perf pmu: Avoid uninitialized use of alias->str

[PATCH v1] perf pmu: Avoid uninitialized use of alias->str

Posted by Ian Rogers 2 years, 5 months ago

alias is allocated with malloc allowing uninitialized memory to be
accessed. The initialization of str was moved late after it could have
been updated by a JSON event, however, this create a potential for an
uninitialized use. Fix this by assigning str to NULL early. Testing on
ARM (Raspberry Pi) showed a memory leak in the same code so add a
zfree.

Fixes: f63a536f03a2 ("perf pmu: Merge JSON events with sysfs at load time")
Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/util/pmu.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index cde33e01959a..b3f8f3f1e900 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -532,6 +532,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name,
 	if (!alias)
 		return -ENOMEM;
 
+	alias->str = NULL;
 	INIT_LIST_HEAD(&alias->terms);
 	alias->scale = 1.0;
 	alias->unit[0] = '\0';
@@ -593,6 +594,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name,
 			ret += scnprintf(newval + ret, sizeof(newval) - ret,
 					 "%s=%s", term->config, term->val.str);
 	}
+	zfree(&alias->str);
 	alias->str = strdup(newval);
 	if (!pe)
 		pmu->sysfs_aliases++;
-- 
2.42.0.rc2.253.gd59a3bf2b4-goog

Re: [PATCH v1] perf pmu: Avoid uninitialized use of alias->str

Posted by Namhyung Kim 2 years, 5 months ago

Hi Ian,

On Tue, Aug 29, 2023 at 5:05 PM Ian Rogers <irogers@google.com> wrote:
>
> alias is allocated with malloc allowing uninitialized memory to be
> accessed. The initialization of str was moved late after it could have
> been updated by a JSON event, however, this create a potential for an
> uninitialized use. Fix this by assigning str to NULL early. Testing on
> ARM (Raspberry Pi) showed a memory leak in the same code so add a
> zfree.
>
> Fixes: f63a536f03a2 ("perf pmu: Merge JSON events with sysfs at load time")
> Signed-off-by: Ian Rogers <irogers@google.com>

Acked-by: Namhyung Kim <namhyung@kernel.org>

Thanks,
Namhyung


> ---
>  tools/perf/util/pmu.c | 2 ++
>  1 file changed, 2 insertions(+)
>
> diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
> index cde33e01959a..b3f8f3f1e900 100644
> --- a/tools/perf/util/pmu.c
> +++ b/tools/perf/util/pmu.c
> @@ -532,6 +532,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name,
>         if (!alias)
>                 return -ENOMEM;
>
> +       alias->str = NULL;
>         INIT_LIST_HEAD(&alias->terms);
>         alias->scale = 1.0;
>         alias->unit[0] = '\0';
> @@ -593,6 +594,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name,
>                         ret += scnprintf(newval + ret, sizeof(newval) - ret,
>                                          "%s=%s", term->config, term->val.str);
>         }
> +       zfree(&alias->str);
>         alias->str = strdup(newval);
>         if (!pe)
>                 pmu->sysfs_aliases++;
> --
> 2.42.0.rc2.253.gd59a3bf2b4-goog
>

Re: [PATCH v1] perf pmu: Avoid uninitialized use of alias->str

Posted by Arnaldo Carvalho de Melo 2 years, 5 months ago

Em Tue, Aug 29, 2023 at 07:23:58PM -0700, Namhyung Kim escreveu:
> Hi Ian,
> 
> On Tue, Aug 29, 2023 at 5:05 PM Ian Rogers <irogers@google.com> wrote:
> >
> > alias is allocated with malloc allowing uninitialized memory to be
> > accessed. The initialization of str was moved late after it could have
> > been updated by a JSON event, however, this create a potential for an
> > uninitialized use. Fix this by assigning str to NULL early. Testing on
> > ARM (Raspberry Pi) showed a memory leak in the same code so add a
> > zfree.
> >
> > Fixes: f63a536f03a2 ("perf pmu: Merge JSON events with sysfs at load time")
> > Signed-off-by: Ian Rogers <irogers@google.com>
> 
> Acked-by: Namhyung Kim <namhyung@kernel.org>

Thanks, applied.

- Arnaldo
 
> Thanks,
> Namhyung
> 
> 
> > ---
> >  tools/perf/util/pmu.c | 2 ++
> >  1 file changed, 2 insertions(+)
> >
> > diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
> > index cde33e01959a..b3f8f3f1e900 100644
> > --- a/tools/perf/util/pmu.c
> > +++ b/tools/perf/util/pmu.c
> > @@ -532,6 +532,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name,
> >         if (!alias)
> >                 return -ENOMEM;
> >
> > +       alias->str = NULL;
> >         INIT_LIST_HEAD(&alias->terms);
> >         alias->scale = 1.0;
> >         alias->unit[0] = '\0';
> > @@ -593,6 +594,7 @@ static int perf_pmu__new_alias(struct perf_pmu *pmu, const char *name,
> >                         ret += scnprintf(newval + ret, sizeof(newval) - ret,
> >                                          "%s=%s", term->config, term->val.str);
> >         }
> > +       zfree(&alias->str);
> >         alias->str = strdup(newval);
> >         if (!pe)
> >                 pmu->sysfs_aliases++;
> > --
> > 2.42.0.rc2.253.gd59a3bf2b4-goog
> >

-- 

- Arnaldo