[PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Zbigniew Kempczyński]

Doubling test name size might be not enough for realloc if target name
length is larger than test/subtest name size.

Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
Cc: Gustavo Sousa <gustavo.sousa@intel.com>
Cc: Ryszard Knop <ryszard.knop@intel.com>
---
 lib/igt_hook.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/igt_hook.c b/lib/igt_hook.c
index b8f25b6c7a..a44b852da1 100644
--- a/lib/igt_hook.c
+++ b/lib/igt_hook.c
@@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
 	if (len + 1 > *size_ptr) {
 		size_t fullname_size;
 
-		*size_ptr *= 2;
+		*size_ptr += len + 1;
 		*name_ptr = realloc(*name_ptr, *size_ptr);
 
 		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);
-- 
2.54.0

Re: [PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Knop, Ryszard]

Reviewed-by: Ryszard Knop <ryszard.knop@intel.com>

On Mon, 2026-06-29 at 13:54 +0200, Zbigniew Kempczyński wrote:
> Doubling test name size might be not enough for realloc if target name
> length is larger than test/subtest name size.
> 
> Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
> Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> Cc: Ryszard Knop <ryszard.knop@intel.com>
> ---
>  lib/igt_hook.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/lib/igt_hook.c b/lib/igt_hook.c
> index b8f25b6c7a..a44b852da1 100644
> --- a/lib/igt_hook.c
> +++ b/lib/igt_hook.c
> @@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
>  	if (len + 1 > *size_ptr) {
>  		size_t fullname_size;
>  
> -		*size_ptr *= 2;
> +		*size_ptr += len + 1;
>  		*name_ptr = realloc(*name_ptr, *size_ptr);
>  
>  		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);

Re: [PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Gustavo Sousa]

Zbigniew Kempczyński <zbigniew.kempczynski@intel.com> writes:

> Doubling test name size might be not enough for realloc if target name
> length is larger than test/subtest name size.
>
> Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
> Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> Cc: Ryszard Knop <ryszard.knop@intel.com>
> ---
>  lib/igt_hook.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/igt_hook.c b/lib/igt_hook.c
> index b8f25b6c7a..a44b852da1 100644
> --- a/lib/igt_hook.c
> +++ b/lib/igt_hook.c
> @@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
>  	if (len + 1 > *size_ptr) {
>  		size_t fullname_size;
>  
> -		*size_ptr *= 2;
> +		*size_ptr += len + 1;

Oops. My bad. Thanks for finding this!

Do we need to use "+=" instead of "=" above, though?

Also, perhaps we could use roundup_power_of_two(len + 1) to reduce the
number of follow-up reallocs?

--
Gustavo Sousa

>  		*name_ptr = realloc(*name_ptr, *size_ptr);
>  
>  		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);
> -- 
> 2.54.0

Re: [PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Jani Nikula]

On Mon, 29 Jun 2026, Zbigniew Kempczyński <zbigniew.kempczynski@intel.com> wrote:
> Doubling test name size might be not enough for realloc if target name
> length is larger than test/subtest name size.

Might one to point out (if) this is the cause for the segfaults we've
been seeing in CI.

BR,
Jani.

>
> Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
> Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> Cc: Ryszard Knop <ryszard.knop@intel.com>
> ---
>  lib/igt_hook.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/lib/igt_hook.c b/lib/igt_hook.c
> index b8f25b6c7a..a44b852da1 100644
> --- a/lib/igt_hook.c
> +++ b/lib/igt_hook.c
> @@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
>  	if (len + 1 > *size_ptr) {
>  		size_t fullname_size;
>  
> -		*size_ptr *= 2;
> +		*size_ptr += len + 1;
>  		*name_ptr = realloc(*name_ptr, *size_ptr);
>  
>  		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);

-- 
Jani Nikula, Intel

Re: [PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Jani Nikula]

On Mon, 29 Jun 2026, Jani Nikula <jani.nikula@intel.com> wrote:
> On Mon, 29 Jun 2026, Zbigniew Kempczyński <zbigniew.kempczynski@intel.com> wrote:
>> Doubling test name size might be not enough for realloc if target name
>> length is larger than test/subtest name size.
>
> Might one to point out (if) this is the cause for the segfaults we've
> been seeing in CI.

Also, Fixes: ?

>
> BR,
> Jani.
>
>>
>> Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
>> Cc: Gustavo Sousa <gustavo.sousa@intel.com>
>> Cc: Ryszard Knop <ryszard.knop@intel.com>
>> ---
>>  lib/igt_hook.c | 2 +-
>>  1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/lib/igt_hook.c b/lib/igt_hook.c
>> index b8f25b6c7a..a44b852da1 100644
>> --- a/lib/igt_hook.c
>> +++ b/lib/igt_hook.c
>> @@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
>>  	if (len + 1 > *size_ptr) {
>>  		size_t fullname_size;
>>  
>> -		*size_ptr *= 2;
>> +		*size_ptr += len + 1;
>>  		*name_ptr = realloc(*name_ptr, *size_ptr);
>>  
>>  		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);

-- 
Jani Nikula, Intel

Re: [PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Zbigniew Kempczyński]

On Mon, Jun 29, 2026 at 09:17:53AM -0300, Gustavo Sousa wrote:
> Zbigniew Kempczyński <zbigniew.kempczynski@intel.com> writes:
> 
> > Doubling test name size might be not enough for realloc if target name
> > length is larger than test/subtest name size.
> >
> > Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
> > Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> > Cc: Ryszard Knop <ryszard.knop@intel.com>
> > ---
> >  lib/igt_hook.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/lib/igt_hook.c b/lib/igt_hook.c
> > index b8f25b6c7a..a44b852da1 100644
> > --- a/lib/igt_hook.c
> > +++ b/lib/igt_hook.c
> > @@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
> >  	if (len + 1 > *size_ptr) {
> >  		size_t fullname_size;
> >  
> > -		*size_ptr *= 2;
> > +		*size_ptr += len + 1;
> 
> Oops. My bad. Thanks for finding this!
> 
> Do we need to use "+=" instead of "=" above, though?
> 
> Also, perhaps we could use roundup_power_of_two(len + 1) to reduce the
> number of follow-up reallocs?

Yes, that was my intention, maybe I should to add a comment but
that was quickfix and didn't think about it.

--
Zbigniew

> 
> --
> Gustavo Sousa
> 
> >  		*name_ptr = realloc(*name_ptr, *size_ptr);
> >  
> >  		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);
> > -- 
> > 2.54.0

Re: [PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Zbigniew Kempczyński]

On Mon, Jun 29, 2026 at 03:37:38PM +0300, Jani Nikula wrote:
> On Mon, 29 Jun 2026, Jani Nikula <jani.nikula@intel.com> wrote:
> > On Mon, 29 Jun 2026, Zbigniew Kempczyński <zbigniew.kempczynski@intel.com> wrote:
> >> Doubling test name size might be not enough for realloc if target name
> >> length is larger than test/subtest name size.
> >
> > Might one to point out (if) this is the cause for the segfaults we've
> > been seeing in CI.
> 
> Also, Fixes: ?

I'm sorry, I wasn't aware of this issue id, just got link to failing
job so I wanted to fix it quickly. I promise I'll behave decent in
the future and will check this id before sending the patch.

--
Zbigniew

> 
> >
> > BR,
> > Jani.
> >
> >>
> >> Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
> >> Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> >> Cc: Ryszard Knop <ryszard.knop@intel.com>
> >> ---
> >>  lib/igt_hook.c | 2 +-
> >>  1 file changed, 1 insertion(+), 1 deletion(-)
> >>
> >> diff --git a/lib/igt_hook.c b/lib/igt_hook.c
> >> index b8f25b6c7a..a44b852da1 100644
> >> --- a/lib/igt_hook.c
> >> +++ b/lib/igt_hook.c
> >> @@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
> >>  	if (len + 1 > *size_ptr) {
> >>  		size_t fullname_size;
> >>  
> >> -		*size_ptr *= 2;
> >> +		*size_ptr += len + 1;
> >>  		*name_ptr = realloc(*name_ptr, *size_ptr);
> >>  
> >>  		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);
> 
> -- 
> Jani Nikula, Intel

Re: [PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Zbigniew Kempczyński]

On Mon, Jun 29, 2026 at 09:17:53AM -0300, Gustavo Sousa wrote:
> Zbigniew Kempczyński <zbigniew.kempczynski@intel.com> writes:
> 
> > Doubling test name size might be not enough for realloc if target name
> > length is larger than test/subtest name size.
> >
> > Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
> > Cc: Gustavo Sousa <gustavo.sousa@intel.com>
> > Cc: Ryszard Knop <ryszard.knop@intel.com>
> > ---
> >  lib/igt_hook.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/lib/igt_hook.c b/lib/igt_hook.c
> > index b8f25b6c7a..a44b852da1 100644
> > --- a/lib/igt_hook.c
> > +++ b/lib/igt_hook.c
> > @@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
> >  	if (len + 1 > *size_ptr) {
> >  		size_t fullname_size;
> >  
> > -		*size_ptr *= 2;
> > +		*size_ptr += len + 1;
> 
> Oops. My bad. Thanks for finding this!
> 
> Do we need to use "+=" instead of "=" above, though?
> 
> Also, perhaps we could use roundup_power_of_two(len + 1) to reduce the
> number of follow-up reallocs?

Sorry, I haven't explained why I used "+=" instead of "=". That was
first what comes to my mind to fix the issue and try to decrease number
of reallocs more than with simple '='. For smaller sizes I'm not sure if
size of power of two is better than any other value. Glibc adds some
overhead to malloc so I think any strategy we pick which increases
buffer underneath is acceptable to me.

--
Zbigniew


> 
> --
> Gustavo Sousa
> 
> >  		*name_ptr = realloc(*name_ptr, *size_ptr);
> >  
> >  		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);
> > -- 
> > 2.54.0

Re: [PATCH i-g-t] lib/igt_hook: Fix realloc size to avoid memory overwriting

[Gustavo Sousa]

Zbigniew Kempczyński <zbigniew.kempczynski@intel.com> writes:

> On Mon, Jun 29, 2026 at 09:17:53AM -0300, Gustavo Sousa wrote:
>> Zbigniew Kempczyński <zbigniew.kempczynski@intel.com> writes:
>> 
>> > Doubling test name size might be not enough for realloc if target name
>> > length is larger than test/subtest name size.
>> >
>> > Signed-off-by: Zbigniew Kempczyński <zbigniew.kempczynski@intel.com>
>> > Cc: Gustavo Sousa <gustavo.sousa@intel.com>
>> > Cc: Ryszard Knop <ryszard.knop@intel.com>
>> > ---
>> >  lib/igt_hook.c | 2 +-
>> >  1 file changed, 1 insertion(+), 1 deletion(-)
>> >
>> > diff --git a/lib/igt_hook.c b/lib/igt_hook.c
>> > index b8f25b6c7a..a44b852da1 100644
>> > --- a/lib/igt_hook.c
>> > +++ b/lib/igt_hook.c
>> > @@ -300,7 +300,7 @@ static void igt_hook_update_test_name_pre_call(struct igt_hook *igt_hook, struct
>> >  	if (len + 1 > *size_ptr) {
>> >  		size_t fullname_size;
>> >  
>> > -		*size_ptr *= 2;
>> > +		*size_ptr += len + 1;
>> 
>> Oops. My bad. Thanks for finding this!
>> 
>> Do we need to use "+=" instead of "=" above, though?
>> 
>> Also, perhaps we could use roundup_power_of_two(len + 1) to reduce the
>> number of follow-up reallocs?
>
> Sorry, I haven't explained why I used "+=" instead of "=". That was
> first what comes to my mind to fix the issue and try to decrease number
> of reallocs more than with simple '='. For smaller sizes I'm not sure if
> size of power of two is better than any other value. Glibc adds some
> overhead to malloc so I think any strategy we pick which increases
> buffer underneath is acceptable to me.

I just though "+=" adding exactly the size needed as an "extra" looked
odd and didn't initially get that this indeed had the objective of
avoiding extra reallocs in the future. I wonder if future readers of the
code will get the same perception or if that's just me.

--
Gustavo Sousa

>
> --
> Zbigniew
>
>
>> 
>> --
>> Gustavo Sousa
>> 
>> >  		*name_ptr = realloc(*name_ptr, *size_ptr);
>> >  
>> >  		fullname_size = igt_hook_calc_test_fullname_size(igt_hook);
>> > -- 
>> > 2.54.0

✗ Fi.CI.BAT: failure for lib/igt_hook: Fix realloc size to avoid memory overwriting

[Patchwork]

[-- Attachment #1: Type: text/plain, Size: 250 bytes --]

== Series Details ==

Series: lib/igt_hook: Fix realloc size to avoid memory overwriting
URL   : https://patchwork.freedesktop.org/series/169418/
State : failure

== Summary ==

Series 169418 revision 1 was fully merged or fully failed: no git log



[-- Attachment #2: Type: text/html, Size: 719 bytes --]