899b0e8c7d3a3eaa67b2eb35e3d8b2f8cd4c93)
Address 0x7f2813331920 is located in stack of thread T0 at offset 32 in frame
#0 0x55c94046e85e in hist_browser__run ui/browsers/hists.c:746
This frame has 1 object(s):
[32, 192) 'title' (line 747) <== Memory access at offset 32 is
inside this variable
HINT: this may be a false positive if your program uses some custom
stack unwind mechanism, swapcontext or vfork
```
hist_browser__run isn't on the stack so the asan error looks legit.
There's no clean init/exit on struct ui_browser so I may be trading a
use-after-return for a memory leak, but that seems look a good trade
anyway.
Fixes: 05e8b0804e ("perf ui browser: Stop using 'self'")
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Andi Kleen <ak@linux.intel.com>
Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Cc: Ben Gainey <ben.gainey@arm.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@arm.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kajol Jain <kjain@linux.ibm.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: K Prateek Nayak <kprateek.nayak@amd.com>
Cc: Li Dong <lidong@vivo.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Oliver Upton <oliver.upton@linux.dev>
Cc: Paran Lee <p4ranlee@gmail.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ravi Bangoria <ravi.bangoria@amd.com>
Cc: Sun Haiyong <sunhaiyong@loongson.cn>
Cc: Tim Chen <tim.c.chen@linux.intel.com>
Cc: Yanteng Si <siyanteng@loongson.cn>
Cc: Yicong Yang <yangyicong@hisilicon.com>
Link: https://lore.kernel.org/r/20240507183545.1236093-2-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
87 lines
3.7 KiB
C
87 lines
3.7 KiB
C
/* SPDX-License-Identifier: GPL-2.0 */
|
|
#ifndef _PERF_UI_BROWSER_H_
|
|
#define _PERF_UI_BROWSER_H_ 1
|
|
|
|
#include <linux/types.h>
|
|
#include <stdarg.h>
|
|
#include <sys/types.h>
|
|
|
|
#define HE_COLORSET_TOP 50
|
|
#define HE_COLORSET_MEDIUM 51
|
|
#define HE_COLORSET_NORMAL 52
|
|
#define HE_COLORSET_SELECTED 53
|
|
#define HE_COLORSET_JUMP_ARROWS 54
|
|
#define HE_COLORSET_ADDR 55
|
|
#define HE_COLORSET_ROOT 56
|
|
|
|
struct ui_browser {
|
|
u64 index, top_idx;
|
|
void *top, *entries;
|
|
u16 y, x, width, height, rows, columns, horiz_scroll;
|
|
u8 extra_title_lines;
|
|
int current_color;
|
|
void *priv;
|
|
char *title;
|
|
char *helpline;
|
|
const char *no_samples_msg;
|
|
void (*refresh_dimensions)(struct ui_browser *browser);
|
|
unsigned int (*refresh)(struct ui_browser *browser);
|
|
void (*write)(struct ui_browser *browser, void *entry, int row);
|
|
void (*seek)(struct ui_browser *browser, off_t offset, int whence);
|
|
bool (*filter)(struct ui_browser *browser, void *entry);
|
|
u32 nr_entries;
|
|
bool navkeypressed;
|
|
bool use_navkeypressed;
|
|
};
|
|
|
|
int ui_browser__set_color(struct ui_browser *browser, int color);
|
|
void ui_browser__set_percent_color(struct ui_browser *browser,
|
|
double percent, bool current);
|
|
bool ui_browser__is_current_entry(struct ui_browser *browser, unsigned row);
|
|
void ui_browser__refresh_dimensions(struct ui_browser *browser);
|
|
void ui_browser__reset_index(struct ui_browser *browser);
|
|
|
|
void ui_browser__gotorc_title(struct ui_browser *browser, int y, int x);
|
|
void ui_browser__gotorc(struct ui_browser *browser, int y, int x);
|
|
void ui_browser__write_nstring(struct ui_browser *browser, const char *msg,
|
|
unsigned int width);
|
|
void ui_browser__vprintf(struct ui_browser *browser, const char *fmt, va_list args);
|
|
void ui_browser__printf(struct ui_browser *browser, const char *fmt, ...);
|
|
void ui_browser__write_graph(struct ui_browser *browser, int graph);
|
|
void __ui_browser__line_arrow(struct ui_browser *browser, unsigned int column,
|
|
u64 start, u64 end);
|
|
void ui_browser__mark_fused(struct ui_browser *browser, unsigned int column,
|
|
unsigned int row, int diff, bool arrow_down);
|
|
void __ui_browser__show_title(struct ui_browser *browser, const char *title);
|
|
void ui_browser__show_title(struct ui_browser *browser, const char *title);
|
|
int ui_browser__show(struct ui_browser *browser, const char *title,
|
|
const char *helpline, ...);
|
|
void ui_browser__hide(struct ui_browser *browser);
|
|
int ui_browser__refresh(struct ui_browser *browser);
|
|
int ui_browser__run(struct ui_browser *browser, int delay_secs);
|
|
void ui_browser__update_nr_entries(struct ui_browser *browser, u32 nr_entries);
|
|
void ui_browser__handle_resize(struct ui_browser *browser);
|
|
void __ui_browser__vline(struct ui_browser *browser, unsigned int column,
|
|
u16 start, u16 end);
|
|
|
|
int ui_browser__warning(struct ui_browser *browser, int timeout,
|
|
const char *format, ...);
|
|
int ui_browser__help_window(struct ui_browser *browser, const char *text);
|
|
bool ui_browser__dialog_yesno(struct ui_browser *browser, const char *text);
|
|
int ui_browser__input_window(const char *title, const char *text, char *input,
|
|
const char *exit_msg, int delay_sec);
|
|
struct perf_env;
|
|
int tui__header_window(struct perf_env *env);
|
|
|
|
void ui_browser__argv_seek(struct ui_browser *browser, off_t offset, int whence);
|
|
unsigned int ui_browser__argv_refresh(struct ui_browser *browser);
|
|
|
|
void ui_browser__rb_tree_seek(struct ui_browser *browser, off_t offset, int whence);
|
|
unsigned int ui_browser__rb_tree_refresh(struct ui_browser *browser);
|
|
|
|
void ui_browser__list_head_seek(struct ui_browser *browser, off_t offset, int whence);
|
|
unsigned int ui_browser__list_head_refresh(struct ui_browser *browser);
|
|
|
|
void ui_browser__init(void);
|
|
#endif /* _PERF_UI_BROWSER_H_ */
|