[PATCH v1] perf stat: Avoid uninitialized memory read on error

[PATCH v1] perf stat: Avoid uninitialized memory read on error

[Ian Rogers]

If has_supported_counters fails then msg was passed to ui__error
regardless of whether an error was written into msg leading to reading
uninitialized memory. Avoid this by always terminating msg at
initialization.

Opportunistically reduce the scope of msg to make its use clearer.

Fixes: c9a8c343ef2f ("perf stat: When no events, don't report an error if there is none")
Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/builtin-stat.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
index c50cf230f16e..37752d6bfef4 100644
--- a/tools/perf/builtin-stat.c
+++ b/tools/perf/builtin-stat.c
@@ -777,7 +777,6 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
 	int interval = stat_config.interval;
 	int times = stat_config.times;
 	int timeout = stat_config.timeout;
-	char msg[BUFSIZ];
 	unsigned long long t0, t1;
 	struct evsel *counter;
 	size_t l;
@@ -908,6 +907,9 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
 		}
 	}
 	if (!has_supported_counters && !stat_config.null_run) {
+		char msg[BUFSIZ];
+
+		msg[0] = '\0';
 		if (open_err) {
 			evsel__open_strerror(evlist__first(evsel_list), &target, open_err,
 					     msg, sizeof(msg));
-- 
2.55.0.979.g7e5102b832-goog

Re: [PATCH v1] perf stat: Avoid uninitialized memory read on error

[Arnaldo Carvalho de Melo]

On Tue, Sep 08, 2026 at 03:07:20PM -0700, Ian Rogers wrote:
> If has_supported_counters fails then msg was passed to ui__error
> regardless of whether an error was written into msg leading to reading
> uninitialized memory. Avoid this by always terminating msg at
> initialization.
> 
> Opportunistically reduce the scope of msg to make its use clearer.

Thanks, applied to perf-tools-next, for v7.4.

- Arnaldo
 
> Fixes: c9a8c343ef2f ("perf stat: When no events, don't report an error if there is none")
> Signed-off-by: Ian Rogers <irogers@google.com>
> ---
>  tools/perf/builtin-stat.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/perf/builtin-stat.c b/tools/perf/builtin-stat.c
> index c50cf230f16e..37752d6bfef4 100644
> --- a/tools/perf/builtin-stat.c
> +++ b/tools/perf/builtin-stat.c
> @@ -777,7 +777,6 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
>  	int interval = stat_config.interval;
>  	int times = stat_config.times;
>  	int timeout = stat_config.timeout;
> -	char msg[BUFSIZ];
>  	unsigned long long t0, t1;
>  	struct evsel *counter;
>  	size_t l;
> @@ -908,6 +907,9 @@ static int __run_perf_stat(int argc, const char **argv, int run_idx)
>  		}
>  	}
>  	if (!has_supported_counters && !stat_config.null_run) {
> +		char msg[BUFSIZ];
> +
> +		msg[0] = '\0';
>  		if (open_err) {
>  			evsel__open_strerror(evlist__first(evsel_list), &target, open_err,
>  					     msg, sizeof(msg));
> -- 
> 2.55.0.979.g7e5102b832-goog
>