Re: [PATCH v4 3/5] perf trace-event: Avoid double free and leak in trace_event__cleanup()/trace_event__init()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Critical] Fixing a memory leak in `trace_event__init()` introduces an exploitable Use-After-Free when processing malformed or crafted `perf.data` files with multiple `PERF_RECORD_HEADER_TRACING_DATA` headers.
--

--- Patch [3]: [PATCH v4 3/5] perf trace-event: Avoid double free and leak in trace_event__cleanup()/trace_event__init() ---
commit 47e0085adcff000a3a6472e037799a5ddd33c012
Author: Tanushree Shah <tshah@linux.ibm.com>

perf trace-event: Avoid double free and leak in trace_event__cleanup()/trace_event__init()

This commit addresses a double-free in trace_event__cleanup() and a memory
leak in trace_event__init() when a perf.data file contains multiple
PERF_RECORD_HEADER_TRACING_DATA headers. It fixes the leak by calling
trace_event__cleanup() before allocating a new tep handle.

> diff --git a/tools/perf/util/trace-event.c b/tools/perf/util/trace-event.c
> index 6a8c66c64b705..000c1e1d68c16 100644
> --- a/tools/perf/util/trace-event.c
> +++ b/tools/perf/util/trace-event.c
> @@ -26,7 +26,11 @@ static bool tevent_initialized;
>  
>  int trace_event__init(struct trace_event *t)
>  {
> -	struct tep_handle *pevent = tep_alloc();
> +	struct tep_handle *pevent;
> +
> +	trace_event__cleanup(t);
> +

[Severity: Critical]
Could this cleanup introduce a use-after-free when parsing a perf.data
file with multiple PERF_RECORD_HEADER_TRACING_DATA headers?

When trace_event__cleanup(t) frees the existing tep_event objects, any 
evsel->tp_format pointers that were set during the first header's parsing 
are left dangling.

Specifically, in tools/perf/util/header.c:evsel__prepare_tracepoint_event(),
it short-circuits if the pointer is already set:

	/* already prepared */
	if (evsel->tp_format)
		return 0;

This short-circuit prevents evsel->tp_format from being updated to point to
the newly allocated memory. Later, tools/perf/util/evsel.c:evsel__tp_format()
retrieves this dangling pointer:

	if (tp_format)
		return tp_format;

Does this leave the perf tool vulnerable to memory corruption when analyzing
a malformed or maliciously crafted perf.data file?

> +	pevent = tep_alloc();
>  
>  	if (pevent) {
>  		t->plugin_list = tep_load_plugins(pevent);

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260725184953.234759-1-tshah@linux.ibm.com?part=3