mirror of
https://sourceware.org/git/glibc.git
synced 2024-11-27 03:33:33 +08:00
bde1218720
V2 of this patch fixes an issue in V1, where the state was changed to ON not OFF at end of _mcleanup. I hadn't noticed that (counterintuitively) ON=0 and OFF=3, hence zeroing the buffer turned it back on. So set the state to OFF after the memset. 1. Prevent double free, and reads from unallocated memory, when _mcleanup is (incorrectly) called two or more times in a row, without an intervening call to __monstartup; with this patch, the second and subsequent calls effectively become no-ops instead. While setting tos=NULL is minimal fix, safest action is to zero the whole gmonparam buffer. 2. Prevent memory leak when __monstartup is (incorrectly) called two or more times in a row, without an intervening call to _mcleanup; with this patch, the second and subsequent calls effectively become no-ops instead. 3. After _mcleanup, treat __moncontrol(1) as __moncontrol(0) instead. With zeroing of gmonparam buffer in _mcleanup, this stops the state incorrectly being changed to GMON_PROF_ON despite profiling actually being off. If we'd just done the minimal fix to _mcleanup of setting tos=NULL, there is risk of far worse memory corruption: kcount would point to deallocated memory, and the __profil syscall would make the kernel write profiling data into that memory, which could have since been reallocated to something unrelated. 4. Ensure __moncontrol(0) still turns off profiling even in error state. Otherwise, if mcount overflows and sets state to GMON_PROF_ERROR, when _mcleanup calls __moncontrol(0), the __profil syscall to disable profiling will not be invoked. _mcleanup will free the buffer, but the kernel will still be writing profiling data into it, potentially corrupted arbitrary memory. Also adds a test case for (1). Issues (2)-(4) are not feasible to test. Signed-off-by: Simon Kissane <skissane@gmail.com> Reviewed-by: DJ Delorie <dj@redhat.com> |
||
|---|---|---|
| .. | ||
| sys | ||
| gmon.c | ||
| Makefile | ||
| mcount.c | ||
| prof-freq.c | ||
| profil.c | ||
| sprofil.c | ||
| tst-gmon-gprof.sh | ||
| tst-gmon-pie.c | ||
| tst-gmon-static-gprof.sh | ||
| tst-gmon-static-pie.c | ||
| tst-gmon-static.c | ||
| tst-gmon.c | ||
| tst-mcleanup.c | ||
| tst-mcount-overflow-check.sh | ||
| tst-mcount-overflow.c | ||
| tst-profile-static.c | ||
| tst-sprofil.c | ||
| Versions | ||