* [PATCH] perf tools: avoid segv in pmu_resolve_param_term
@ 2019-11-25 17:41 Ian Rogers
2019-11-26 9:17 ` Jiri Olsa
0 siblings, 1 reply; 2+ messages in thread
From: Ian Rogers @ 2019-11-25 17:41 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim,
Jin Yao, John Garry, Adrian Hunter, linux-kernel,
clang-built-linux
Cc: Stephane Eranian, Ian Rogers
PE_TERMS may set the config to NULL, avoid dereferencing this in
pmu_resolve_param_term. Error detected by LLVM's libFuzzer.
To reproduce the segv run:
$ perf record -e 'm/event=?,time/' ls
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/pmu.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
index e8d348988026..1a6e36353407 100644
--- a/tools/perf/util/pmu.c
+++ b/tools/perf/util/pmu.c
@@ -988,13 +988,17 @@ static int pmu_resolve_param_term(struct parse_events_term *term,
struct parse_events_term *t;
list_for_each_entry(t, head_terms, list) {
- if (t->type_val == PARSE_EVENTS__TERM_TYPE_NUM) {
- if (!strcmp(t->config, term->config)) {
- t->used = true;
- *value = t->val.num;
- return 0;
- }
- }
+ if (t->type_val != PARSE_EVENTS__TERM_TYPE_NUM)
+ continue;
+
+ if (t->config == NULL && term->config != NULL)
+ continue;
+ else if (strcmp(t->config, term->config))
+ continue;
+
+ t->used = true;
+ *value = t->val.num;
+ return 0;
}
if (verbose > 0)
--
2.24.0.432.g9d3f5f5b63-goog
^ permalink raw reply related [flat|nested] 2+ messages in thread* Re: [PATCH] perf tools: avoid segv in pmu_resolve_param_term
2019-11-25 17:41 [PATCH] perf tools: avoid segv in pmu_resolve_param_term Ian Rogers
@ 2019-11-26 9:17 ` Jiri Olsa
0 siblings, 0 replies; 2+ messages in thread
From: Jiri Olsa @ 2019-11-26 9:17 UTC (permalink / raw)
To: Ian Rogers
Cc: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Mark Rutland, Alexander Shishkin, Namhyung Kim, Jin Yao,
John Garry, Adrian Hunter, linux-kernel, clang-built-linux,
Stephane Eranian
On Mon, Nov 25, 2019 at 09:41:35AM -0800, Ian Rogers wrote:
> PE_TERMS may set the config to NULL, avoid dereferencing this in
> pmu_resolve_param_term. Error detected by LLVM's libFuzzer.
> To reproduce the segv run:
> $ perf record -e 'm/event=?,time/' ls
>
> Signed-off-by: Ian Rogers <irogers@google.com>
> ---
> tools/perf/util/pmu.c | 18 +++++++++++-------
> 1 file changed, 11 insertions(+), 7 deletions(-)
>
> diff --git a/tools/perf/util/pmu.c b/tools/perf/util/pmu.c
> index e8d348988026..1a6e36353407 100644
> --- a/tools/perf/util/pmu.c
> +++ b/tools/perf/util/pmu.c
> @@ -988,13 +988,17 @@ static int pmu_resolve_param_term(struct parse_events_term *term,
> struct parse_events_term *t;
>
> list_for_each_entry(t, head_terms, list) {
> - if (t->type_val == PARSE_EVENTS__TERM_TYPE_NUM) {
> - if (!strcmp(t->config, term->config)) {
> - t->used = true;
> - *value = t->val.num;
> - return 0;
> - }
> - }
> + if (t->type_val != PARSE_EVENTS__TERM_TYPE_NUM)
> + continue;
> +
> + if (t->config == NULL && term->config != NULL)
> + continue;
hum, I might be missing something but should above condition
be more like this?
if (t->config == NULL || term->config == NULL)
continue;
jirka
> + else if (strcmp(t->config, term->config))
> + continue;
> +
> + t->used = true;
> + *value = t->val.num;
> + return 0;
> }
>
> if (verbose > 0)
> --
> 2.24.0.432.g9d3f5f5b63-goog
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2019-11-26 9:18 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-11-25 17:41 [PATCH] perf tools: avoid segv in pmu_resolve_param_term Ian Rogers
2019-11-26 9:17 ` Jiri Olsa
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox