Re: [PATCH 5/5] perf tools: Fix NULL pointer deference when vdso not found

[Hekuang]

å 2016/6/23 10:02, Wangnan (F) åé:
> Hi,
>
> This patch fixes a real crash problem when we do 'perf report'
> on an arm64 platform with arm32 program.
> It is introduced by commit f9b2bdf228 ("perf tools: Find vdso
> with the consider of cross-platform"). From dmesg report, perf
> crashes in dso__type() because dso is NULL.
>
> Still don't know why on x86 it never crash, but it is obviously

This is because the fault only occured while
dso_type==DSO__TYPE_32BIT, run 64bit executable won't enter the
fault branch, but if we run a 32bit executable on x86_64, this
bug can be reproduced easily.

  # file ~/hello
  ~/hello: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), 
dynamically linked (uses shared libs), for GNU/Linux 4.5.0, not stripped

  # perf record -g hello
  Segmentation fault

Thank you.

> that we need to check the return vaule from __dso__find(): it can
> be NULL.
>
> So please consider pulling.
>
> Thank you.
>
> On 2016/6/22 14:57, He Kuang wrote:
> > We should check if 'dso' is a null pointer before passing it to the
> > function dso__type(), otherwise a segfault will be raised in
> > dso__data_get_fd(). In function machine__find_vdso(), the return value
> > checking of 'dso' is missed and this patch fixes this issue.
> >
> > Signed-off-by: He Kuang <hekuang@xxxxxxxxxx>
> > ---
> >   tools/perf/util/vdso.c | 2 +-
> >   1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/tools/perf/util/vdso.c b/tools/perf/util/vdso.c
> > index 8f81c41..7bdcad4 100644
> > --- a/tools/perf/util/vdso.c
> > +++ b/tools/perf/util/vdso.c
> > @@ -296,7 +296,7 @@ static struct dso *machine__find_vdso(struct 
> > machine *machine,
> >           if (!dso) {
> >               dso = __dsos__find(&machine->dsos, DSO__NAME_VDSO,
> >                          true);
> > -            if (dso_type != dso__type(dso, machine))
> > +            if (dso && dso_type != dso__type(dso, machine))
> >                   dso = NULL;
> >           }
> >           break;