summaryrefslogtreecommitdiffstats
path: root/tools
diff options
context:
space:
mode:
authorAnton Blanchard <anton@samba.org>2012-03-07 11:42:49 +1100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2012-03-23 11:21:22 -0700
commit460e2faa3a051fa4cb3aacb6ef47c71845bcf6bb (patch)
tree7be0b37468c4dca17392f920929f21422d850427 /tools
parenta3e7dddf9d7dd2e98f015b96afa343da370e8468 (diff)
downloadlinux-stable-460e2faa3a051fa4cb3aacb6ef47c71845bcf6bb.tar.gz
linux-stable-460e2faa3a051fa4cb3aacb6ef47c71845bcf6bb.tar.bz2
linux-stable-460e2faa3a051fa4cb3aacb6ef47c71845bcf6bb.zip
perf tools: Incorrect use of snprintf results in SEGV
commit b832796caa1fda8516464a003c8c7cc547bc20c2 upstream. I have a workload where perf top scribbles over the stack and we SEGV. What makes it interesting is that an snprintf is causing this. The workload is a c++ gem that has method names over 3000 characters long, but snprintf is designed to avoid overrunning buffers. So what went wrong? The problem is we assume snprintf returns the number of characters written: ret += repsep_snprintf(bf + ret, size - ret, "[%c] ", self->level); ... ret += repsep_snprintf(bf + ret, size - ret, "%s", self->ms.sym->name); Unfortunately this is not how snprintf works. snprintf returns the number of characters that would have been written if there was enough space. In the above case, if the first snprintf returns a value larger than size, we pass a negative size into the second snprintf and happily scribble over the stack. If you have 3000 character c++ methods thats a lot of stack to trample. This patch fixes repsep_snprintf by clamping the value at size - 1 which is the maximum snprintf can write before adding the NULL terminator. I get the sinking feeling that there are a lot of other uses of snprintf that have this same bug, we should audit them all. Cc: David Ahern <dsahern@gmail.com> Cc: Eric B Munson <emunson@mgebm.net> Cc: Frederic Weisbecker <fweisbec@gmail.com> Cc: Ingo Molnar <mingo@elte.hu> Cc: Paul Mackerras <paulus@samba.org> Cc: Peter Zijlstra <peterz@infradead.org> Cc: Yanmin Zhang <yanmin_zhang@linux.intel.com> Link: http://lkml.kernel.org/r/20120307114249.44275ca3@kryten Signed-off-by: Anton Blanchard <anton@samba.org> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools')
-rw-r--r--tools/perf/util/sort.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/tools/perf/util/sort.c b/tools/perf/util/sort.c
index 16da30d8d765..076c9d4e1ea4 100644
--- a/tools/perf/util/sort.c
+++ b/tools/perf/util/sort.c
@@ -33,6 +33,9 @@ static int repsep_snprintf(char *bf, size_t size, const char *fmt, ...)
}
}
va_end(ap);
+
+ if (n >= (int)size)
+ return size - 1;
return n;
}