linux-kernel - Re: [PATCH v5 2/3] perf tests: avoid storing an absolute path in perf binary

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 20 May 2021 23:59:27 -0700
From:   Namhyung Kim <namhyung@...nel.org>
To:     Denys Zagorui <dzagorui@...co.com>
Cc:     Jiri Olsa <jolsa@...hat.com>,
        linux-kernel <linux-kernel@...r.kernel.org>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Subject: Re: [PATCH v5 2/3] perf tests: avoid storing an absolute path in perf binary

Hello,

On Mon, May 17, 2021 at 1:46 AM Denys Zagorui <dzagorui@...co.com> wrote:
>
> python binding test uses PYTHONPATH definition to find python/perf.so
> library. This definition is an absolute path that makes perf binary
> unreproducible. This path can be found during runtime execution.
>
> Signed-off-by: Denys Zagorui <dzagorui@...co.com>
> ---
[SNIP]
> +char *perf_exe_path(void)
> +{
> +       char *buf;
> +       char *dname;
> +
> +       buf = malloc(PATH_MAX);
> +       if (buf == NULL)
> +               return NULL;
> +
> +       buf = perf_exe(buf, PATH_MAX);
> +
> +       dname = dirname(buf);
> +
> +       free(buf);
> +       return dname;

I don't think it's safe to use dname after freeing buf.

Thanks,
Namhyung


> +}
> diff --git a/tools/perf/util/util.h b/tools/perf/util/util.h
> index 80b194ee6c7d..4b506df4e8b9 100644
> --- a/tools/perf/util/util.h
> +++ b/tools/perf/util/util.h
> @@ -49,6 +49,7 @@ void perf_set_singlethreaded(void);
>  void perf_set_multithreaded(void);
>
>  char *perf_exe(char *buf, int len);
> +char *perf_exe_path(void);
>
>  #ifndef O_CLOEXEC
>  #ifdef __sparc__
> --
> 2.26.2.Cisco
>