linux-kernel - Re: [PATCH v1] perf trace: Fix possible insufficient allocation of argument formats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAH0uvogMRnMVO=7169kSWJzFuTTTJ_r2uUTH6vaFuJDgvN8Q6g@mail.gmail.com>
Date: Wed, 26 Mar 2025 12:52:03 -0700
From: Howard Chu <howardchu95@...il.com>
To: Namhyung Kim <namhyung@...nel.org>
Cc: acme@...nel.org, mingo@...hat.com, mark.rutland@....com, 
	alexander.shishkin@...ux.intel.com, jolsa@...nel.org, irogers@...gle.com, 
	adrian.hunter@...el.com, peterz@...radead.org, kan.liang@...ux.intel.com, 
	linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1] perf trace: Fix possible insufficient allocation of
 argument formats

Hello Namhyung,

On Wed, Mar 26, 2025 at 12:44 PM Namhyung Kim <namhyung@...nel.org> wrote:
>
> On Wed, Mar 26, 2025 at 11:30:11AM -0700, Howard Chu wrote:
> > Hello Namhyung,
> >
> > LGTM. This is better. :)
>
> Great, can you please resend it with my Suggested-by?

Sure.

Thanks,
Howard
>
> Thanks,
> Namhyung
>
> >
> > On Wed, Mar 26, 2025 at 11:21 AM Namhyung Kim <namhyung@...nel.org> wrote:
> > >
> > > On Mon, Mar 24, 2025 at 04:52:45PM -0700, Howard Chu wrote:
> > > > In my previous fix of runtime error(Link:
> > > > https://lore.kernel.org/linux-perf-users/20250122025519.361873-1-howardchu95@gmail.com/),
> > > > I made a mistake of decrementing one unconditionally, regardless of
> > > > whether an extra 'syscall_nr' or 'nr' field was present in
> > > > libtraceevent's tp_format. This may cause perf trace to allocate one
> > > > fewer arg_fmt entry than needed for the accurate representation of syscall
> > > > arguments.
> > > >
> > > > This patch corrects the mistake by checking the presence of'syscall_nr' or
> > > > 'nr', and adjusting the length of arg_fmt[] accordingly.
> > >
> > > Thanks for the fix.  I've noticed this too but I feel like we can make
> > > syscall__alloc_arg_fmts() a bit simpler.
> > >
> > > How about this?
> > >
> > > Thanks,
> > > Namhyung
> > >
> > >
> > > ---8<---
> > > diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> > > index 6ac51925ea4249c2..b9bdab52f5801c3a 100644
> > > --- a/tools/perf/builtin-trace.c
> > > +++ b/tools/perf/builtin-trace.c
> > > @@ -2022,9 +2022,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
> > >  {
> > >         int idx;
> > >
> > > -       if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0)
> > > -               nr_args = sc->fmt->nr_args;
> > > -
> > >         sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt));
> > >         if (sc->arg_fmt == NULL)
> > >                 return -1;
> > > @@ -2034,7 +2031,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
> > >                         sc->arg_fmt[idx] = sc->fmt->arg[idx];
> > >         }
> > >
> > > -       sc->nr_args = nr_args;
> > >         return 0;
> > >  }
> > >
> > > @@ -2176,14 +2172,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
> > >                 return err;
> > >         }
> > >
> > > -       /*
> > > -        * The tracepoint format contains __syscall_nr field, so it's one more
> > > -        * than the actual number of syscall arguments.
> > > -        */
> > > -       if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
> > > -               return -ENOMEM;
> > > -
> > >         sc->args = sc->tp_format->format.fields;
> > > +       sc->nr_args = sc->tp_format->format.nr_fields;
> > > +
> > >         /*
> > >          * We need to check and discard the first variable '__syscall_nr'
> > >          * or 'nr' that mean the syscall number. It is needless here.
> > > @@ -2194,6 +2185,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
> > >                 --sc->nr_args;
> > >         }
> > >
> > > +       if (syscall__alloc_arg_fmts(sc, sc->nr_args))
> > > +               return -ENOMEM;
> > > +
> > >         sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit");
> > >         sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat");
> > >
> > > --
> > > 2.49.0.395.g12beb8f557-goog
> > >