From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1753290AbdHQRCv (ORCPT <rfc822;w@1wt.eu>);
        Thu, 17 Aug 2017 13:02:51 -0400
Received: from mga07.intel.com ([134.134.136.100]:44915 "EHLO mga07.intel.com"
        rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
        id S1751575AbdHQRCu (ORCPT <rfc822;linux-kernel@vger.kernel.org>);
        Thu, 17 Aug 2017 13:02:50 -0400
X-ExtLoop1: 1
X-IronPort-AV: E=Sophos;i="5.41,388,1498546800"; 
   d="scan'208";a="891118220"
Date: Thu, 17 Aug 2017 10:02:49 -0700
From: Andi Kleen <ak@linux.intel.com>
To: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Andi Kleen <andi@firstfloor.org>, jolsa@kernel.org,
        linux-kernel@vger.kernel.org
Subject: Re: [PATCH 2/2] perf, tools: Avoid segfault on alias parse error
Message-ID: <20170817170249.GK28715@tassilo.jf.intel.com>
References: <20170816220201.19182-1-andi@firstfloor.org>
 <20170816220201.19182-3-andi@firstfloor.org>
 <20170817152816.GC10891@kernel.org>
 <20170817153421.GE2482@two.firstfloor.org>
 <20170817162539.GD10891@kernel.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20170817162539.GD10891@kernel.org>
User-Agent: Mutt/1.8.3 (2017-05-23)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Thu, Aug 17, 2017 at 01:25:39PM -0300, Arnaldo Carvalho de Melo wrote:
> Em Thu, Aug 17, 2017 at 08:34:22AM -0700, Andi Kleen escreveu:
> > > Humm, but don't we have that checked?
> > 
> > At least not in the case of the segfault below.
> 
> Again:
> 
> tools/perf/util/parse-events.c
> 
> 2523 void parse_events_evlist_error(struct parse_events_evlist *data,
> 2524                                int idx, const char *str)
> 2525 {
> 2526         struct parse_events_error *err = data->error;
> 2527 
> 2528         if (!err)
> 2529                 return;
> 2530         err->idx = idx;
> 2531         err->str = strdup(str);
> 2532         WARN_ONCE(!err->str, "WARNING: failed to allocate error string");
> 2533 }
> 
> data->error _is_ being checked for NULL, and the hunk you added would

In the crash, data->error is not NULL, it's random stack contents
because the data types for the data pointer do not match
(parse_events_evlist vs parse_events_terms)

-Andi