Re: [PATCH v10 04/29] perf evsel: Refactor evsel tracepoint sample accessors perf_sample

sashiko-bot
2026-04-12T02:34:20Z

Sashiko AI review found 1 potential issue(s):
- [High] Removal of `strdup` in `sched_work_init` introduces a Use-After-Free vulnerability when storing the task name.
--

commit 0d7b6945ae0c6b8ad53d53aacf54fb3b747a99a7
Author: Ian Rogers <irogers@google.com>

perf evsel: Refactor evsel tracepoint sample accessors perf_sample

This commit removes the evsel argument from tracepoint sample accessor
functions, renaming them to reflect that the data is being read directly
from the sample.

Please note that the issue discussed below was resolved in a later commit
upstream, specifically commit 5e8ad46aaa11f37f17084b59fcd84e6b4bbc3d6e
(perf kwork: Fix memory management of kwork_work). It is included here
for completeness regarding this specific patch.

[ ... ]
> diff --git a/tools/perf/builtin-kwork.c b/tools/perf/builtin-kwork.c
> index d4bb19ed91b59..8ba5ea201bf94 100644
> --- a/tools/perf/builtin-kwork.c
> +++ b/tools/perf/builtin-kwork.c
[ ... ]
> @@ -1310,11 +1309,11 @@ static void sched_work_init(struct perf_kwork *kwork __maybe_unused,
> work->cpu = sample->cpu;
>
> if (src_type == KWORK_TRACE_EXIT) {
> - work->id = evsel__intval(evsel, sample, "prev_pid");
> - work->name = strdup(evsel__strval(evsel, sample, "prev_comm"));
> + work->id = perf_sample__intval(sample, "prev_pid");
> + work->name = perf_sample__strval(sample, "prev_comm");

Does removing the strdup call here leave work->name pointing directly to
the raw data inside the memory mapped ring buffer?

If perf_sample__strval returns a pointer to the sample data, that memory
will be overwritten as new events arrive. When the reporting phase later
iterates over the kwork_work tree, could this result in a use-after-free
and output garbage strings?

> } else if (src_type == KWORK_TRACE_ENTRY) {
> - work->id = evsel__intval(evsel, sample, "next_pid");
> - work->name = strdup(evsel__strval(evsel, sample, "next_comm"));
> + work->id = perf_sample__intval(sample, "next_pid");
> + work->name = perf_sample__strval(sample, "next_comm");
> }
> }

--
Sashiko AI review · https://sashiko.dev/#/patchset/20260412020833.641177-1-irogers@google.com?part=4