You can not select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
71 lines
3.3 KiB
71 lines
3.3 KiB
commit 8e1a8e04b153739a77289e6fc07cbfc252d87e02 |
|
Author: Леонид Юрьев (Leonid Yuriev) <leo@yuriev.ru> |
|
Date: Sat Feb 4 14:41:38 2023 +0300 |
|
|
|
gmon: Fix allocated buffer overflow (bug 29444) |
|
|
|
The `__monstartup()` allocates a buffer used to store all the data |
|
accumulated by the monitor. |
|
|
|
The size of this buffer depends on the size of the internal structures |
|
used and the address range for which the monitor is activated, as well |
|
as on the maximum density of call instructions and/or callable functions |
|
that could be potentially on a segment of executable code. |
|
|
|
In particular a hash table of arcs is placed at the end of this buffer. |
|
The size of this hash table is calculated in bytes as |
|
p->fromssize = p->textsize / HASHFRACTION; |
|
|
|
but actually should be |
|
p->fromssize = ROUNDUP(p->textsize / HASHFRACTION, sizeof(*p->froms)); |
|
|
|
This results in writing beyond the end of the allocated buffer when an |
|
added arc corresponds to a call near from the end of the monitored |
|
address range, since `_mcount()` check the incoming caller address for |
|
monitored range but not the intermediate result hash-like index that |
|
uses to write into the table. |
|
|
|
It should be noted that when the results are output to `gmon.out`, the |
|
table is read to the last element calculated from the allocated size in |
|
bytes, so the arcs stored outside the buffer boundary did not fall into |
|
`gprof` for analysis. Thus this "feature" help me to found this bug |
|
during working with https://sourceware.org/bugzilla/show_bug.cgi?id=29438 |
|
|
|
Just in case, I will explicitly note that the problem breaks the |
|
`make test t=gmon/tst-gmon-dso` added for Bug 29438. |
|
There, the arc of the `f3()` call disappears from the output, since in |
|
the DSO case, the call to `f3` is located close to the end of the |
|
monitored range. |
|
|
|
Signed-off-by: Леонид Юрьев (Leonid Yuriev) <leo@yuriev.ru> |
|
|
|
Another minor error seems a related typo in the calculation of |
|
`kcountsize`, but since kcounts are smaller than froms, this is |
|
actually to align the p->froms data. |
|
|
|
Co-authored-by: DJ Delorie <dj@redhat.com> |
|
Reviewed-by: Carlos O'Donell <carlos@redhat.com> |
|
(cherry picked from commit 801af9fafd4689337ebf27260aa115335a0cb2bc) |
|
|
|
diff --git a/gmon/gmon.c b/gmon/gmon.c |
|
index dee64803ada583d7..bf76358d5b1aa2da 100644 |
|
--- a/gmon/gmon.c |
|
+++ b/gmon/gmon.c |
|
@@ -132,6 +132,8 @@ __monstartup (u_long lowpc, u_long highpc) |
|
p->lowpc = ROUNDDOWN(lowpc, HISTFRACTION * sizeof(HISTCOUNTER)); |
|
p->highpc = ROUNDUP(highpc, HISTFRACTION * sizeof(HISTCOUNTER)); |
|
p->textsize = p->highpc - p->lowpc; |
|
+ /* This looks like a typo, but it's here to align the p->froms |
|
+ section. */ |
|
p->kcountsize = ROUNDUP(p->textsize / HISTFRACTION, sizeof(*p->froms)); |
|
p->hashfraction = HASHFRACTION; |
|
p->log_hashfraction = -1; |
|
@@ -142,7 +144,7 @@ __monstartup (u_long lowpc, u_long highpc) |
|
instead of integer division. Precompute shift amount. */ |
|
p->log_hashfraction = ffs(p->hashfraction * sizeof(*p->froms)) - 1; |
|
} |
|
- p->fromssize = p->textsize / HASHFRACTION; |
|
+ p->fromssize = ROUNDUP(p->textsize / HASHFRACTION, sizeof(*p->froms)); |
|
p->tolimit = p->textsize * ARCDENSITY / 100; |
|
if (p->tolimit < MINARCS) |
|
p->tolimit = MINARCS;
|
|
|