linux-trace-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Wander Lairson Costa <wander@redhat.com>
To: Steven Rostedt <rostedt@goodmis.org>,
	Wander Lairson Costa <wander@redhat.com>,
	Tomas Glozar <tglozar@redhat.com>,
	Ivan Pravdin <ipravdin.official@gmail.com>,
	Crystal Wood <crwood@redhat.com>, John Kacur <jkacur@redhat.com>,
	Costa Shulyupin <costa.shul@redhat.com>,
	Tiezhu Yang <yangtiezhu@loongson.cn>,
	linux-trace-kernel@vger.kernel.org (open list:Real-time Linux
	Analysis (RTLA) tools), linux-kernel@vger.kernel.org (open list),
	bpf@vger.kernel.org (open list:BPF
	[MISC]:Keyword:(?:\b|_)bpf(?:\b|_))
Subject: [rtla 13/13] rtla: Fix inconsistent state in actions_add_* functions
Date: Mon, 17 Nov 2025 15:41:20 -0300	[thread overview]
Message-ID: <20251117184409.42831-14-wander@redhat.com> (raw)
In-Reply-To: <20251117184409.42831-1-wander@redhat.com>

The actions_add_trace_output() and actions_add_shell() functions
leave the action list in an inconsistent state when strdup() fails.
The actions_new() function increments self->len before returning a
pointer to the new action slot, but if the subsequent strdup()
allocation fails, the function returns an error without decrementing
self->len back.

This leaves an action object in an invalid state within the list.
When actions_destroy() or other functions iterate over the list
using for_each_action(), they will access this invalid entry with
uninitialized fields, potentially leading to undefined behavior.

Fix this by decrementing self->len when strdup() fails, effectively
returning the allocated slot back to the pool and maintaining list
consistency even when memory allocation fails.

Signed-off-by: Wander Lairson Costa <wander@redhat.com>
---
 tools/tracing/rtla/src/actions.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/tools/tracing/rtla/src/actions.c b/tools/tracing/rtla/src/actions.c
index 2d153d5efdea2..4aaaedadcc42a 100644
--- a/tools/tracing/rtla/src/actions.c
+++ b/tools/tracing/rtla/src/actions.c
@@ -76,11 +76,13 @@ actions_add_trace_output(struct actions *self, const char *trace_output)
 	if (!action)
 		return -1;
 
-	self->present[ACTION_TRACE_OUTPUT] = true;
 	action->type = ACTION_TRACE_OUTPUT;
 	action->trace_output = strdup(trace_output);
-	if (!action->trace_output)
+	if (!action->trace_output) {
+		self->len--; // return the action object to the pool
 		return -1;
+	}
+	self->present[ACTION_TRACE_OUTPUT] = true;
 
 	return 0;
 }
@@ -115,11 +117,13 @@ actions_add_shell(struct actions *self, const char *command)
 	if (!action)
 		return -1;
 
-	self->present[ACTION_SHELL] = true;
 	action->type = ACTION_SHELL;
 	action->command = strdup(command);
-	if (!action->command)
+	if (!action->command) {
+		self->len--;
 		return -1;
+	}
+	self->present[ACTION_SHELL] = true;
 
 	return 0;
 }
-- 
2.51.1


      parent reply	other threads:[~2025-11-17 18:57 UTC|newest]

Thread overview: 31+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2025-11-17 18:41 [PATCH 0/13] rtla: Code robustness and maintainability improvements Wander Lairson Costa
2025-11-17 18:41 ` [rtla 01/13] rtla: Check for memory allocation failures Wander Lairson Costa
2025-11-18  2:09   ` Masami Hiramatsu
2025-11-18  3:06     ` Steven Rostedt
2025-11-18  5:13       ` Masami Hiramatsu
2025-11-28 13:29   ` Costa Shulyupin
2025-11-28 13:52     ` Wander Lairson Costa
2025-11-17 18:41 ` [rtla 02/13] rtla: Use strdup() to simplify code Wander Lairson Costa
2025-11-17 18:41 ` [rtla 03/13] rtla: Introduce for_each_action() helper Wander Lairson Costa
2025-11-17 18:41 ` [rtla 04/13] rtla: Replace atoi() with a robust strtoi() Wander Lairson Costa
2025-11-25  0:46   ` Crystal Wood
2025-11-25 13:34     ` Wander Lairson Costa
2025-11-25  8:35   ` Costa Shulyupin
2025-11-25 13:49     ` Wander Lairson Costa
2025-11-17 18:41 ` [rtla 05/13] rtla: Simplify argument parsing Wander Lairson Costa
2025-11-25  0:46   ` Crystal Wood
2025-11-25 13:45     ` Wander Lairson Costa
2025-11-25 16:53       ` Crystal Wood
2025-11-17 18:41 ` [rtla 06/13] rtla: Use strncmp_static() in more places Wander Lairson Costa
2025-11-17 18:41 ` [rtla 07/13] rtla: Introduce timerlat_restart() helper Wander Lairson Costa
2025-11-25  0:46   ` Crystal Wood
2025-11-25 14:20     ` Wander Lairson Costa
2025-11-25 17:35       ` Crystal Wood
2025-11-25 18:09         ` Wander Lairson Costa
2025-11-17 18:41 ` [rtla 08/13] rtla: Use standard exit codes for result enum Wander Lairson Costa
     [not found]   ` <CADDUTFz_gU0C8uqwDS3ewFRUxk7nbkGv1UU09Omjy0Ew2wB5VQ@mail.gmail.com>
2025-11-28 14:04     ` Wander Lairson Costa
2025-11-17 18:41 ` [rtla 09/13] rtla: Exit if trace output action fails Wander Lairson Costa
2025-11-17 18:41 ` [rtla 10/13] rtla: Remove redundant memset after calloc Wander Lairson Costa
2025-11-17 18:41 ` [rtla 11/13] rtla: Replace magic number with MAX_PATH Wander Lairson Costa
2025-11-17 18:41 ` [rtla 12/13] rtla: Remove unused headers Wander Lairson Costa
2025-11-17 18:41 ` Wander Lairson Costa [this message]

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20251117184409.42831-14-wander@redhat.com \
    --to=wander@redhat.com \
    --cc=bpf@vger.kernel.org \
    --cc=costa.shul@redhat.com \
    --cc=crwood@redhat.com \
    --cc=ipravdin.official@gmail.com \
    --cc=jkacur@redhat.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-trace-kernel@vger.kernel.org \
    --cc=rostedt@goodmis.org \
    --cc=tglozar@redhat.com \
    --cc=yangtiezhu@loongson.cn \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).