linux-kernel - [PATCH] perf symbol: Fix uninitialized return value in symbols__find_by

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20230630153840.858668-1-james.clark@arm.com>
Date:   Fri, 30 Jun 2023 16:38:39 +0100
From:   James Clark <james.clark@....com>
To:     linux-perf-users@...r.kernel.org, irogers@...gle.com
Cc:     James Clark <james.clark@....com>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Jiri Olsa <jolsa@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Adrian Hunter <adrian.hunter@...el.com>,
        linux-kernel@...r.kernel.org
Subject: [PATCH] perf symbol: Fix uninitialized return value in symbols__find_by_name()

found_idx and s aren't initialized, so if no symbol is found then the
assert at the end will index off the end of the array causing a
segfault. The function also doesn't return NULL when the symbol isn't
found even if the assert passes. Fix it by initializing the values and
only setting them when something is found.

Fixes the following test failure:

  $ perf test 1
  1: vmlinux symtab matches kallsyms     : FAILED!

Fixes: 259dce914e93 ("perf symbol: Remove symbol_name_rb_node")
Signed-off-by: James Clark <james.clark@....com>
---
 tools/perf/util/symbol.c | 16 +++++++++-------
 1 file changed, 9 insertions(+), 7 deletions(-)

diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index bc79291b9f3b..f849f9ef68e6 100644
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -495,7 +495,10 @@ static struct symbol *symbols__find_by_name(struct symbol *symbols[],
 					    size_t *found_idx)
 {
 	size_t i, lower = 0, upper = symbols_len;
-	struct symbol *s;
+	struct symbol *s = NULL;
+
+	if (found_idx)
+		*found_idx = SIZE_MAX;
 
 	if (!symbols_len)
 		return NULL;
@@ -504,8 +507,7 @@ static struct symbol *symbols__find_by_name(struct symbol *symbols[],
 		int cmp;
 
 		i = (lower + upper) / 2;
-		s = symbols[i];
-		cmp = symbol__match_symbol_name(s->name, name, includes);
+		cmp = symbol__match_symbol_name(symbols[i]->name, name, includes);
 
 		if (cmp > 0)
 			upper = i;
@@ -514,10 +516,11 @@ static struct symbol *symbols__find_by_name(struct symbol *symbols[],
 		else {
 			if (found_idx)
 				*found_idx = i;
+			s = symbols[i];
 			break;
 		}
 	}
-	if (includes != SYMBOL_TAG_INCLUDE__DEFAULT_ONLY) {
+	if (s && includes != SYMBOL_TAG_INCLUDE__DEFAULT_ONLY) {
 		/* return first symbol that has same name (if any) */
 		for (; i > 0; i--) {
 			struct symbol *tmp = symbols[i - 1];
@@ -525,13 +528,12 @@ static struct symbol *symbols__find_by_name(struct symbol *symbols[],
 			if (!arch__compare_symbol_names(tmp->name, s->name)) {
 				if (found_idx)
 					*found_idx = i - 1;
+				s = tmp;
 			} else
 				break;
-
-			s = tmp;
 		}
 	}
-	assert(!found_idx || s == symbols[*found_idx]);
+	assert(!found_idx || !s || s == symbols[*found_idx]);
 	return s;
 }
 
-- 
2.34.1