[PATCH] perf iostat: Preserve the port count when growing the list fails

[PATCH] perf iostat: Preserve the port count when growing the list fails

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

The root port insertion helper increments nr_entries before reallocating
its pointer array. If realloc() fails, both the scan and filter error
paths free the list using the increased count, reading one pointer past
the allocation. Failure of the first insertion instead dereferences a
NULL array.

Grow the array before changing the entry count or the port index so a
failed insertion leaves the list valid for cleanup.

Fixes: 19776d3cede7 ("perf stat: Helper functions for PCIe root ports list in iostat mode")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 tools/perf/arch/x86/util/iostat.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/perf/arch/x86/util/iostat.c b/tools/perf/arch/x86/util/iostat.c
index 5ecc2de..7dc31f5 100644
--- a/tools/perf/arch/x86/util/iostat.c
+++ b/tools/perf/arch/x86/util/iostat.c
@@ -129,13 +129,13 @@ static int iio_root_ports_list_insert(struct iio_root_ports_list *list,
 	struct iio_root_port **tmp_buf;
 
 	if (list && rp) {
-		rp->idx = list->nr_entries++;
 		tmp_buf = realloc(list->rps,
-				  list->nr_entries * sizeof(*list->rps));
+				  (list->nr_entries + 1) * sizeof(*list->rps));
 		if (!tmp_buf) {
 			pr_err("Failed to realloc memory\n");
 			return -ENOMEM;
 		}
+		rp->idx = list->nr_entries++;
 		tmp_buf[rp->idx] = rp;
 		list->rps = tmp_buf;
 	}
-- 
2.9.4

Re: [PATCH] perf iostat: Preserve the port count when growing the list fails

[sashiko-bot]

> From: Li RongQing <lirongqing@baidu.com>
> 
> The root port insertion helper increments nr_entries before reallocating
> its pointer array. If realloc() fails, both the scan and filter error
> paths free the list using the increased count, reading one pointer past
> the allocation. Failure of the first insertion instead dereferences a
> NULL array.
> 
> Grow the array before changing the entry count or the port index so a
> failed insertion leaves the list valid for cleanup.
> 
> Fixes: 19776d3cede7 ("perf stat: Helper functions for PCIe root ports list in iostat mode")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261106021913.2341-1-lirongqing@baidu.com?part=1