Re: [PATCH v1 08/11] perf session: Smatch: Fix potential NULL pointer dereference

From: Arnaldo Carvalho de Melo <arnaldo.melo@gmail.com>
To: Leo Yan <leo.yan@linaro.org>
Cc: Peter Zijlstra <peterz@infradead.org>,
	Ingo Molnar <mingo@redhat.com>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	Jiri Olsa <jolsa@redhat.com>, Namhyung Kim <namhyung@kernel.org>,
	Mathieu Poirier <mathieu.poirier@linaro.org>,
	Suzuki K Poulose <suzuki.poulose@arm.com>,
	Andi Kleen <ak@linux.intel.com>,
	"David S. Miller" <davem@davemloft.net>,
	Davidlohr Bueso <dave@stgolabs.net>,
	Rasmus Villemoes <linux@rasmusvillemoes.dk>,
	Jin Yao <yao.jin@linux.intel.com>,
	Song Liu <songliubraving@fb.com>,
	Adrian Hunter <adrian.hunter@intel.com>,
	Alexios Zavras <alexios.zavras@intel.com>,
	Thomas Gleixner <tglx@linutronix.de>,
	Changbin Du <changbin.du@intel.com>,
	Eric Saint-Etienne <eric.saint.etienne@oracle.com>,
	Konstantin Khlebnikov <khlebnikov@yandex-team.ru>,
	Thomas Richter <tmricht@linux.ibm.com>,
	Alexey Budankov <alexey.budankov@linux.intel.com>,
	linux-kernel@vger.kernel.org,
	linux-arm-kernel@lists.infradead.org
Subject: Re: [PATCH v1 08/11] perf session: Smatch: Fix potential NULL pointer dereference
Date: Wed, 3 Jul 2019 16:01:57 -0300	[thread overview]
Message-ID: <20190703190157.GG10740@kernel.org> (raw)
In-Reply-To: <20190702103420.27540-9-leo.yan@linaro.org>

Em Tue, Jul 02, 2019 at 06:34:17PM +0800, Leo Yan escreveu:
> Based on the following report from Smatch, fix the potential
> NULL pointer dereference check.
> 
>   tools/perf/util/session.c:1252
>   dump_read() error: we previously assumed 'evsel' could be null
>   (see line 1249)
> 
> tools/perf/util/session.c
> 1240 static void dump_read(struct perf_evsel *evsel, union perf_event *event)
> 1241 {
> 1242         struct read_event *read_event = &event->read;
> 1243         u64 read_format;
> 1244
> 1245         if (!dump_trace)
> 1246                 return;
> 1247
> 1248         printf(": %d %d %s %" PRIu64 "\n", event->read.pid, event->read.tid,
> 1249                evsel ? perf_evsel__name(evsel) : "FAIL",
> 1250                event->read.value);
> 1251
> 1252         read_format = evsel->attr.read_format;
>                            ^^^^^^^
> 
> 'evsel' could be NULL pointer, for this case this patch directly bails
> out without dumping read_event.

So this needs another hunk, adding it.

diff --git a/tools/perf/builtin-inject.c b/tools/perf/builtin-inject.c
index 8e0e06d3edfc..f4591a1438b4 100644
--- a/tools/perf/builtin-inject.c
+++ b/tools/perf/builtin-inject.c
@@ -224,7 +224,7 @@ static int perf_event__repipe_sample(struct perf_tool *tool,
 				     struct perf_evsel *evsel,
 				     struct machine *machine)
 {
-	if (evsel->handler) {
+	if (evsel && evsel->handler) {
 		inject_handler f = evsel->handler;
 		return f(tool, event, sample, evsel, machine);
 	}
 
> Signed-off-by: Leo Yan <leo.yan@linaro.org>
> ---
>  tools/perf/util/session.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/tools/perf/util/session.c b/tools/perf/util/session.c
> index 54cf163347f7..2e61dd6a3574 100644
> --- a/tools/perf/util/session.c
> +++ b/tools/perf/util/session.c
> @@ -1249,6 +1249,9 @@ static void dump_read(struct perf_evsel *evsel, union perf_event *event)
>  	       evsel ? perf_evsel__name(evsel) : "FAIL",
>  	       event->read.value);
>  
> +	if (!evsel)
> +		return;
> +
>  	read_format = evsel->attr.read_format;
>  
>  	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED)
> -- 
> 2.17.1

-- 

- Arnaldo
