Re: [PATCH v10 04/29] perf evsel: Refactor evsel tracepoint sample accessors perf_sample

On Sun, Apr 12, 2026 at 02:34:19AM +0000, [email protected] wrote:
> Sashiko AI review found 1 potential issue(s):
> - [High] Removal of `strdup` in `sched_work_init` introduces a Use-After-Free vulnerability when storing the task name.
> --
> 
> commit 0d7b6945ae0c6b8ad53d53aacf54fb3b747a99a7
> Author: Ian Rogers <[email protected]>
> 
> perf evsel: Refactor evsel tracepoint sample accessors perf_sample
> 
> This commit removes the evsel argument from tracepoint sample accessor
> functions, renaming them to reflect that the data is being read directly
> from the sample.
> 
> Please note that the issue discussed below was resolved in a later commit
> upstream, specifically commit 5e8ad46aaa11f37f17084b59fcd84e6b4bbc3d6e
> (perf kwork: Fix memory management of kwork_work). It is included here
> for completeness regarding this specific patch.
> 
> [ ... ]
> > diff --git a/tools/perf/builtin-kwork.c b/tools/perf/builtin-kwork.c
> > index d4bb19ed91b59..8ba5ea201bf94 100644
> > --- a/tools/perf/builtin-kwork.c
> > +++ b/tools/perf/builtin-kwork.c
> [ ... ]
> > @@ -1310,11 +1309,11 @@ static void sched_work_init(struct perf_kwork *kwork __maybe_unused,
> >  	work->cpu = sample->cpu;
> >  
> >  	if (src_type == KWORK_TRACE_EXIT) {
> > -		work->id = evsel__intval(evsel, sample, "prev_pid");
> > -		work->name = strdup(evsel__strval(evsel, sample, "prev_comm"));
> > +		work->id = perf_sample__intval(sample, "prev_pid");
> > +		work->name = perf_sample__strval(sample, "prev_comm");
> 
> Does removing the strdup call here leave work->name pointing directly to
> the raw data inside the memory mapped ring buffer?
> 
> If perf_sample__strval returns a pointer to the sample data, that memory
> will be overwritten as new events arrive. When the reporting phase later
> iterates over the kwork_work tree, could this result in a use-after-free
> and output garbage strings?

I've removed this part for now.

Thanks,
Namhyung

> 
> >  	} else if (src_type == KWORK_TRACE_ENTRY) {
> > -		work->id = evsel__intval(evsel, sample, "next_pid");
> > -		work->name = strdup(evsel__strval(evsel, sample, "next_comm"));
> > +		work->id = perf_sample__intval(sample, "next_pid");
> > +		work->name = perf_sample__strval(sample, "next_comm");
> >  	}
> >  }
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4