[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20250805004633.135904-3-dapeng1.mi@linux.intel.com>
Date: Tue, 5 Aug 2025 08:46:30 +0800
From: Dapeng Mi <dapeng1.mi@...ux.intel.com>
To: Peter Zijlstra <peterz@...radead.org>,
Ingo Molnar <mingo@...hat.com>,
Arnaldo Carvalho de Melo <acme@...nel.org>,
Namhyung Kim <namhyung@...nel.org>,
Ian Rogers <irogers@...gle.com>,
Adrian Hunter <adrian.hunter@...el.com>,
Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
Kan Liang <kan.liang@...ux.intel.com>
Cc: linux-perf-users@...r.kernel.org,
linux-kernel@...r.kernel.org,
Kevin Tian <kevin.tian@...el.com>,
Dapeng Mi <dapeng1.mi@...el.com>,
Dapeng Mi <dapeng1.mi@...ux.intel.com>
Subject: [PATCH 2/5] perf tools kvm: Fix the potential out of range memory access issue
kvm_add_default_arch_event() helper may add 2 extra options but it
directly modifies the original argv[] array. This may cause out of range
memory access. Fix this issue.
Signed-off-by: Dapeng Mi <dapeng1.mi@...ux.intel.com>
---
tools/perf/builtin-kvm.c | 14 +++++++++-----
1 file changed, 9 insertions(+), 5 deletions(-)
diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
index f78a67a199ff..7e48d2437710 100644
--- a/tools/perf/builtin-kvm.c
+++ b/tools/perf/builtin-kvm.c
@@ -2002,12 +2002,12 @@ static int __cmd_record(const char *file_name, int argc, const char **argv)
int rec_argc, i = 0, j, ret;
const char **rec_argv;
- ret = kvm_add_default_arch_event(&argc, argv);
- if (ret)
- return -EINVAL;
-
rec_argc = argc + 2;
- rec_argv = calloc(rec_argc + 1, sizeof(char *));
+ /*
+ * kvm_add_default_arch_event() may add 2 extra options, so
+ * allocate 2 more pointers in adavance.
+ */
+ rec_argv = calloc(rec_argc + 2 + 1, sizeof(char *));
if (!rec_argv)
return -ENOMEM;
@@ -2019,6 +2019,10 @@ static int __cmd_record(const char *file_name, int argc, const char **argv)
BUG_ON(i != rec_argc);
+ ret = kvm_add_default_arch_event(&i, rec_argv);
+ if (ret)
+ return -EINVAL;
+
ret = cmd_record(i, rec_argv);
free(rec_argv);
return ret;
--
2.34.1
Powered by blists - more mailing lists