linux-kernel - Re: [PATCH v4] perf trace: Fix possible insufficient allocation of argument formats

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <Z-rDXsgIqvvd7hFk@gmail.com>
Date: Mon, 31 Mar 2025 09:31:26 -0700
From: Howard Chu <howardchu95@...il.com>
To: Namhyung Kim <namhyung@...nel.org>
Cc: acme@...nel.org, mingo@...hat.com, mark.rutland@....com,
	alexander.shishkin@...ux.intel.com, jolsa@...nel.org,
	irogers@...gle.com, adrian.hunter@...el.com, peterz@...radead.org,
	kan.liang@...ux.intel.com, linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org
Subject: Re: [PATCH v4] perf trace: Fix possible insufficient allocation of
 argument formats

Hello Namhyung,

On Sat, Mar 29, 2025 at 10:31:01PM -0700, Namhyung Kim wrote:
> Hello,
> 
> On Thu, Mar 27, 2025 at 08:07:12AM -0700, Howard Chu wrote:
> > In my previous fix of runtime error(Link:
> > https://lore.kernel.org/linux-perf-users/20250122025519.361873-1-howardchu95@gmail.com/),
> 
> We usually handle this by adding a footnote style link like, [1].
> 
> > I made a mistake of decrementing one unconditionally, regardless of
> > whether an extra 'syscall_nr' or 'nr' field was present in
> > libtraceevent's tp_format. This may cause perf trace to allocate one
> > fewer arg_fmt entry than needed for the accurate representation of syscall
> > arguments.
> > 
> > This patch corrects the mistake by checking the presence of'syscall_nr' or
> > 'nr', and adjusting the length of arg_fmt[] accordingly.
> > 
> > Signed-off-by: Howard Chu <howardchu95@...il.com>
> > Suggested-by: Namhyung Kim <namhyung@...nel.org>
> > Fixes: c7b87ce0dd10 ("perf trace: Fix runtime error of index out of bounds")
> 
> And add the link here.
> 
> [1] (actual URL here)

Thanks I'll update the commit message.

> 
> Also you need to keep three dashes "---" before the change log so that
> it can be treated as comments (and not added to the commit message).

Oopsie, got it thanks.

> 
> Please take a look at my previous posting.
> 
> https://lore.kernel.org/r/20250326044001.3503432-1-namhyung@kernel.org
> 
> Thanks,
> Namhyung

Thanks,
Howard
> 
> 
> > 
> > Changes in v4:
> > - Make the patch apply
> > 
> > Changes in v3:
> > - Add 'Fixes:' tag
> > 
> > Changes in v2:
> > - Simplify the code (written by Namhyung)
> > 
> >  tools/perf/builtin-trace.c | 16 +++++-----------
> >  1 file changed, 5 insertions(+), 11 deletions(-)
> > 
> > diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> > index a102748bd0c9..439e152186da 100644
> > --- a/tools/perf/builtin-trace.c
> > +++ b/tools/perf/builtin-trace.c
> > @@ -2022,9 +2022,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
> >  {
> >  	int idx;
> >  
> > -	if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0)
> > -		nr_args = sc->fmt->nr_args;
> > -
> >  	sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt));
> >  	if (sc->arg_fmt == NULL)
> >  		return -1;
> > @@ -2034,7 +2031,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
> >  			sc->arg_fmt[idx] = sc->fmt->arg[idx];
> >  	}
> >  
> > -	sc->nr_args = nr_args;
> >  	return 0;
> >  }
> >  
> > @@ -2176,14 +2172,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
> >  		return err;
> >  	}
> >  
> > -	/*
> > -	 * The tracepoint format contains __syscall_nr field, so it's one more
> > -	 * than the actual number of syscall arguments.
> > -	 */
> > -	if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
> > -		return -ENOMEM;
> > -
> >  	sc->args = sc->tp_format->format.fields;
> > +	sc->nr_args = sc->tp_format->format.nr_fields;
> > +
> >  	/*
> >  	 * We need to check and discard the first variable '__syscall_nr'
> >  	 * or 'nr' that mean the syscall number. It is needless here.
> > @@ -2194,6 +2185,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
> >  		--sc->nr_args;
> >  	}
> >  
> > +	if (syscall__alloc_arg_fmts(sc, sc->nr_args))
> > +		return -ENOMEM;
> > +
> >  	sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit");
> >  	sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat");
> >  
> > -- 
> > 2.45.2
> >