perf hwmon: Guard label read against empty or failed reads

hwmon_pmu__read_events() reads label files with read() into a stack
buffer, strips trailing newlines, then checks buf[0] == '\0'.  When
read() returns 0 (empty file) or -1 (error), the buffer is never
written, so buf[0] reads uninitialized stack memory.  If the garbage
byte is non-zero, the code falls through to strdup(buf) which copies
arbitrary stack data as the label string.

Fix by checking read_len <= 0 before accessing buf contents, closing
the fd and skipping the entry.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Fixes: 53cc0b351ec99278 ("perf hwmon_pmu: Add a tool PMU exposing events from hwmon in sysfs")
Cc: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

diff --git a/tools/perf/util/hwmon_pmu.c b/tools/perf/util/hwmon_pmu.c
index bdcbe887579a1f08ccb378068ee79c23b89d84c3..efd3067a2e591050bfb131ab00d439ee4b787cb9 100644 (file)
--- a/tools/perf/util/hwmon_pmu.c
+++ b/tools/perf/util/hwmon_pmu.c
@@ -295,8 +295,11 @@ static int hwmon_pmu__read_events(struct hwmon_pmu *pmu)
                        while (read_len > 0 && buf[read_len - 1] == '\n')
                                read_len--;
 
-                       if (read_len > 0)
-                               buf[read_len] = '\0';
+                       if (read_len <= 0) {
+                               close(fd);
+                               continue;
+                       }
+                       buf[read_len] = '\0';
 
                        if (buf[0] == '\0') {
                                pr_debug("hwmon_pmu: empty label file %s %s\n",