diff options
| author | Dapeng Mi <dapeng1.mi@linux.intel.com> | 2025-09-19 10:16:56 +0800 |
|---|---|---|
| committer | Arnaldo Carvalho de Melo <acme@redhat.com> | 2025-10-02 15:31:00 -0300 |
| commit | 45ff39f6e70aa55d0054fbc3508eba9ac03d7e29 (patch) | |
| tree | 49129afe8b04b0f9e2557c1e4a88617e4afa935a /tools/perf | |
| parent | 6f58cf10457f5868ef4cd98b4de6428787b3fb2c (diff) | |
perf tools kvm: Fix the potential out of range memory access issue
kvm_add_default_arch_event() helper may add 2 extra options but it
directly modifies the original argv[] array. This may cause out of range
memory access. Fix this issue.
Signed-off-by: Dapeng Mi <dapeng1.mi@linux.intel.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Kan Liang <kan.liang@linux.intel.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Diffstat (limited to 'tools/perf')
| -rw-r--r-- | tools/perf/builtin-kvm.c | 15 |
1 files changed, 10 insertions, 5 deletions
diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c index 9813f1eb56f9..d297a7b2c088 100644 --- a/tools/perf/builtin-kvm.c +++ b/tools/perf/builtin-kvm.c @@ -2008,11 +2008,12 @@ static int __cmd_record(const char *file_name, int argc, const char **argv) int rec_argc, i = 0, j, ret; const char **rec_argv; - ret = kvm_add_default_arch_event(&argc, argv); - if (ret) - return -EINVAL; - - rec_argc = argc + 2; + /* + * Besides the 2 more options "-o" and "filename", + * kvm_add_default_arch_event() may add 2 extra options, + * so allocate 4 more items. + */ + rec_argc = argc + 2 + 2; rec_argv = calloc(rec_argc + 1, sizeof(char *)); if (!rec_argv) return -ENOMEM; @@ -2025,6 +2026,10 @@ static int __cmd_record(const char *file_name, int argc, const char **argv) BUG_ON(i != rec_argc); + ret = kvm_add_default_arch_event(&i, rec_argv); + if (ret) + goto EXIT; + ret = cmd_record(i, rec_argv); EXIT: |