linux-kernel - [PATCH] perf test: Subtest Exclude disjoint subcmd names fails

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260120121508.4054348-1-tmricht@linux.ibm.com>
Date: Tue, 20 Jan 2026 13:15:08 +0100
From: Thomas Richter <tmricht@...ux.ibm.com>
To: linux-kernel@...r.kernel.org, linux-s390@...r.kernel.org,
        linux-perf-users@...r.kernel.org, acme@...nel.org, namhyung@...nel.org,
        irogers@...gle.com
Cc: agordeev@...ux.ibm.com, gor@...ux.ibm.com, sumanthk@...ux.ibm.com,
        hca@...ux.ibm.com, japo@...ux.ibm.com,
        Thomas Richter <tmricht@...ux.ibm.com>
Subject: [PATCH] perf test: Subtest Exclude disjoint subcmd names fails

The perf test case 'libsubcmd help tests', subtest
'Exclude disjoint subcmd names' fails all the time.

Root case is a special case of sorted input which the exclude_cmds()
in libsubcmd can not handle. Assume the following inputs:
cmds = { X, Y, Z } and excludes = { A, B }.

This leads to
 ci  cj  ei   cmds-name  excludes
 ----------|--------------------
 0   0   0 |     X         A       :    cmp > 0, ei++
 0   0   1 |     X         B       :    cmp > 0, ei++

At this point, the loop is terminated due to ei == excludes->cnt.
The for-loop now checks for trailing names which had to be deleted.
But the first entry points to a name: cmds->names[0].name == "X"
and this is a valid entry.

This is the case when all commands listed in excludes are less than
all commands listed in cmds.
Only check for existing names when cmds list was changed, that is ci != cj.

Also remove an needed if (cmp > 0).

-
Output before:
 # ./perf test -F 68
 68.1: Load subcmd names                           : Ok
 68.2: Uniquify subcmd names                       : Ok
 68.3: Exclude duplicate subcmd names              : Ok
 perf: help.c:112: exclude_cmds: Assertion `cmds->names[ci] == NULL' \
	failed.
 Aborted                    ./perf test -F 68

Output after:
 # ./perf test -F 68
 68.1: Load subcmd names                           : Ok
 68.2: Uniquify subcmd names                       : Ok
 68.3: Exclude duplicate subcmd names              : Ok
 68.4: Exclude disjoint subcmd names               : Ok

Fixes: 1fdf938168c4 ("perf tools: Fix use-after-free in help_unknown_cmd()")
Cc: Namhyung Kim <namhyung@...nel.org>
Cc: Ian Rogers <irogers@...gle.com>
Signed-off-by: Thomas Richter <tmricht@...ux.ibm.com>
---
 tools/lib/subcmd/help.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/tools/lib/subcmd/help.c b/tools/lib/subcmd/help.c
index ddaeb4eb3e24..1ce5fe507687 100644
--- a/tools/lib/subcmd/help.c
+++ b/tools/lib/subcmd/help.c
@@ -93,19 +93,19 @@ void exclude_cmds(struct cmdnames *cmds, struct cmdnames *excludes)
 			zfree(&cmds->names[ci]);
 			ci++;
 			ei++;
-		} else if (cmp > 0) {
+		} else {
 			ei++;
 		}
 	}
-	if (ci != cj) {
+	if (ci != cj) {		/* Verify cmds list only if it changed */
 		while (ci < cmds->cnt) {
 			cmds->names[cj++] = cmds->names[ci];
 			cmds->names[ci++] = NULL;
 		}
+		for (ci = cj; ci < cmds->cnt; ci++)
+			assert(!cmds->names[ci]);
+		cmds->cnt = cj;
 	}
-	for (ci = cj; ci < cmds->cnt; ci++)
-		assert(cmds->names[ci] == NULL);
-	cmds->cnt = cj;
 }
 
 static void get_term_dimensions(struct winsize *ws)
-- 
2.52.0