2020-06-18 00:41:34

by Gaurav Singh

Subject: [PATCH] [perf] Fix null pointer deference in nest_epollfd

Add a NULL check for worker before dereferencing.

Signed-off-by: Gaurav Singh <[email protected]>
---
tools/perf/bench/epoll-wait.c | 3 +++
1 file changed, 3 insertions(+)

diff --git a/tools/perf/bench/epoll-wait.c b/tools/perf/bench/epoll-wait.c
index 75dca9773186..42983eb7f82e 100644
--- a/tools/perf/bench/epoll-wait.c
+++ b/tools/perf/bench/epoll-wait.c
@@ -239,6 +239,9 @@ static void *workerfn(void *arg)

static void nest_epollfd(struct worker *w)
{
+ if (!w)
+ return;
+
unsigned int i;
struct epoll_event ev;
int efd = multiq ? w->epollfd : epollfd;
--
2.17.1

2020-06-18 21:26:42

by Namhyung Kim

Subject: Re: [PATCH] [perf] Fix null pointer deference in nest_epollfd

Hello,

On Thu, Jun 18, 2020 at 9:39 AM Gaurav Singh <[email protected]> wrote:
>
> Add a NULL check for worker before dereferencing.

Did you actually see a segfault due to this?
It seems it's called with NULL only if multiq is false
so there should not be a NULL dereference.

>
> Signed-off-by: Gaurav Singh <[email protected]>
> ---
> tools/perf/bench/epoll-wait.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/tools/perf/bench/epoll-wait.c b/tools/perf/bench/epoll-wait.c
> index 75dca9773186..42983eb7f82e 100644
> --- a/tools/perf/bench/epoll-wait.c
> +++ b/tools/perf/bench/epoll-wait.c
> @@ -239,6 +239,9 @@ static void *workerfn(void *arg)
>
> static void nest_epollfd(struct worker *w)
> {
> + if (!w)
> + return;
> +
> unsigned int i;
> struct epoll_event ev;
> int efd = multiq ? w->epollfd : epollfd;

Maybe it's more intuitive to check w instead of multiq here.

Thanks
Namhyung


> --
> 2.17.1
>

2020-06-19 18:25:48

by Namhyung Kim

Subject: Re: [PATCH] [perf] Fix null pointer deference in nest_epollfd

On Fri, Jun 19, 2020 at 6:28 AM gaurav singh <[email protected]> wrote:
>
> multiqu is a static bool which is never assigned and nested is a static int (=0)

It's set by command line option (-m).

Thanks
Namhyung


> and only assigned in nest_epollfd(). Hence,
>
> if (nested)
> nest_epollfd(NULL);
>
> probably never gets executed.