Re: [PATCH 1/4] perf config: Move perf_config__set_variable() to util/config.c

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] perf: NULL pointer dereference in perf_config__set_variable()
--

commit 0d5767702c97c90061c56a5a96f7d7f30aec5f53
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf config: Move perf_config__set_variable() to util/config.c
    
This commit moves perf_config__set_variable() out of the perf config builtin
to util/config.c so that opt-in features can persist their choices from
outside it. It also introduces mutexes to serialize configuration parsing
and rewriting.

> diff --git a/tools/perf/util/config.c b/tools/perf/util/config.c
> index 8fe43b032e9af..43994786eb964 100644
> --- a/tools/perf/util/config.c
> +++ b/tools/perf/util/config.c

[ ... ]

> +int perf_config__set_variable(const char *var, const char *value)
> +{
> +	char path[PATH_MAX];
> +	char *user_config = mkpath(path, sizeof(path), "%s/.perfconfig", getenv("HOME"));
> +	const char *config_filename = config_exclusive_filename ?: user_config;
> +		/*
> +	 * When rewriting the system wide file all entries are marked as coming
> +	 * from it and must be kept, or it would be truncated down to its
> +	 * header.
> +	 */
> +	bool system_config = strcmp(config_filename, perf_etc_perfconfig()) == 0;

[Severity: Medium]
When the system is under memory pressure, strdup() inside system_path() can
fail and return NULL for absolute paths like ETC_PERFCONFIG. In this case,
perf_etc_perfconfig() caches and returns this NULL value.

Since strcmp() is called directly with the return value of
perf_etc_perfconfig() as its second argument in perf_config__set_variable(),
could this unconditionally dereference a NULL pointer and cause a crash
under memory exhaustion?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928162250.2413383-1-acme@kernel.org?part=1