2021-04-20 15:17:31

by Leo Yan

Subject: [PATCH] perf auxtrace: Fix potential null pointer dereference

In the function auxtrace_parse_snapshot_options(), the callback pointer
"itr->parse_snapshot_options" can be NULL if it has not been set during
the AUX record initialization. This can cause tool crashing if the
callback pointer "itr->parse_snapshot_options" is dereferenced without
performing NULL check.

Add a NULL check for the pointer "itr->parse_snapshot_options" before
invoke the callback.

Fixes: d20031bb63dd ("perf tools: Add AUX area tracing Snapshot Mode")
Signed-off-by: Leo Yan <[email protected]>
---
tools/perf/util/auxtrace.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index 953f4afacd3b..320b47f133d3 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -638,7 +638,7 @@ int auxtrace_parse_snapshot_options(struct auxtrace_record *itr,
break;
}

- if (itr)
+ if (itr && itr->parse_snapshot_options)
return itr->parse_snapshot_options(itr, opts, str);

pr_err("No AUX area tracing to snapshot\n");
--
2.25.1

2021-04-20 15:52:57

by Adrian Hunter

Subject: Re: [PATCH] perf auxtrace: Fix potential null pointer dereference

On 20/04/21 6:15 pm, Leo Yan wrote:
> In the function auxtrace_parse_snapshot_options(), the callback pointer
> "itr->parse_snapshot_options" can be NULL if it has not been set during
> the AUX record initialization. This can cause tool crashing if the
> callback pointer "itr->parse_snapshot_options" is dereferenced without
> performing NULL check.
>
> Add a NULL check for the pointer "itr->parse_snapshot_options" before
> invoke the callback.
>
> Fixes: d20031bb63dd ("perf tools: Add AUX area tracing Snapshot Mode")
> Signed-off-by: Leo Yan <[email protected]>

Acked-by: Adrian Hunter <[email protected]>

> ---
> tools/perf/util/auxtrace.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
> index 953f4afacd3b..320b47f133d3 100644
> --- a/tools/perf/util/auxtrace.c
> +++ b/tools/perf/util/auxtrace.c
> @@ -638,7 +638,7 @@ int auxtrace_parse_snapshot_options(struct auxtrace_record *itr,
> break;
> }
>
> - if (itr)
> + if (itr && itr->parse_snapshot_options)
> return itr->parse_snapshot_options(itr, opts, str);
>
> pr_err("No AUX area tracing to snapshot\n");
>