Re: perf: fuzzer KASAN: global-out-of-bounds in match_token

[Vince Weaver]

On Thu, 17 Nov 2016, Vince Weaver wrote:

> On Thu, 17 Nov 2016, Vince Weaver wrote:
> > > 
> > > [  911.507365] ==================================================================
> > > [  911.514824] BUG: KASAN: global-out-of-bounds in match_token+0x268/0x310 at addr ffffffffb14ad058
> > > [  911.523912] Read of size 8 by task perf_fuzzer/20662
> > > [  911.528945] Address belongs to variable if_tokens+0x78/0xa0

I managed to create a short reproducer that reliably causes the issue on 
my skylake test machine.



/* simplified perf_fuzzer test case */
/* that triggers BUG: KASAN: global-out-of-bounds in match_token+0x288 */
/* on a skylake machine running Linux 4.9-rc5 */
/* by Vince Weaver <vincent.weaver _at_ maine.edu> */

#include <stdio.h>
#include <unistd.h>
#include <string.h>
#include <sys/syscall.h>
#include <sys/ioctl.h>
#include <linux/perf_event.h>


int perf_event_open(struct perf_event_attr *hw_event_uptr,
	pid_t pid, int cpu, int group_fd, unsigned long flags) {

	return syscall(__NR_perf_event_open,hw_event_uptr, pid, cpu,
		group_fd, flags);
}

int main(int argc, char **argv) {

	int fd7;
	struct perf_event_attr pe7;

	char filter[]="(((to&733)&&common_type&605)||common_flags<386922879890793102)";

	memset(&pe7,0,sizeof(struct perf_event_attr));
	pe7.type=7;		/* intel_pt */
	pe7.size=72;
	pe7.config=0x200ULL;	/* bit 10 = tsc */
	pe7.read_format=PERF_FORMAT_TOTAL_TIME_ENABLED; /* 1 */
	pe7.disabled=1;
	pe7.pinned=1;
	pe7.comm_exec=1;

	fd7=perf_event_open(&pe7,
				0, /* current thread */
				0, /* Only cpu 0 */
				-1, /* group leader */
				PERF_FLAG_FD_NO_GROUP /*1*/ );

	ioctl(fd7, PERF_EVENT_IOC_SET_FILTER , &filter);

	return 0;
}