linux-kernel - [PATCH] perf parse-events: Fix potential null pointer dereference in __add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250812085941.19982-1-zhaoguohan@kylinos.cn>
Date: Tue, 12 Aug 2025 16:59:41 +0800
From: zhaoguohan@...inos.cn
To: peterz@...radead.org,
	mingo@...hat.com,
	acme@...nel.org,
	namhyung@...nel.org,
	mark.rutland@....com,
	alexander.shishkin@...ux.intel.com,
	jolsa@...nel.org,
	irogers@...gle.com,
	adrian.hunter@...el.com,
	kan.liang@...ux.intel.com,
	thomas.falcon@...el.com
Cc: linux-perf-users@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	GuoHan Zhao <zhaoguohan@...inos.cn>
Subject: [PATCH] perf parse-events: Fix potential null pointer dereference in __add_event()

From: GuoHan Zhao <zhaoguohan@...inos.cn>

In the error handling path of __add_event(), if evsel__new_idx() fails
and returns NULL, the subsequent calls to zfree(&evsel->name) and
zfree(&evsel->metric_id) will cause null pointer dereference.

Add a null check before accessing evsel members in the error path.

Signed-off-by: GuoHan Zhao <zhaoguohan@...inos.cn>
---
 tools/perf/util/parse-events.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index 8282ddf68b98..251f1b31b62f 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -313,9 +313,13 @@ __add_event(struct list_head *list, int *idx,
 out_err:
 	perf_cpu_map__put(cpus);
 	perf_cpu_map__put(pmu_cpus);
-	zfree(&evsel->name);
-	zfree(&evsel->metric_id);
-	free(evsel);
+
+	if (evsel) {
+		zfree(&evsel->name);
+		zfree(&evsel->metric_id);
+		free(evsel);
+	}
+
 	return NULL;
 }
 
-- 
2.43.0