github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 12:44:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf disasm: Fix potential NULL pointer dereference and use-after-free in arch__find()

Browse Source 
In arch__find(), if the architecture's arch_new_fn[e_machine]() returns
NULL, the error handling path attempts to read result->name, dereferencing
a NULL pointer and crashing. At the same time, it invokes free(tmp)
BEFORE updating the static global archs pointer to tmp. If the
reallocarray() call moved the allocated block, the original archs pointer
remained active but was freed. A subsequent call to arch__find() would
then pass this dangling pointer into bsearch(), causing a use-after-free.

Fix both by printing the numeric e_machine ID instead of result->name,
and updating the static global archs pointer to tmp immediately after the
successful reallocarray() invocation to safely retain the valid prior
architectures.

Closes: https://lore.kernel.org/linux-perf-users/20260709035721.9EE901F000E9@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
This commit is contained in:
Ian Rogers 2026-07-16 00:23:46 -07:00 committed by Namhyung Kim
parent c627578393
commit 1243a5e741
1 changed files with 4 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
tools/perf/util/disasm.c
View File

@ -180,14 +180,14 @@ const struct arch *arch__find(uint16_t e_machine, uint32_t e_flags, const char *
if (!tmp)
return NULL;
archs = tmp;
result = arch_new_fn[e_machine](&key, cpuid);
if (!result) {
pr_err("%s: failed to initialize %s (%u) arch priv area\n",
__func__, result->name, e_machine);
free(tmp);
pr_err("%s: failed to initialize %u arch priv area\n",
__func__, e_machine);
return NULL;
}
archs = tmp;
archs[num_archs++] = result;
qsort(archs, num_archs, sizeof(*archs), arch__cmp);
return result;