From 6bfb4c571b8896df479e6b82a241ea7055ec4b55 Mon Sep 17 00:00:00 2001 From: Ian Rogers Date: Tue, 7 Jan 2025 21:15:11 -0800 Subject: [PATCH] perf test cpumap: Avoid use-after-free following merge Previously cpu maps in the test weren't modified by calls to the cpu map API, however, perf_cpu_map__merge was modified so the left hand argument was updated. In the test this meant the maps copy of the "two" map was put/deleted in the merge meaning when accessed via maps, the pointer was stale and to the put/deleted memory. To fix this add an extra layer of indirection to the maps array, so the updated value of two is accessed. Fixes: a9d2217556f7745e ("libperf cpumap: Refactor perf_cpu_map__merge()") Reviewed-by: James Clark Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Leo Yan Cc: Mark Rutland Cc: Namhyung Kim Cc: Peter Zijlstra Link: https://lore.kernel.org/r/20250108051511.1720369-1-irogers@google.com Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/tests/cpumap.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/tools/perf/tests/cpumap.c b/tools/perf/tests/cpumap.c index 5ed7ff072ea34..2354246afc5a5 100644 --- a/tools/perf/tests/cpumap.c +++ b/tools/perf/tests/cpumap.c @@ -252,16 +252,16 @@ static int test__cpu_map_equal(struct test_suite *test __maybe_unused, int subte struct perf_cpu_map *empty = perf_cpu_map__intersect(one, two); struct perf_cpu_map *pair = perf_cpu_map__new("1-2"); struct perf_cpu_map *tmp; - struct perf_cpu_map *maps[] = {empty, any, one, two, pair}; + struct perf_cpu_map **maps[] = {&empty, &any, &one, &two, &pair}; for (size_t i = 0; i < ARRAY_SIZE(maps); i++) { /* Maps equal themself. */ - TEST_ASSERT_VAL("equal", perf_cpu_map__equal(maps[i], maps[i])); + TEST_ASSERT_VAL("equal", perf_cpu_map__equal(*maps[i], *maps[i])); for (size_t j = 0; j < ARRAY_SIZE(maps); j++) { /* Maps dont't equal each other. */ if (i == j) continue; - TEST_ASSERT_VAL("not equal", !perf_cpu_map__equal(maps[i], maps[j])); + TEST_ASSERT_VAL("not equal", !perf_cpu_map__equal(*maps[i], *maps[j])); } } @@ -274,7 +274,7 @@ static int test__cpu_map_equal(struct test_suite *test __maybe_unused, int subte perf_cpu_map__put(tmp); for (size_t i = 0; i < ARRAY_SIZE(maps); i++) - perf_cpu_map__put(maps[i]); + perf_cpu_map__put(*maps[i]); return TEST_OK; } -- 2.50.1