linux-kernel - Re: [PATCH v16 4/4] perf tools: Merge deferred user callchains

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20251002134938.756db4ef@gandalf.local.home>
Date: Thu, 2 Oct 2025 13:49:38 -0400
From: Steven Rostedt <rostedt@...dmis.org>
To: Steven Rostedt <rostedt@...nel.org>
Cc: linux-kernel@...r.kernel.org, linux-trace-kernel@...r.kernel.org,
 bpf@...r.kernel.org, x86@...nel.org, Masami Hiramatsu
 <mhiramat@...nel.org>, Mathieu Desnoyers <mathieu.desnoyers@...icios.com>,
 Josh Poimboeuf <jpoimboe@...nel.org>, Peter Zijlstra
 <peterz@...radead.org>, Ingo Molnar <mingo@...nel.org>, Jiri Olsa
 <jolsa@...nel.org>, Arnaldo Carvalho de Melo <acme@...nel.org>, Namhyung
 Kim <namhyung@...nel.org>, Thomas Gleixner <tglx@...utronix.de>, Andrii
 Nakryiko <andrii@...nel.org>, Indu Bhagat <indu.bhagat@...cle.com>, "Jose
 E. Marchesi" <jemarch@....org>, Beau Belgrave <beaub@...ux.microsoft.com>,
 Jens Remus <jremus@...ux.ibm.com>, Linus Torvalds
 <torvalds@...ux-foundation.org>, Andrew Morton <akpm@...ux-foundation.org>,
 Florian Weimer <fweimer@...hat.com>, Sam James <sam@...too.org>, Kees Cook
 <kees@...nel.org>, "Carlos O'Donell" <codonell@...hat.com>
Subject: Re: [PATCH v16 4/4] perf tools: Merge deferred user callchains

On Mon, 08 Sep 2025 13:53:23 -0400
Steven Rostedt <rostedt@...nel.org> wrote:

> +static int evlist__deliver_deferred_samples(struct evlist *evlist,
> +					    const struct perf_tool *tool,
> +					    union  perf_event *event,
> +					    struct perf_sample *sample,
> +					    struct machine *machine)
> +{
> +	struct deferred_event *de, *tmp;
> +	struct evsel *evsel;
> +	int ret = 0;
> +
> +	if (!tool->merge_deferred_callchains) {
> +		evsel = evlist__id2evsel(evlist, sample->id);
> +		return tool->callchain_deferred(tool, event, sample,
> +						evsel, machine);
> +	}
> +
> +	list_for_each_entry_safe(de, tmp, &evlist->deferred_samples, list) {
> +		struct perf_sample orig_sample;

orig_sample is not initialized and can then contain junk.

> +
> +		ret = evlist__parse_sample(evlist, de->event, &orig_sample);
> +		if (ret < 0) {
> +			pr_err("failed to parse original sample\n");
> +			break;
> +		}
> +
> +		if (sample->tid != orig_sample.tid)
> +			continue;
> +
> +		if (event->callchain_deferred.cookie == orig_sample.deferred_cookie)
> +			sample__merge_deferred_callchain(&orig_sample, sample);

The sample__merge_deferred_callchain() initializes both
orig_sample.deferred_callchain and the callchain. But now that it's not
being called, it can cause the below free to happen with junk as the
callchain. This needs:

		else
			orig_sample.deferred_callchain = false;

> +
> +		evsel = evlist__id2evsel(evlist, orig_sample.id);
> +		ret = evlist__deliver_sample(evlist, tool, de->event,
> +					     &orig_sample, evsel,> machine); +
> +		if (orig_sample.deferred_callchain)
> +			free(orig_sample.callchain);
> +
> +		list_del(&de->list);
> +		free(de);
> +
> +		if (ret)
> +			break;
> +	}
> +	return ret;
> +}

-- Steve