[PATCH v1] perf trace: Fix possible insufficient allocation of argument formats

[PATCH v1] perf trace: Fix possible insufficient allocation of argument formats

[Howard Chu]

In my previous fix of runtime error(Link:
https://lore.kernel.org/linux-perf-users/20250122025519.361873-1-howardchu95@gmail.com/),
I made a mistake of decrementing one unconditionally, regardless of
whether an extra 'syscall_nr' or 'nr' field was present in
libtraceevent's tp_format. This may cause perf trace to allocate one
fewer arg_fmt entry than needed for the accurate representation of syscall
arguments.

This patch corrects the mistake by checking the presence of'syscall_nr' or
'nr', and adjusting the length of arg_fmt[] accordingly.

Signed-off-by: Howard Chu <howardchu95@gmail.com>
---
 tools/perf/builtin-trace.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index a102748bd0c9..ad6dad8e2453 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2139,6 +2139,7 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
 	char tp_name[128];
 	const char *name;
 	int err;
+	bool extra_nr = false;
 
 	if (sc->nonexistent)
 		return -EEXIST;
@@ -2176,20 +2177,22 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
 		return err;
 	}
 
+	sc->args = sc->tp_format->format.fields;
+	if (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))
+		extra_nr = true;
 	/*
 	 * The tracepoint format contains __syscall_nr field, so it's one more
 	 * than the actual number of syscall arguments.
 	 */
-	if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
+	if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - (extra_nr ? 1 : 0)))
 		return -ENOMEM;
 
-	sc->args = sc->tp_format->format.fields;
 	/*
 	 * We need to check and discard the first variable '__syscall_nr'
 	 * or 'nr' that mean the syscall number. It is needless here.
 	 * So drop '__syscall_nr' or 'nr' field but does not exist on older kernels.
 	 */
-	if (sc->args && (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))) {
+	if (sc->args && extra_nr) {
 		sc->args = sc->args->next;
 		--sc->nr_args;
 	}
-- 
2.45.2

Re: [PATCH v1] perf trace: Fix possible insufficient allocation of argument formats

[Howard Chu]

Hello,

Forgot to add, there should be:

Fixes: c7b87ce0dd10 ("perf trace: Fix runtime error of index out of bounds")

Thanks,
Howard

On Mon, Mar 24, 2025 at 04:52:45PM -0700, Howard Chu wrote:
> In my previous fix of runtime error(Link:
> https://lore.kernel.org/linux-perf-users/20250122025519.361873-1-howardchu95@gmail.com/),
> I made a mistake of decrementing one unconditionally, regardless of
> whether an extra 'syscall_nr' or 'nr' field was present in
> libtraceevent's tp_format. This may cause perf trace to allocate one
> fewer arg_fmt entry than needed for the accurate representation of syscall
> arguments.
> 
> This patch corrects the mistake by checking the presence of'syscall_nr' or
> 'nr', and adjusting the length of arg_fmt[] accordingly.
> 
> Signed-off-by: Howard Chu <howardchu95@gmail.com>
> ---
>  tools/perf/builtin-trace.c | 9 ++++++---
>  1 file changed, 6 insertions(+), 3 deletions(-)
> 
> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> index a102748bd0c9..ad6dad8e2453 100644
> --- a/tools/perf/builtin-trace.c
> +++ b/tools/perf/builtin-trace.c
> @@ -2139,6 +2139,7 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
>  	char tp_name[128];
>  	const char *name;
>  	int err;
> +	bool extra_nr = false;
>  
>  	if (sc->nonexistent)
>  		return -EEXIST;
> @@ -2176,20 +2177,22 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
>  		return err;
>  	}
>  
> +	sc->args = sc->tp_format->format.fields;
> +	if (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))
> +		extra_nr = true;
>  	/*
>  	 * The tracepoint format contains __syscall_nr field, so it's one more
>  	 * than the actual number of syscall arguments.
>  	 */
> -	if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
> +	if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - (extra_nr ? 1 : 0)))
>  		return -ENOMEM;
>  
> -	sc->args = sc->tp_format->format.fields;
>  	/*
>  	 * We need to check and discard the first variable '__syscall_nr'
>  	 * or 'nr' that mean the syscall number. It is needless here.
>  	 * So drop '__syscall_nr' or 'nr' field but does not exist on older kernels.
>  	 */
> -	if (sc->args && (!strcmp(sc->args->name, "__syscall_nr") || !strcmp(sc->args->name, "nr"))) {
> +	if (sc->args && extra_nr) {
>  		sc->args = sc->args->next;
>  		--sc->nr_args;
>  	}
> -- 
> 2.45.2
> 

Re: [PATCH v1] perf trace: Fix possible insufficient allocation of argument formats

[Namhyung Kim]

On Mon, Mar 24, 2025 at 04:52:45PM -0700, Howard Chu wrote:
> In my previous fix of runtime error(Link:
> https://lore.kernel.org/linux-perf-users/20250122025519.361873-1-howardchu95@gmail.com/),
> I made a mistake of decrementing one unconditionally, regardless of
> whether an extra 'syscall_nr' or 'nr' field was present in
> libtraceevent's tp_format. This may cause perf trace to allocate one
> fewer arg_fmt entry than needed for the accurate representation of syscall
> arguments.
> 
> This patch corrects the mistake by checking the presence of'syscall_nr' or
> 'nr', and adjusting the length of arg_fmt[] accordingly.

Thanks for the fix.  I've noticed this too but I feel like we can make
syscall__alloc_arg_fmts() a bit simpler.

How about this?

Thanks,
Namhyung


---8<---
diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 6ac51925ea4249c2..b9bdab52f5801c3a 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -2022,9 +2022,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
 {
 	int idx;
 
-	if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0)
-		nr_args = sc->fmt->nr_args;
-
 	sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt));
 	if (sc->arg_fmt == NULL)
 		return -1;
@@ -2034,7 +2031,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
 			sc->arg_fmt[idx] = sc->fmt->arg[idx];
 	}
 
-	sc->nr_args = nr_args;
 	return 0;
 }
 
@@ -2176,14 +2172,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
 		return err;
 	}
 
-	/*
-	 * The tracepoint format contains __syscall_nr field, so it's one more
-	 * than the actual number of syscall arguments.
-	 */
-	if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
-		return -ENOMEM;
-
 	sc->args = sc->tp_format->format.fields;
+	sc->nr_args = sc->tp_format->format.nr_fields;
+
 	/*
 	 * We need to check and discard the first variable '__syscall_nr'
 	 * or 'nr' that mean the syscall number. It is needless here.
@@ -2194,6 +2185,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
 		--sc->nr_args;
 	}
 
+	if (syscall__alloc_arg_fmts(sc, sc->nr_args))
+		return -ENOMEM;
+
 	sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit");
 	sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat");
 
-- 
2.49.0.395.g12beb8f557-goog

Re: [PATCH v1] perf trace: Fix possible insufficient allocation of argument formats

[Howard Chu]

Hello Namhyung,

LGTM. This is better. :)

Thanks,
Howard

On Wed, Mar 26, 2025 at 11:21 AM Namhyung Kim <namhyung@kernel.org> wrote:
>
> On Mon, Mar 24, 2025 at 04:52:45PM -0700, Howard Chu wrote:
> > In my previous fix of runtime error(Link:
> > https://lore.kernel.org/linux-perf-users/20250122025519.361873-1-howardchu95@gmail.com/),
> > I made a mistake of decrementing one unconditionally, regardless of
> > whether an extra 'syscall_nr' or 'nr' field was present in
> > libtraceevent's tp_format. This may cause perf trace to allocate one
> > fewer arg_fmt entry than needed for the accurate representation of syscall
> > arguments.
> >
> > This patch corrects the mistake by checking the presence of'syscall_nr' or
> > 'nr', and adjusting the length of arg_fmt[] accordingly.
>
> Thanks for the fix.  I've noticed this too but I feel like we can make
> syscall__alloc_arg_fmts() a bit simpler.
>
> How about this?
>
> Thanks,
> Namhyung
>
>
> ---8<---
> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> index 6ac51925ea4249c2..b9bdab52f5801c3a 100644
> --- a/tools/perf/builtin-trace.c
> +++ b/tools/perf/builtin-trace.c
> @@ -2022,9 +2022,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
>  {
>         int idx;
>
> -       if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0)
> -               nr_args = sc->fmt->nr_args;
> -
>         sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt));
>         if (sc->arg_fmt == NULL)
>                 return -1;
> @@ -2034,7 +2031,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
>                         sc->arg_fmt[idx] = sc->fmt->arg[idx];
>         }
>
> -       sc->nr_args = nr_args;
>         return 0;
>  }
>
> @@ -2176,14 +2172,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
>                 return err;
>         }
>
> -       /*
> -        * The tracepoint format contains __syscall_nr field, so it's one more
> -        * than the actual number of syscall arguments.
> -        */
> -       if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
> -               return -ENOMEM;
> -
>         sc->args = sc->tp_format->format.fields;
> +       sc->nr_args = sc->tp_format->format.nr_fields;
> +
>         /*
>          * We need to check and discard the first variable '__syscall_nr'
>          * or 'nr' that mean the syscall number. It is needless here.
> @@ -2194,6 +2185,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
>                 --sc->nr_args;
>         }
>
> +       if (syscall__alloc_arg_fmts(sc, sc->nr_args))
> +               return -ENOMEM;
> +
>         sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit");
>         sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat");
>
> --
> 2.49.0.395.g12beb8f557-goog
>

Re: [PATCH v1] perf trace: Fix possible insufficient allocation of argument formats

[Namhyung Kim]

On Wed, Mar 26, 2025 at 11:30:11AM -0700, Howard Chu wrote:
> Hello Namhyung,
> 
> LGTM. This is better. :)

Great, can you please resend it with my Suggested-by?

Thanks,
Namhyung

> 
> On Wed, Mar 26, 2025 at 11:21 AM Namhyung Kim <namhyung@kernel.org> wrote:
> >
> > On Mon, Mar 24, 2025 at 04:52:45PM -0700, Howard Chu wrote:
> > > In my previous fix of runtime error(Link:
> > > https://lore.kernel.org/linux-perf-users/20250122025519.361873-1-howardchu95@gmail.com/),
> > > I made a mistake of decrementing one unconditionally, regardless of
> > > whether an extra 'syscall_nr' or 'nr' field was present in
> > > libtraceevent's tp_format. This may cause perf trace to allocate one
> > > fewer arg_fmt entry than needed for the accurate representation of syscall
> > > arguments.
> > >
> > > This patch corrects the mistake by checking the presence of'syscall_nr' or
> > > 'nr', and adjusting the length of arg_fmt[] accordingly.
> >
> > Thanks for the fix.  I've noticed this too but I feel like we can make
> > syscall__alloc_arg_fmts() a bit simpler.
> >
> > How about this?
> >
> > Thanks,
> > Namhyung
> >
> >
> > ---8<---
> > diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> > index 6ac51925ea4249c2..b9bdab52f5801c3a 100644
> > --- a/tools/perf/builtin-trace.c
> > +++ b/tools/perf/builtin-trace.c
> > @@ -2022,9 +2022,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
> >  {
> >         int idx;
> >
> > -       if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0)
> > -               nr_args = sc->fmt->nr_args;
> > -
> >         sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt));
> >         if (sc->arg_fmt == NULL)
> >                 return -1;
> > @@ -2034,7 +2031,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
> >                         sc->arg_fmt[idx] = sc->fmt->arg[idx];
> >         }
> >
> > -       sc->nr_args = nr_args;
> >         return 0;
> >  }
> >
> > @@ -2176,14 +2172,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
> >                 return err;
> >         }
> >
> > -       /*
> > -        * The tracepoint format contains __syscall_nr field, so it's one more
> > -        * than the actual number of syscall arguments.
> > -        */
> > -       if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
> > -               return -ENOMEM;
> > -
> >         sc->args = sc->tp_format->format.fields;
> > +       sc->nr_args = sc->tp_format->format.nr_fields;
> > +
> >         /*
> >          * We need to check and discard the first variable '__syscall_nr'
> >          * or 'nr' that mean the syscall number. It is needless here.
> > @@ -2194,6 +2185,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
> >                 --sc->nr_args;
> >         }
> >
> > +       if (syscall__alloc_arg_fmts(sc, sc->nr_args))
> > +               return -ENOMEM;
> > +
> >         sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit");
> >         sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat");
> >
> > --
> > 2.49.0.395.g12beb8f557-goog
> >

Re: [PATCH v1] perf trace: Fix possible insufficient allocation of argument formats

[Howard Chu]

Hello Namhyung,

On Wed, Mar 26, 2025 at 12:44 PM Namhyung Kim <namhyung@kernel.org> wrote:
>
> On Wed, Mar 26, 2025 at 11:30:11AM -0700, Howard Chu wrote:
> > Hello Namhyung,
> >
> > LGTM. This is better. :)
>
> Great, can you please resend it with my Suggested-by?

Sure.

Thanks,
Howard
>
> Thanks,
> Namhyung
>
> >
> > On Wed, Mar 26, 2025 at 11:21 AM Namhyung Kim <namhyung@kernel.org> wrote:
> > >
> > > On Mon, Mar 24, 2025 at 04:52:45PM -0700, Howard Chu wrote:
> > > > In my previous fix of runtime error(Link:
> > > > https://lore.kernel.org/linux-perf-users/20250122025519.361873-1-howardchu95@gmail.com/),
> > > > I made a mistake of decrementing one unconditionally, regardless of
> > > > whether an extra 'syscall_nr' or 'nr' field was present in
> > > > libtraceevent's tp_format. This may cause perf trace to allocate one
> > > > fewer arg_fmt entry than needed for the accurate representation of syscall
> > > > arguments.
> > > >
> > > > This patch corrects the mistake by checking the presence of'syscall_nr' or
> > > > 'nr', and adjusting the length of arg_fmt[] accordingly.
> > >
> > > Thanks for the fix.  I've noticed this too but I feel like we can make
> > > syscall__alloc_arg_fmts() a bit simpler.
> > >
> > > How about this?
> > >
> > > Thanks,
> > > Namhyung
> > >
> > >
> > > ---8<---
> > > diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> > > index 6ac51925ea4249c2..b9bdab52f5801c3a 100644
> > > --- a/tools/perf/builtin-trace.c
> > > +++ b/tools/perf/builtin-trace.c
> > > @@ -2022,9 +2022,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
> > >  {
> > >         int idx;
> > >
> > > -       if (nr_args == RAW_SYSCALL_ARGS_NUM && sc->fmt && sc->fmt->nr_args != 0)
> > > -               nr_args = sc->fmt->nr_args;
> > > -
> > >         sc->arg_fmt = calloc(nr_args, sizeof(*sc->arg_fmt));
> > >         if (sc->arg_fmt == NULL)
> > >                 return -1;
> > > @@ -2034,7 +2031,6 @@ static int syscall__alloc_arg_fmts(struct syscall *sc, int nr_args)
> > >                         sc->arg_fmt[idx] = sc->fmt->arg[idx];
> > >         }
> > >
> > > -       sc->nr_args = nr_args;
> > >         return 0;
> > >  }
> > >
> > > @@ -2176,14 +2172,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
> > >                 return err;
> > >         }
> > >
> > > -       /*
> > > -        * The tracepoint format contains __syscall_nr field, so it's one more
> > > -        * than the actual number of syscall arguments.
> > > -        */
> > > -       if (syscall__alloc_arg_fmts(sc, sc->tp_format->format.nr_fields - 1))
> > > -               return -ENOMEM;
> > > -
> > >         sc->args = sc->tp_format->format.fields;
> > > +       sc->nr_args = sc->tp_format->format.nr_fields;
> > > +
> > >         /*
> > >          * We need to check and discard the first variable '__syscall_nr'
> > >          * or 'nr' that mean the syscall number. It is needless here.
> > > @@ -2194,6 +2185,9 @@ static int syscall__read_info(struct syscall *sc, struct trace *trace)
> > >                 --sc->nr_args;
> > >         }
> > >
> > > +       if (syscall__alloc_arg_fmts(sc, sc->nr_args))
> > > +               return -ENOMEM;
> > > +
> > >         sc->is_exit = !strcmp(name, "exit_group") || !strcmp(name, "exit");
> > >         sc->is_open = !strcmp(name, "open") || !strcmp(name, "openat");
> > >
> > > --
> > > 2.49.0.395.g12beb8f557-goog
> > >