From: Hui Su <sh_def@163.com>
To: Arnaldo Carvalho de Melo <acme@kernel.org>,
Namhyung Kim <namhyung@kernel.org>
Cc: Ian Rogers <irogers@google.com>,
Adrian Hunter <adrian.hunter@intel.com>,
James Clark <james.clark@linaro.org>,
Jiri Olsa <jolsa@kernel.org>,
linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org,
Hui Su <sh_def@163.com>
Subject: [PATCH] perf synthetic-events: Check schedstat domain allocation failure
Date: Sat, 12 Sep 2026 12:11:12 +0900 [thread overview]
Message-ID: <20260912031112.1814574-3-sh_def@163.com> (raw)
__synthesize_schedstat_domain() uses event after zalloc() without
checking for allocation failure, unlike __synthesize_schedstat_cpu().
If zalloc() fails and returns NULL, dereferencing ds->header.type
immediately crashes with a segmentation fault:
Program received signal SIGSEGV, Segmentation fault.
0x00005555558aed8a in __synthesize_schedstat_domain ()
#0 0x00005555558aed8a in __synthesize_schedstat_domain ()
#1 0x00005555558b889a in perf_event__synthesize_schedstat ()
#2 0x000055555563c397 in cmd_sched ()
#3 0x00005555556583a1 in handle_internal_command ()
#4 0x00005555555bf739 in main ()
perf_event__synthesize_schedstat() already treats a NULL event as an
error and cleans up, so return NULL when the allocation fails.
After this fix, an allocation failure returns NULL safely, allowing
the caller to exit gracefully without crashing:
[ perf sched stats: Failed !! ]
Fixes: c3030995f23b ("perf sched stats: Add record and rawdump support")
Signed-off-by: Hui Su <sh_def@163.com>
---
tools/perf/util/synthetic-events.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
index 0c150193cca8..24559691b88e 100644
--- a/tools/perf/util/synthetic-events.c
+++ b/tools/perf/util/synthetic-events.c
@@ -2776,6 +2776,8 @@ static union perf_event *__synthesize_schedstat_domain(struct io *io, __u16 vers
size = sizeof(*ds);
size = PERF_ALIGN(size, sizeof(u64));
event = zalloc(size);
+ if (!event)
+ return NULL;
ds = &event->schedstat_domain;
ds->header.type = PERF_RECORD_SCHEDSTAT_DOMAIN;
--
2.55.0
next reply other threads:[~2026-09-12 3:11 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-12 3:11 Hui Su [this message]
[not found] ` <20260912032114.A02C91F000FF@smtp.kernel.org>
2026-09-12 5:36 ` Hui Su
2026-09-26 10:31 ` Hui Su
2026-09-26 18:30 ` Arnaldo Carvalho de Melo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260912031112.1814574-3-sh_def@163.com \
--to=sh_def@163.com \
--cc=acme@kernel.org \
--cc=adrian.hunter@intel.com \
--cc=irogers@google.com \
--cc=james.clark@linaro.org \
--cc=jolsa@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-perf-users@vger.kernel.org \
--cc=namhyung@kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®