archives/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-03-08 04:04:43 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

perf test cpumap: Avoid use-after-free following merge

Browse source 
Previously cpu maps in the test weren't modified by calls to the cpu map
API, however, perf_cpu_map__merge was modified so the left hand argument
was updated.

In the test this meant the maps copy of the "two" map was put/deleted in
the merge meaning when accessed via maps, the pointer was stale and to
the put/deleted memory.

To fix this add an extra layer of indirection to the maps array, so the
updated value of two is accessed.

Fixes: a9d2217556 ("libperf cpumap: Refactor perf_cpu_map__merge()")
Reviewed-by: James Clark <james.clark@linaro.org>
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Leo Yan <leo.yan@arm.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20250108051511.1720369-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Ian Rogers 2025-01-07 21:15:11 -08:00 • committed by Arnaldo Carvalho de Melo
parent 9c64c7c658
commit 6bfb4c571b
1 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

8
tools/perf/tests/cpumap.c
View file

@ -252,16 +252,16 @@ static int test__cpu_map_equal(struct test_suite *test __maybe_unused, int subte
struct perf_cpu_map *empty = perf_cpu_map__intersect(one, two);
struct perf_cpu_map *pair = perf_cpu_map__new("1-2");
struct perf_cpu_map *tmp;
struct perf_cpu_map *maps[] = {empty, any, one, two, pair};
struct perf_cpu_map **maps[] = {&empty, &any, &one, &two, &pair};
for (size_t i = 0; i < ARRAY_SIZE(maps); i++) {
/* Maps equal themself. */
TEST_ASSERT_VAL("equal", perf_cpu_map__equal(maps[i], maps[i]));
TEST_ASSERT_VAL("equal", perf_cpu_map__equal(*maps[i], *maps[i]));
for (size_t j = 0; j < ARRAY_SIZE(maps); j++) {
/* Maps dont't equal each other. */
if (i == j)
continue;
TEST_ASSERT_VAL("not equal", !perf_cpu_map__equal(maps[i], maps[j]));
TEST_ASSERT_VAL("not equal", !perf_cpu_map__equal(*maps[i], *maps[j]));
}
}
@ -274,7 +274,7 @@ static int test__cpu_map_equal(struct test_suite *test __maybe_unused, int subte
perf_cpu_map__put(tmp);
for (size_t i = 0; i < ARRAY_SIZE(maps); i++)
perf_cpu_map__put(maps[i]);
perf_cpu_map__put(*maps[i]);
return TEST_OK;
}