Bug Summary

File:src/usr.sbin/kgmon/kgmon.c
Warning:line 473, column 3
Potential leak of memory pointed to by 'zbuf'

Annotated Source Code

Press '?' to see keyboard shortcuts

clang -cc1 -cc1 -triple amd64-unknown-openbsd7.4 -analyze -disable-free -clear-ast-before-backend -disable-llvm-verifier -discard-value-names -main-file-name kgmon.c -analyzer-checker=core -analyzer-checker=apiModeling -analyzer-checker=unix -analyzer-checker=deadcode -analyzer-checker=security.insecureAPI.UncheckedReturn -analyzer-checker=security.insecureAPI.getpw -analyzer-checker=security.insecureAPI.gets -analyzer-checker=security.insecureAPI.mktemp -analyzer-checker=security.insecureAPI.mkstemp -analyzer-checker=security.insecureAPI.vfork -analyzer-checker=nullability.NullPassedToNonnull -analyzer-checker=nullability.NullReturnedFromNonnull -analyzer-output plist -w -setup-static-analyzer -mrelocation-model pic -pic-level 1 -pic-is-pie -mframe-pointer=all -relaxed-aliasing -ffp-contract=on -fno-rounding-math -mconstructor-aliases -funwind-tables=2 -target-cpu x86-64 -target-feature +retpoline-indirect-calls -target-feature +retpoline-indirect-branches -tune-cpu generic -debugger-tuning=gdb -fcoverage-compilation-dir=/usr/src/usr.sbin/kgmon/obj -resource-dir /usr/local/llvm16/lib/clang/16 -internal-isystem /usr/local/llvm16/lib/clang/16/include -internal-externc-isystem /usr/include -O2 -fdebug-compilation-dir=/usr/src/usr.sbin/kgmon/obj -ferror-limit 19 -fwrapv -D_RET_PROTECTOR -ret-protector -fcf-protection=branch -fno-jump-tables -fgnuc-version=4.2.1 -vectorize-loops -vectorize-slp -fno-builtin-malloc -fno-builtin-calloc -fno-builtin-realloc -fno-builtin-valloc -fno-builtin-free -fno-builtin-strdup -fno-builtin-strndup -analyzer-output=html -faddrsig -D__GCC_HAVE_DWARF2_CFI_ASM=1 -o /home/ben/Projects/scan/2024-01-11-140451-98009-1 -x c /usr/src/usr.sbin/kgmon/kgmon.c
1/* $OpenBSD: kgmon.c,v 1.26 2019/06/28 13:32:48 deraadt Exp $ */
2
3/*
4 * Copyright (c) 1983, 1992, 1993
5 * The Regents of the University of California. All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the University nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32#include <sys/types.h>
33#include <sys/sysctl.h>
34#include <sys/time.h>
35#include <sys/gmon.h>
36
37#include <errno(*__errno()).h>
38#include <err.h>
39#include <fcntl.h>
40#include <kvm.h>
41#include <limits.h>
42#include <stdio.h>
43#include <stdlib.h>
44#include <unistd.h>
45#include <string.h>
46#include <nlist.h>
47#include <paths.h>
48
49struct nlist nl[] = {
50#define N_GMONPARAM0 0
51 { "__gmonparam" },
52#define N_PROFHZ1 1
53 { "_profhz" },
54 { NULL((void *)0) }
55};
56
57struct kvmvars {
58 kvm_t *kd;
59 struct gmonparam gpm;
60};
61
62extern char *__progname;
63
64int bflag, cflag, hflag, kflag, rflag, pflag;
65int debug = 0;
66void kgmon(char *, char *, struct kvmvars *, int);
67void setprof(struct kvmvars *, int, int);
68void dumpstate(struct kvmvars *, int);
69void reset(struct kvmvars *, int);
70void kern_readonly(int);
71int getprof(struct kvmvars *, int);
72int getprofhz(struct kvmvars *);
73int openfiles(char *, char *, struct kvmvars *, int);
74int getncpu(void);
75
76int
77main(int argc, char **argv)
78{
79 int ch, ncpu, cpuid = -1;
80 struct kvmvars kvmvars;
81 char *sys, *kmemf;
82 const char *p;
83
84 kmemf = NULL((void *)0);
85 sys = NULL((void *)0);
86 while ((ch = getopt(argc, argv, "M:N:bc:hpr")) != -1) {
1
Assuming the condition is false
→
2
←
Loop condition is false. Execution continues on line 127
→
87 switch(ch) {
88
89 case 'M':
90 kmemf = optarg;
91 kflag = 1;
92 break;
93
94 case 'N':
95 sys = optarg;
96 break;
97
98 case 'b':
99 bflag = 1;
100 break;
101
102 case 'c':
103 cflag = 1;
104 cpuid = strtonum(optarg, 0, 1024, &p);
105 if (p)
106 errx(1, "illegal CPU id %s: %s", optarg, p);
107 break;
108
109 case 'h':
110 hflag = 1;
111 break;
112
113 case 'p':
114 pflag = 1;
115 break;
116
117 case 'r':
118 rflag = 1;
119 break;
120
121 default:
122 fprintf(stderr(&__sF[2]), "usage: %s [-bhpr] "
123 "[-c cpuid] [-M core] [-N system]\n", __progname);
124 exit(1);
125 }
126 }
127 argc -= optind;
128 argv += optind;
129
130#define BACKWARD_COMPATIBILITY
131#ifdef BACKWARD_COMPATIBILITY
132 if (*argv) {
3
←
Assuming the condition is false
→
4
←
Taking false branch
→
133 sys = *argv;
134 if (*++argv) {
135 kmemf = *argv;
136 ++kflag;
137 }
138 }
139#endif
140
141 if (cflag) {
5
←
Assuming 'cflag' is not equal to 0
→
6
←
Taking true branch
→
142 kgmon(sys, kmemf, &kvmvars, cpuid);
7
←
Calling 'kgmon'
→
143 } else {
144 ncpu = getncpu();
145 for (cpuid = 0; cpuid < ncpu; cpuid++)
146 kgmon(sys, kmemf, &kvmvars, cpuid);
147 }
148
149 return (0);
150}
151
152void
153kgmon(char *sys, char *kmemf, struct kvmvars *kvp, int cpuid)
154{
155 int mode, disp, accessmode;
156
157 accessmode = openfiles(sys, kmemf, kvp, cpuid);
158 mode = getprof(kvp, cpuid);
159 if (hflag)
8
←
Assuming 'hflag' is not equal to 0
→
9
←
Taking true branch
→
160 disp = GMON_PROF_OFF3;
161 else if (bflag)
162 disp = GMON_PROF_ON0;
163 else
164 disp = mode;
165 if (pflag)
10
←
Assuming 'pflag' is 0
→
11
←
Taking false branch
→
166 dumpstate(kvp, cpuid);
167 if (rflag)
12
←
Assuming 'rflag' is not equal to 0
→
13
←
Taking true branch
→
168 reset(kvp, cpuid);
14
←
Calling 'reset'
→
169 if (accessmode == O_RDWR0x0002)
170 setprof(kvp, cpuid, disp);
171 printf("%s: kernel profiling is %s for cpu %d.\n", __progname,
172 disp == GMON_PROF_OFF3 ? "off" : "running", cpuid);
173}
174
175/*
176 * Check that profiling is enabled and open any ncessary files.
177 */
178int
179openfiles(char *sys, char *kmemf, struct kvmvars *kvp, int cpuid)
180{
181 int mib[4], state, openmode;
182 size_t size;
183 char errbuf[_POSIX2_LINE_MAX2048];
184
185 if (!kflag) {
186 mib[0] = CTL_KERN1;
187 mib[1] = KERN_PROF16;
188 mib[2] = GPROF_STATE0;
189 mib[3] = cpuid;
190 size = sizeof state;
191 if (sysctl(mib, 4, &state, &size, NULL((void *)0), 0) == -1)
192 errx(20, "profiling not defined in kernel.");
193 if (!(bflag || hflag || rflag ||
194 (pflag && state == GMON_PROF_ON0)))
195 return (O_RDONLY0x0000);
196 if (sysctl(mib, 4, NULL((void *)0), NULL((void *)0), &state, size) >= 0)
197 return (O_RDWR0x0002);
198 kern_readonly(state);
199 return (O_RDONLY0x0000);
200 }
201 openmode = (bflag || hflag || pflag || rflag) ? O_RDWR0x0002 : O_RDONLY0x0000;
202 kvp->kd = kvm_openfiles(sys, kmemf, NULL((void *)0), openmode, errbuf);
203 if (kvp->kd == NULL((void *)0)) {
204 if (openmode == O_RDWR0x0002) {
205 openmode = O_RDONLY0x0000;
206 kvp->kd = kvm_openfiles(sys, kmemf, NULL((void *)0), O_RDONLY0x0000,
207 errbuf);
208 }
209 if (kvp->kd == NULL((void *)0))
210 errx(2, "kvm_openfiles: %s", errbuf);
211 kern_readonly(GMON_PROF_ON0);
212 }
213 if (kvm_nlist(kvp->kd, nl) == -1)
214 errx(3, "%s: no namelist", sys ? sys : _PATH_UNIX"/bsd");
215 if (!nl[N_GMONPARAM0].n_value)
216 errx(20, "profiling not defined in kernel.");
217 return (openmode);
218}
219
220/*
221 * Suppress options that require a writable kernel.
222 */
223void
224kern_readonly(int mode)
225{
226 extern char *__progname;
227
228 (void)fprintf(stderr(&__sF[2]), "%s: kernel read-only: ", __progname);
229 if (pflag && mode == GMON_PROF_ON0)
230 (void)fprintf(stderr(&__sF[2]), "data may be inconsistent\n");
231 if (rflag)
232 (void)fprintf(stderr(&__sF[2]), "-r suppressed\n");
233 if (bflag)
234 (void)fprintf(stderr(&__sF[2]), "-b suppressed\n");
235 if (hflag)
236 (void)fprintf(stderr(&__sF[2]), "-h suppressed\n");
237 rflag = bflag = hflag = 0;
238}
239
240/*
241 * Get the state of kernel profiling.
242 */
243int
244getprof(struct kvmvars *kvp, int cpuid)
245{
246 int mib[4];
247 size_t size;
248
249 if (kflag) {
250 size = kvm_read(kvp->kd, nl[N_GMONPARAM0].n_value, &kvp->gpm,
251 sizeof kvp->gpm);
252 } else {
253 mib[0] = CTL_KERN1;
254 mib[1] = KERN_PROF16;
255 mib[2] = GPROF_GMONPARAM4;
256 mib[3] = cpuid;
257 size = sizeof kvp->gpm;
258 if (sysctl(mib, 4, &kvp->gpm, &size, NULL((void *)0), 0) == -1)
259 size = 0;
260 }
261 if (size != sizeof kvp->gpm)
262 errx(4, "cannot get gmonparam: %s",
263 kflag ? kvm_geterr(kvp->kd) : strerror(errno(*__errno())));
264 return (kvp->gpm.state);
265}
266
267/*
268 * Enable or disable kernel profiling according to the state variable.
269 */
270void
271setprof(struct kvmvars *kvp, int cpuid, int state)
272{
273 struct gmonparam *p = (struct gmonparam *)nl[N_GMONPARAM0].n_value;
274 int mib[4], oldstate;
275 size_t sz;
276
277 sz = sizeof(state);
278 if (!kflag) {
279 mib[0] = CTL_KERN1;
280 mib[1] = KERN_PROF16;
281 mib[2] = GPROF_STATE0;
282 mib[3] = cpuid;
283 if (sysctl(mib, 4, &oldstate, &sz, NULL((void *)0), 0) == -1)
284 goto bad;
285 if (oldstate == state)
286 return;
287 if (sysctl(mib, 4, NULL((void *)0), NULL((void *)0), &state, sz) >= 0)
288 return;
289 } else if (kvm_write(kvp->kd, (u_long)&p->state, (void *)&state, sz)
290 == sz)
291 return;
292bad:
293 warnx("warning: cannot turn profiling %s",
294 state == GMON_PROF_OFF3 ? "off" : "on");
295}
296
297/*
298 * Build the gmon.out file.
299 */
300void
301dumpstate(struct kvmvars *kvp, int cpuid)
302{
303 FILE *fp;
304 struct rawarc rawarc;
305 struct tostruct *tos;
306 u_long frompc;
307 u_short *froms, *tickbuf;
308 int mib[4];
309 size_t i;
310 struct gmonhdr h;
311 int fromindex, endfrom, toindex;
312 char buf[16];
313
314 snprintf(buf, sizeof(buf), "gmon-%02d.out", cpuid);
315
316 setprof(kvp, cpuid, GMON_PROF_OFF3);
317 fp = fopen(buf, "w");
318 if (fp == 0) {
319 perror(buf);
320 return;
321 }
322
323 /*
324 * Build the gmon header and write it to a file.
325 */
326 bzero(&h, sizeof(h));
327 h.lpc = kvp->gpm.lowpc;
328 h.hpc = kvp->gpm.highpc;
329 h.ncnt = kvp->gpm.kcountsize + sizeof(h);
330 h.version = GMONVERSION0x00051879;
331 h.profrate = getprofhz(kvp);
332 fwrite((char *)&h, sizeof(h), 1, fp);
333
334 /*
335 * Write out the tick buffer.
336 */
337 mib[0] = CTL_KERN1;
338 mib[1] = KERN_PROF16;
339 if ((tickbuf = malloc(kvp->gpm.kcountsize)) == NULL((void *)0))
340 errx(5, "cannot allocate kcount space");
341 if (kflag) {
342 i = kvm_read(kvp->kd, (u_long)kvp->gpm.kcount, (void *)tickbuf,
343 kvp->gpm.kcountsize);
344 } else {
345 mib[2] = GPROF_COUNT1;
346 mib[3] = cpuid;
347 i = kvp->gpm.kcountsize;
348 if (sysctl(mib, 4, tickbuf, &i, NULL((void *)0), 0) == -1)
349 i = 0;
350 }
351 if (i != kvp->gpm.kcountsize)
352 errx(6, "read ticks: read %lu, got %zu: %s",
353 kvp->gpm.kcountsize, i,
354 kflag ? kvm_geterr(kvp->kd) : strerror(errno(*__errno())));
355 if ((fwrite(tickbuf, kvp->gpm.kcountsize, 1, fp)) != 1)
356 err(7, "writing tocks to gmon.out");
357 free(tickbuf);
358
359 /*
360 * Write out the arc info.
361 */
362 if ((froms = malloc(kvp->gpm.fromssize)) == NULL((void *)0))
363 errx(8, "cannot allocate froms space");
364 if (kflag) {
365 i = kvm_read(kvp->kd, (u_long)kvp->gpm.froms, (void *)froms,
366 kvp->gpm.fromssize);
367 } else {
368 mib[2] = GPROF_FROMS2;
369 mib[3] = cpuid;
370 i = kvp->gpm.fromssize;
371 if (sysctl(mib, 4, froms, &i, NULL((void *)0), 0) == -1)
372 i = 0;
373 }
374 if (i != kvp->gpm.fromssize)
375 errx(9, "read froms: read %lu, got %zu: %s",
376 kvp->gpm.fromssize, i,
377 kflag ? kvm_geterr(kvp->kd) : strerror(errno(*__errno())));
378 if ((tos = malloc(kvp->gpm.tossize)) == NULL((void *)0))
379 errx(10, "cannot allocate tos space");
380 if (kflag) {
381 i = kvm_read(kvp->kd, (u_long)kvp->gpm.tos, (void *)tos,
382 kvp->gpm.tossize);
383 } else {
384 mib[2] = GPROF_TOS3;
385 mib[3] = cpuid;
386 i = kvp->gpm.tossize;
387 if (sysctl(mib, 4, tos, &i, NULL((void *)0), 0) == -1)
388 i = 0;
389 }
390 if (i != kvp->gpm.tossize)
391 errx(11, "read tos: read %lu, got %zu: %s",
392 kvp->gpm.tossize, i,
393 kflag ? kvm_geterr(kvp->kd) : strerror(errno(*__errno())));
394 if (debug)
395 warnx("lowpc 0x%lx, textsize 0x%lx",
396 kvp->gpm.lowpc, kvp->gpm.textsize);
397 endfrom = kvp->gpm.fromssize / sizeof(*froms);
398 for (fromindex = 0; fromindex < endfrom; ++fromindex) {
399 if (froms[fromindex] == 0)
400 continue;
401 frompc = (u_long)kvp->gpm.lowpc +
402 (fromindex * kvp->gpm.hashfraction * sizeof(*froms));
403 for (toindex = froms[fromindex]; toindex != 0;
404 toindex = tos[toindex].link) {
405 if (debug)
406 warnx("[mcleanup] frompc 0x%lx selfpc 0x%lx count %ld",
407 frompc, tos[toindex].selfpc, tos[toindex].count);
408 rawarc.raw_frompc = frompc;
409 rawarc.raw_selfpc = (u_long)tos[toindex].selfpc;
410 rawarc.raw_count = tos[toindex].count;
411 fwrite((char *)&rawarc, sizeof(rawarc), 1, fp);
412 }
413 }
414 fclose(fp);
415}
416
417/*
418 * Get the profiling rate.
419 */
420int
421getprofhz(struct kvmvars *kvp)
422{
423 int mib[2], profrate;
424 size_t size;
425 struct clockinfo clockrate;
426
427 if (kflag) {
428 profrate = 1;
429 if (kvm_read(kvp->kd, nl[N_PROFHZ1].n_value, &profrate,
430 sizeof profrate) != sizeof profrate)
431 warnx("get clockrate: %s", kvm_geterr(kvp->kd));
432 return (profrate);
433 }
434 mib[0] = CTL_KERN1;
435 mib[1] = KERN_CLOCKRATE12;
436 clockrate.profhz = 1;
437 size = sizeof clockrate;
438 if (sysctl(mib, 2, &clockrate, &size, NULL((void *)0), 0) == -1)
439 warn("get clockrate");
440 return (clockrate.profhz);
441}
442
443/*
444 * Reset the kernel profiling date structures.
445 */
446void
447reset(struct kvmvars *kvp, int cpuid)
448{
449 char *zbuf;
450 u_long biggest;
451 int mib[4];
452
453 setprof(kvp, cpuid, GMON_PROF_OFF3);
454
455 biggest = kvp->gpm.kcountsize;
456 if (kvp->gpm.fromssize > biggest)
15
←
Assuming 'biggest' is >= field 'fromssize'
→
16
←
Taking false branch
→
457 biggest = kvp->gpm.fromssize;
458 if (kvp->gpm.tossize > biggest)
17
←
Assuming 'biggest' is >= field 'tossize'
→
18
←
Taking false branch
→
459 biggest = kvp->gpm.tossize;
460 if ((zbuf = malloc(biggest)) == NULL((void *)0))
19
←
Memory is allocated
→
20
←
Assuming the condition is false
→
21
←
Taking false branch
→
461 errx(12, "cannot allocate zbuf space");
462 bzero(zbuf, biggest);
463 if (kflag) {
22
←
Assuming 'kflag' is not equal to 0
→
23
←
Taking true branch
→
464 if (kvm_write(kvp->kd, (u_long)kvp->gpm.kcount, zbuf,
24
←
Assuming the condition is false
→
25
←
Taking false branch
→
465 kvp->gpm.kcountsize) != kvp->gpm.kcountsize)
466 errx(13, "tickbuf zero: %s", kvm_geterr(kvp->kd));
467 if (kvm_write(kvp->kd, (u_long)kvp->gpm.froms, zbuf,
26
←
Assuming the condition is false
→
27
←
Taking false branch
→
468 kvp->gpm.fromssize) != kvp->gpm.fromssize)
469 errx(14, "froms zero: %s", kvm_geterr(kvp->kd));
470 if (kvm_write(kvp->kd, (u_long)kvp->gpm.tos, zbuf,
28
←
Assuming the condition is false
→
29
←
Taking false branch
→
471 kvp->gpm.tossize) != kvp->gpm.tossize)
472 errx(15, "tos zero: %s", kvm_geterr(kvp->kd));
473 return;
30
←
Potential leak of memory pointed to by 'zbuf'
474 }
475 mib[0] = CTL_KERN1;
476 mib[1] = KERN_PROF16;
477 mib[2] = GPROF_COUNT1;
478 mib[3] = cpuid;
479 if (sysctl(mib, 4, NULL((void *)0), NULL((void *)0), zbuf, kvp->gpm.kcountsize) == -1)
480 err(13, "tickbuf zero");
481 mib[2] = GPROF_FROMS2;
482 if (sysctl(mib, 4, NULL((void *)0), NULL((void *)0), zbuf, kvp->gpm.fromssize) == -1)
483 err(14, "froms zero");
484 mib[2] = GPROF_TOS3;
485 if (sysctl(mib, 4, NULL((void *)0), NULL((void *)0), zbuf, kvp->gpm.tossize) == -1)
486 err(15, "tos zero");
487 free(zbuf);
488}
489
490int
491getncpu(void)
492{
493 int mib[2] = { CTL_HW6, HW_NCPU3 };
494 size_t size;
495 int ncpu;
496
497 size = sizeof(ncpu);
498 if (sysctl(mib, 2, &ncpu, &size, NULL((void *)0), 0) == -1) {
499 warnx("cannot read hw.ncpu");
500 return (1);
501 }
502
503 return (ncpu);
504}