Re: perf: fuzzer KASAN: global-out-of-bounds in match_token

From: Vince Weaver
Date: Fri Nov 18 2016 - 13:03:11 EST

On Fri, 18 Nov 2016, Alexander Shishkin wrote:

> From 139306c3bcf7abf49c51a8e56131aaae51222594 Mon Sep 17 00:00:00 2001
> From: Alexander Shishkin <alexander.shishkin@xxxxxxxxxxxxxxx>
> Date: Fri, 18 Nov 2016 13:24:55 +0200
> Subject: [PATCH] perf: Fix address filter parser
> The token table passed into match_token() must be null-terminated, which
> it currently is not in the perf's address filter string parser, as caught
> by Vince's perf_fuzzer and KASAN. It doesn't blow up otherwise because of
> the alignment padding of the table to the next element in the .rodata,
> which is luck.

I can confirm that with this patch applied I no longer get the
token-parsing KASAN messages.

This is even after I enhanced the perf_fuzzer to generate more realistic

As an aside, is there any better documentation on what a "proper" address
filter looks like? In kernel/events/core.c it says

* where ACTION is one of the
* * "filter": limit the trace to this region
* * "start": start tracing from this address
* * "stop": stop tracing at this address/region;
* * for kernel addresses: <start address>[/<size>]
* * for object files: <start address>[/<size>]@</path/to/object/file>

Does each action always get a range?

Are the ranges hex? decimal? can they have a leading 0x?
Are the sizes hex? decimal?
What's the path to object file for? What kind of object file?