Re: [PATCH v10 04/29] perf evsel: Refactor evsel tracepoint sample accessors perf_sample

Namhyung Kim
2026-04-12T20:11:06Z

On Sun, Apr 12, 2026 at 02:34:19AM +0000, sashiko-bot@kernel.org wrote:
> Sashiko AI review found 1 potential issue(s):
> - [High] Removal of `strdup` in `sched_work_init` introduces a Use-After-Free vulnerability when storing the task name.
> --
>
> commit 0d7b6945ae0c6b8ad53d53aacf54fb3b747a99a7
> Author: Ian Rogers <irogers@google.com>
>
> perf evsel: Refactor evsel tracepoint sample accessors perf_sample
>
> This commit removes the evsel argument from tracepoint sample accessor
> functions, renaming them to reflect that the data is being read directly
> from the sample.
>
> Please note that the issue discussed below was resolved in a later commit
> upstream, specifically commit 5e8ad46aaa11f37f17084b59fcd84e6b4bbc3d6e
> (perf kwork: Fix memory management of kwork_work). It is included here
> for completeness regarding this specific patch.
>
> [ ... ]
> > diff --git a/tools/perf/builtin-kwork.c b/tools/perf/builtin-kwork.c
> > index d4bb19ed91b59..8ba5ea201bf94 100644
> > --- a/tools/perf/builtin-kwork.c
> > +++ b/tools/perf/builtin-kwork.c
> [ ... ]
> > @@ -1310,11 +1309,11 @@ static void sched_work_init(struct perf_kwork *kwork __maybe_unused,
> > work->cpu = sample->cpu;
> >
> > if (src_type == KWORK_TRACE_EXIT) {
> > - work->id = evsel__intval(evsel, sample, "prev_pid");
> > - work->name = strdup(evsel__strval(evsel, sample, "prev_comm"));
> > + work->id = perf_sample__intval(sample, "prev_pid");
> > + work->name = perf_sample__strval(sample, "prev_comm");
>
> Does removing the strdup call here leave work->name pointing directly to
> the raw data inside the memory mapped ring buffer?
>
> If perf_sample__strval returns a pointer to the sample data, that memory
> will be overwritten as new events arrive. When the reporting phase later
> iterates over the kwork_work tree, could this result in a use-after-free
> and output garbage strings?

I've removed this part for now.

Thanks,
Namhyung

>
> > } else if (src_type == KWORK_TRACE_ENTRY) {
> > - work->id = evsel__intval(evsel, sample, "next_pid");
> > - work->name = strdup(evsel__strval(evsel, sample, "next_comm"));
> > + work->id = perf_sample__intval(sample, "next_pid");
> > + work->name = perf_sample__strval(sample, "next_comm");
> > }
> > }
>
> --
> Sashiko AI review · https://sashiko.dev/#/patchset/20260412020833.641177-1-irogers@google.com?part=4