]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf tools: Fix thread__set_comm_from_proc() on empty comm file
authorArnaldo Carvalho de Melo <acme@redhat.com>
Mon, 8 Jun 2026 01:37:55 +0000 (22:37 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 10 Jun 2026 21:56:01 +0000 (18:56 -0300)
commit31d596054550f793508abe7dd593853ece47d428
treed37c299fba5c0289be49bbd04f322b8a1552bb92
parentb6bb3b005dcdd960b8e0b7f9d6869132b3de08d5
perf tools: Fix thread__set_comm_from_proc() on empty comm file

thread__set_comm_from_proc() calls procfs__read_str() then strips
the trailing newline via comm[sz - 1] = '\0'.  procfs__read_str()
allocates the buffer before reading, so on an empty /proc/pid/comm
(reachable during late exit teardown) it returns success with sz = 0
and an unterminated heap buffer.

The sz - 1 underflow was the original sashiko finding: it writes a
null byte before the allocation.  But even with a sz > 0 guard on
the newline strip, the unterminated buffer would still be passed to
thread__set_comm() which calls strlen() — an unbounded heap read.

Fix by treating sz == 0 as failure: free the buffer and return -1.
This is consistent with pmu.c's perf_pmu__parse_scale/unit which
already treat len == 0 from filename__read_str as an error.

Fixes: 2f3027ac28bf6bc3 ("perf thread: Introduce method to set comm from /proc/pid/self")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/thread.c