Project

General

Profile

Actions
Copy link

Bug #1238

closed

AddressSanitizer detects an global buffer overflow when we iterate over tracepoint sections

Added by Mathieu Desnoyers about 4 years ago. Updated about 4 years ago.

Status:
Resolved
Priority:
Normal
Assignee:
Mathieu Desnoyers
Target version:
-
Start date:
02/17/2020
Due date:
% Done:

0%

Estimated time:

Description

Building lttng-ust with:

CC="clang-9" CFLAGS="-g -O0 -fsanitize=address" LDFLAGS="-fsanitize=address -fno-omit-frame-pointer" ./configure && make

then running tests/hello/hello :

=================================================================
5772ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f1e9d589270 at pc 0x7f1e9d16103f bp 0x7fff2e875ff0 sp 0x7fff2e875fe8
READ of size 4 at 0x7f1e9d589270 thread T0
#0 0x7f1e9d16103e in hashlittle /home/efficios/git/lttng-ust/liblttng-ust/./jhash.h:129:15
#1 0x7f1e9d160322 in jhash /home/efficios/git/lttng-ust/liblttng-ust/./jhash.h:256:9
#2 0x7f1e9d1657a2 in add_callsite /home/efficios/git/lttng-ust/liblttng-ust/tracepoint.c:422:9
#3 0x7f1e9d15d518 in lib_register_callsites /home/efficios/git/lttng-ust/liblttng-ust/tracepoint.c:552:3
#4 0x7f1e9d15ca91 in tracepoint_register_lib /home/efficios/git/lttng-ust/liblttng-ust/tracepoint.c:903:2
#5 0x7f1e9d4a124e in _tracepoints_ptrs_init /home/efficios/git/lttng-ust/liblttng-ust/../include/lttng/tracepoint.h:485:3
#6 0x7f1e9d4a2d8d in lttng_ust_statedump_init /home/efficios/git/lttng-ust/liblttng-ust/lttng-ust-statedump.c:645:2
#7 0x7f1e9d409a85 in lttng_ust_init /home/efficios/git/lttng-ust/liblttng-ust/lttng-ust-comm.c:1846:2
#8 0x7f1e9d7e0732 (/lib64/ld-linux-x86-64.so.2+0x10732)
#9 0x7f1e9d7d10c9 (/lib64/ld-linux-x86-64.so.2+0x10c9)

0x7f1e9d589270 is located 48 bytes to the left of global variable '__tp_strtab_lttng_ust_lib___build_id' defined in './ust_lib.h:55:1' (0x7f1e9d5892a0) of size 23
'__tp_strtab_lttng_ust_lib___build_id' is ascii string 'lttng_ust_lib:build_id'
0x7f1e9d589273 is located 0 bytes to the right of global variable '__tp_strtab_lttng_ust_lib___load' defined in './ust_lib.h:42:1' (0x7f1e9d589260) of size 19
'__tp_strtab_lttng_ust_lib___load' is ascii string 'lttng_ust_lib:load'
SUMMARY: AddressSanitizer: global-buffer-overflow /home/efficios/git/lttng-ust/liblttng-ust/./jhash.h:129:15 in hashlittle
Shadow bytes around the buggy address:
0x0fe453aa91f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fe453aa9200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fe453aa9210: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fe453aa9220: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x0fe453aa9230: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
=>0x0fe453aa9240: 00 00 00 00 00 00 00 00 00 00 00 00 00 0003f9
0x0fe453aa9250: f9 f9 f9 f9 00 00 07 f9 f9 f9 f9 f9 00 00 00 01
0x0fe453aa9260: f9 f9 f9 f9 00 00 05 f9 f9 f9 f9 f9 00 00 00 02
0x0fe453aa9270: f9 f9 f9 f9 00 00 00 05 f9 f9 f9 f9 00 00 00 05
0x0fe453aa9280: f9 f9 f9 f9 00 00 00 07 f9 f9 f9 f9 00 00 00 05
0x0fe453aa9290: f9 f9 f9 f9 00 00 00 f9 f9 f9 f9 f9 00 00 07 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
5772ABORTING

Actions
Copy link
 #1

Updated by Mathieu Desnoyers about 4 years ago

Actually, the splat above seems to be related to jhash.h.

Actions
Copy link
 #2

Updated by Mathieu Desnoyers about 4 years ago

Which is a documented limitation in jhash.h:

  • "k2&0xffffff" actually reads beyond the end of the string, but
  • then masks off the part it's not allowed to read. Because the
  • string is aligned, the masked-off tail is in the same word as the
  • rest of the string. Every machine with memory protection I've seen
  • does it on word boundaries, so is OK with this. But VALGRIND will
  • still catch it and complain. The masking trick does make the hash
  • noticably faster for short strings (like English words).
Actions
Copy link
 #3

Updated by Mathieu Desnoyers about 4 years ago

After fixing jhash.h, here is the tracepoint splat:

=================================================================
16513ERROR: AddressSanitizer: global-buffer-overflow on address 0x7f65d99412c8 at pc 0x7f65d92db469 bp 0x7fff1c2be8b0 sp 0x7fff1c2be8a8
READ of size 8 at 0x7f65d99412c8 thread T0
#0 0x7f65d92db468 in lib_register_callsites /home/efficios/git/lttng-ust/liblttng-ust/tracepoint.c:547:8
#1 0x7f65d92daa91 in tracepoint_register_lib /home/efficios/git/lttng-ust/liblttng-ust/tracepoint.c:903:2
#2 0x7f65d961e9ee in _tracepoints_ptrs_init /home/efficios/git/lttng-ust/liblttng-ust/../include/lttng/tracepoint.h:485:3
#3 0x7f65d962052d in lttng_ust_statedump_init /home/efficios/git/lttng-ust/liblttng-ust/lttng-ust-statedump.c:645:2
#4 0x7f65d9587a85 in lttng_ust_init /home/efficios/git/lttng-ust/liblttng-ust/lttng-ust-comm.c:1846:2
#5 0x7f65d995d732 (/lib64/ld-linux-x86-64.so.2+0x10732)
#6 0x7f65d994e0c9 (/lib64/ld-linux-x86-64.so.2+0x10c9)

0x7f65d99412c8 is located 56 bytes to the left of global variable '__tracepoint_ptr_lttng_ust_lib___build_id' defined in './ust_lib.h:55:1' (0x7f65d9941300) of size 8
0x7f65d99412c8 is located 0 bytes to the right of global variable '__tracepoint_ptr_lttng_ust_lib___load' defined in './ust_lib.h:42:1' (0x7f65d99412c0) of size 8
SUMMARY: AddressSanitizer: global-buffer-overflow /home/efficios/git/lttng-ust/liblttng-ust/tracepoint.c:547:8 in lib_register_callsites
Shadow bytes around the buggy address:
0x0fed3b320200: f9 f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
0x0fed3b320210: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
0x0fed3b320220: 00 00 00 f9 f9 f9 f9 f9 00 00 00 00 00 00 00 f9
0x0fed3b320230: f9 f9 f9 f9 00 00 00 00 00 00 00 f9 f9 f9 f9 f9
0x0fed3b320240: 00 00 00 00 00 00 00 f9 f9 f9 f9 f9 00 00 00 00
=>0x0fed3b320250: 00 00 00 f9 f9 f9 f9 f9 00[f9]f9 f9 f9 f9 f9 f9
0x0fed3b320260: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
0x0fed3b320270: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
0x0fed3b320280: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
0x0fed3b320290: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
0x0fed3b3202a0: 00 f9 f9 f9 f9 f9 f9 f9 00 f9 f9 f9 f9 f9 f9 f9
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
Shadow gap: cc
16513ABORTING

Actions
Copy link
 #4

Updated by Mathieu Desnoyers about 4 years ago

  • Status changed from Confirmed to Resolved

Fixed by commits:

commit 4f74bc5ef1bff1198cf47bd823cc5dc2e8fd9649
Author: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Date:   Mon Feb 17 19:25:01 2020 -0500

    Fix: tracepoint.h: Disable address sanitizer on pointer array section variables

commit 9ee5b0883c5aea8f461b6c382d2cf7ee7f3c0ba6
Author: Mathieu Desnoyers <mathieu.desnoyers@efficios.com>
Date:   Mon Feb 17 19:31:41 2020 -0500

    Fix: jhash.h: remove out-of-bound reads
Actions
Copy link

Also available in: Atom PDF