From: Arnaldo Carvalho de Melo <acme@kernel.org>
To: Ingo Molnar <mingo@kernel.org>
Cc: linux-kernel@vger.kernel.org, He Kuang <hekuang@huawei.com>,
Ingo Molnar <mingo@redhat.com>,
Peter Zijlstra <a.p.zijlstra@chello.nl>,
Wang Nan <wangnan0@huawei.com>,
Arnaldo Carvalho de Melo <acme@redhat.com>
Subject: [PATCH 14/24] perf probe: Fix possible double free on error
Date: Thu, 12 Mar 2015 18:27:54 -0300 [thread overview]
Message-ID: <1426195684-20046-15-git-send-email-acme@kernel.org> (raw)
In-Reply-To: <1426195684-20046-1-git-send-email-acme@kernel.org>
From: He Kuang <hekuang@huawei.com>
A double free occurred when get source file path failed. If lr->path
failed to assign a new value, it will be freed as the old path and then
be freed again during line_range__clear(), and causes this:
$ perf probe -L do_execve -k vmlinux
*** Error in `/usr/bin/perf': double free or corruption (fasttop):
0x0000000000a9ac50 ***
======= Backtrace: =========
../lib64/libc.so.6(+0x6eeef)[0x7ffff5e44eef]
../lib64/libc.so.6(+0x78cae)[0x7ffff5e4ecae]
../lib64/libc.so.6(+0x79987)[0x7ffff5e4f987]
../bin/perf[0x4ab41f]
...
This patch fix this problem.
Signed-off-by: He Kuang <hekuang@huawei.com>
Acked-by: Masami Hiramatsu <masami.hiramatsu.pt@hitachi.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/r/1425463302-1687-1-git-send-email-hekuang@huawei.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/util/probe-event.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 8af8e7f55254..e2bf620f98cb 100644
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -790,7 +790,11 @@ static int __show_line_range(struct line_range *lr, const char *module,
/* Convert source file path */
tmp = lr->path;
ret = get_real_path(tmp, lr->comp_dir, &lr->path);
- free(tmp); /* Free old path */
+
+ /* Free old path when new path is assigned */
+ if (tmp != lr->path)
+ free(tmp);
+
if (ret < 0) {
pr_warning("Failed to find source file path.\n");
return ret;
--
1.9.3
next prev parent reply other threads:[~2015-03-12 21:32 UTC|newest]
Thread overview: 31+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-03-12 21:27 [GIT PULL 00/24] perf/core improvements and fixes Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 01/24] perf ordered_events: Untangle from perf_session Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 02/24] perf ordered_events: Shorten function signatures Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 03/24] perf ordered_events: Allow tools to specify a deliver method Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 04/24] perf tools: tool->finished_round() doesn't need perf_session Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 05/24] perf tools: Remove superfluous thread->comm_set setting Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 06/24] perf ordered_events: Adopt queue() method Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 07/24] perf probe: Fix to handle aliased symbols in glibc Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 08/24] perf probe: Fix --line " Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 09/24] Revert "perf probe: Fix to fall back to find probe point in symbols" Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 10/24] perf symbols: Allow symbol alias when loading map for symbol name Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 11/24] perf probe: Allow weak symbols to be probed Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 12/24] perf build: Fix libbabeltrace detection Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 13/24] perf tools: Output feature detection's gcc output to a file Arnaldo Carvalho de Melo
2015-03-12 21:27 ` Arnaldo Carvalho de Melo [this message]
2015-03-12 21:27 ` [PATCH 15/24] perf hists browser: Fix UI bug after zoom into thread/dso/symbol Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 16/24] perf probe: Fix compiles due to declarations using perf_probe_point Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 17/24] perf hists browser: Fix UI bug after fold/unfold Arnaldo Carvalho de Melo
2015-03-12 21:27 ` [PATCH 18/24] perf stat: Output running time and run/enabled ratio in CSV mode Arnaldo Carvalho de Melo
2015-03-13 7:34 ` Ingo Molnar
2015-03-13 10:53 ` Arnaldo Carvalho de Melo
2015-03-13 12:31 ` Ingo Molnar
2015-03-12 21:27 ` [PATCH 19/24] perf stat: Fix IPC and other formulas with -A Arnaldo Carvalho de Melo
2015-03-12 21:28 ` [PATCH 20/24] perf stat: Always correctly indent ratio column Arnaldo Carvalho de Melo
2015-03-13 7:36 ` Ingo Molnar
2015-03-12 21:28 ` [PATCH 21/24] perf kmem: Fix segfault when invalid sort key is given Arnaldo Carvalho de Melo
2015-03-12 21:28 ` [PATCH 22/24] perf kmem: Allow -v option Arnaldo Carvalho de Melo
2015-03-12 21:28 ` [PATCH 23/24] perf kmem: Fix alignment of slab result table Arnaldo Carvalho de Melo
2015-03-12 21:28 ` [PATCH 24/24] perf data: Add tracepoint events fields CTF conversion support Arnaldo Carvalho de Melo
2015-03-13 12:34 ` [GIT PULL 00/24] perf/core improvements and fixes Ingo Molnar
2015-03-13 12:45 ` Jiri Olsa
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1426195684-20046-15-git-send-email-acme@kernel.org \
--to=acme@kernel.org \
--cc=a.p.zijlstra@chello.nl \
--cc=acme@redhat.com \
--cc=hekuang@huawei.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mingo@kernel.org \
--cc=mingo@redhat.com \
--cc=wangnan0@huawei.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).