diff options
author | Simon Kissane <skissane@gmail.com> | 2023-02-11 08:58:02 +1100 |
---|---|---|
committer | DJ Delorie <dj@redhat.com> | 2023-02-22 21:03:30 -0500 |
commit | bde121872001d8f3224eeafa5b7effb871c3fbca (patch) | |
tree | 7b3051e54e9d17873a2cf02a5161a3a21b00f351 /gmon/Makefile | |
parent | 31be941e4367c001b2009308839db5c67bf9dcbc (diff) | |
download | glibc-bde121872001d8f3224eeafa5b7effb871c3fbca.tar.gz glibc-bde121872001d8f3224eeafa5b7effb871c3fbca.tar.xz glibc-bde121872001d8f3224eeafa5b7effb871c3fbca.zip |
gmon: fix memory corruption issues [BZ# 30101]
V2 of this patch fixes an issue in V1, where the state was changed to ON not OFF at end of _mcleanup. I hadn't noticed that (counterintuitively) ON=0 and OFF=3, hence zeroing the buffer turned it back on. So set the state to OFF after the memset. 1. Prevent double free, and reads from unallocated memory, when _mcleanup is (incorrectly) called two or more times in a row, without an intervening call to __monstartup; with this patch, the second and subsequent calls effectively become no-ops instead. While setting tos=NULL is minimal fix, safest action is to zero the whole gmonparam buffer. 2. Prevent memory leak when __monstartup is (incorrectly) called two or more times in a row, without an intervening call to _mcleanup; with this patch, the second and subsequent calls effectively become no-ops instead. 3. After _mcleanup, treat __moncontrol(1) as __moncontrol(0) instead. With zeroing of gmonparam buffer in _mcleanup, this stops the state incorrectly being changed to GMON_PROF_ON despite profiling actually being off. If we'd just done the minimal fix to _mcleanup of setting tos=NULL, there is risk of far worse memory corruption: kcount would point to deallocated memory, and the __profil syscall would make the kernel write profiling data into that memory, which could have since been reallocated to something unrelated. 4. Ensure __moncontrol(0) still turns off profiling even in error state. Otherwise, if mcount overflows and sets state to GMON_PROF_ERROR, when _mcleanup calls __moncontrol(0), the __profil syscall to disable profiling will not be invoked. _mcleanup will free the buffer, but the kernel will still be writing profiling data into it, potentially corrupted arbitrary memory. Also adds a test case for (1). Issues (2)-(4) are not feasible to test. Signed-off-by: Simon Kissane <skissane@gmail.com> Reviewed-by: DJ Delorie <dj@redhat.com>
Diffstat (limited to 'gmon/Makefile')
-rw-r--r-- | gmon/Makefile | 15 |
1 files changed, 14 insertions, 1 deletions
diff --git a/gmon/Makefile b/gmon/Makefile index 83837dd689..213622a7ad 100644 --- a/gmon/Makefile +++ b/gmon/Makefile @@ -1,4 +1,5 @@ # Copyright (C) 1995-2023 Free Software Foundation, Inc. +# Copyright The GNU Toolchain Authors. # This file is part of the GNU C Library. # The GNU C Library is free software; you can redistribute it and/or @@ -25,7 +26,7 @@ include ../Makeconfig headers := sys/gmon.h sys/gmon_out.h sys/profil.h routines := gmon mcount profil sprofil prof-freq -tests = tst-sprofil tst-gmon tst-mcount-overflow +tests = tst-sprofil tst-gmon tst-mcount-overflow tst-mcleanup ifeq ($(build-profile),yes) tests += tst-profile-static tests-static += tst-profile-static @@ -68,6 +69,14 @@ ifeq ($(run-built-tests),yes) tests-special += $(objpfx)tst-mcount-overflow-check.out endif +CFLAGS-tst-mcleanup.c := -fno-omit-frame-pointer -pg +tst-mcleanup-no-pie = yes +CRT-tst-mcleanup := $(csu-objpfx)g$(start-installed-name) +tst-mcleanup-ENV := GMON_OUT_PREFIX=$(objpfx)tst-mcleanup.data +ifeq ($(run-built-tests),yes) +tests-special += $(objpfx)tst-mcleanup.out +endif + CFLAGS-tst-gmon-static.c := $(PIE-ccflag) -fno-omit-frame-pointer -pg CRT-tst-gmon-static := $(csu-objpfx)g$(static-start-installed-name) tst-gmon-static-no-pie = yes @@ -123,6 +132,10 @@ $(objpfx)tst-mcount-overflow-check.out: tst-mcount-overflow-check.sh $(objpfx)ts $(SHELL) $< $(objpfx)tst-mcount-overflow > $@; \ $(evaluate-test) +$(objpfx)tst-mcleanup.out: clean-tst-mcleanup-data +clean-tst-mcleanup-data: + rm -f $(objpfx)tst-mcleanup.data.* + $(objpfx)tst-gmon-gprof.out: tst-gmon-gprof.sh $(objpfx)tst-gmon.out $(SHELL) $< $(GPROF) $(objpfx)tst-gmon $(objpfx)tst-gmon.data.* > $@; \ $(evaluate-test) |