Re: [PATCH 08/12] perf jitdump: Free event in jit_repipe_code_move()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Heap Out-of-Bounds Read when writing event to perf.data in `jit_repipe_code_move()`
--

--- Patch [8]: [PATCH 08/12] perf jitdump: Free event in jit_repipe_code_move() ---
commit b900743750fdefef6d63a1e65a54cf9d26b1477d
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf jitdump: Free event in jit_repipe_code_move()

This commit fixes a memory leak in jit_repipe_code_move() by freeing the
event allocated via calloc at the out label, matching the behavior in
jit_repipe_code_load().

Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Stephane Eranian <eranian@google.com>
Assisted-by: Claude:claude-opus-4.6
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

> diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c
> index ae63366b86c6d..91aa1eea8229f 100644
> --- a/tools/perf/util/jitdump.c
> +++ b/tools/perf/util/jitdump.c
> @@ -685,6 +685,7 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd, union jr_entry *jr)

[ ... ]

>  		build_id__mark_dso_hit(tool, event, &sample, jd->machine);
>  out:
>  	perf_sample__exit(&sample);
> +	free(event);

[Severity: High]
This is a pre-existing issue, but does this code have a heap out-of-bounds
read when calculating the event size?

In jit_repipe_code_move(), the event being freed here is initially allocated
with a hardcoded extra 16 bytes:

    event = calloc(1, sizeof(*event) + 16);

However, the header size is calculated using idr_size:

    event->mmap2.header.size = (sizeof(event->mmap2) -
                    (sizeof(event->mmap2.filename) - size) + idr_size);

If idr_size is greater than 16 (which can happen when multiple sample types
like TID, TIME, and CPU are enabled), and the path is very long, the
calculated header.size can exceed the allocated size.

When this event is later injected:

tools/perf/util/jitdump.c:jit_inject_event() {
    ...
    size = perf_data__write(jd->output, event, event->header.size);
    ...
}

Could this cause perf_data__write() to read out-of-bounds from the heap,
potentially leaking adjacent memory into the perf.data file or causing a crash
if the read crosses into an unmapped page?

>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260806123604.271277-1-acme@kernel.org?part=8