* [PATCH v2] perf mem2node: avoid double free related to realloc
@ 2020-03-20 18:23 Ian Rogers
2020-04-29 17:40 ` Ian Rogers
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Ian Rogers @ 2020-03-20 18:23 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim,
linux-kernel, clang-built-linux
Cc: Stephane Eranian, Ian Rogers
Realloc of size zero is a free not an error, avoid this causing a double
free. Caught by clang's address sanitizer:
==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
#0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
#1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
#2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
#3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
#4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#8 0x564965942e41 in main tools/perf/perf.c:538:3
0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
freed by thread T0 here:
#0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
#1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
#2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
#3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#7 0x564965942e41 in main tools/perf/perf.c:538:3
previously allocated by thread T0 here:
#0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
#1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
#2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
#3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
#4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#8 0x564965942e41 in main tools/perf/perf.c:538:3
v2: add a WARN_ON_ONCE when the free condition arises.
Signed-off-by: Ian Rogers <irogers@google.com>
---
tools/perf/util/mem2node.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
index 797d86a1ab09..c84f5841c7ab 100644
--- a/tools/perf/util/mem2node.c
+++ b/tools/perf/util/mem2node.c
@@ -1,5 +1,6 @@
#include <errno.h>
#include <inttypes.h>
+#include <asm/bug.h>
#include <linux/bitmap.h>
#include <linux/kernel.h>
#include <linux/zalloc.h>
@@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
/* Cut unused entries, due to merging. */
tmp_entries = realloc(entries, sizeof(*entries) * j);
- if (tmp_entries)
+ if (tmp_entries || WARN_ON_ONCE(j == 0))
entries = tmp_entries;
for (i = 0; i < j; i++) {
--
2.25.1.696.g5e7596f4ac-goog
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH v2] perf mem2node: avoid double free related to realloc
2020-03-20 18:23 [PATCH v2] perf mem2node: avoid double free related to realloc Ian Rogers
@ 2020-04-29 17:40 ` Ian Rogers
2020-04-29 17:45 ` Arnaldo Carvalho de Melo
2020-04-30 8:15 ` Jiri Olsa
2020-05-08 13:04 ` [tip: perf/core] perf mem2node: Avoid " tip-bot2 for Ian Rogers
2 siblings, 1 reply; 6+ messages in thread
From: Ian Rogers @ 2020-04-29 17:40 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim, LKML,
clang-built-linux
Cc: Stephane Eranian
Ping. This is missing an Acked-by:
v2 addressed Jiri's review comments:
https://lore.kernel.org/lkml/20200315093013.GC492969@krava/
Thanks,
Ian
On Fri, Mar 20, 2020 at 11:23 AM Ian Rogers <irogers@google.com> wrote:
>
> Realloc of size zero is a free not an error, avoid this causing a double
> free. Caught by clang's address sanitizer:
>
> ==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
> #0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
> #1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
> #2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
> #3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
> #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #8 0x564965942e41 in main tools/perf/perf.c:538:3
>
> 0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
> freed by thread T0 here:
> #0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
> #1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
> #2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> #3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #7 0x564965942e41 in main tools/perf/perf.c:538:3
>
> previously allocated by thread T0 here:
> #0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
> #1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
> #2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
> #3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #8 0x564965942e41 in main tools/perf/perf.c:538:3
>
> v2: add a WARN_ON_ONCE when the free condition arises.
>
> Signed-off-by: Ian Rogers <irogers@google.com>
> ---
> tools/perf/util/mem2node.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
> index 797d86a1ab09..c84f5841c7ab 100644
> --- a/tools/perf/util/mem2node.c
> +++ b/tools/perf/util/mem2node.c
> @@ -1,5 +1,6 @@
> #include <errno.h>
> #include <inttypes.h>
> +#include <asm/bug.h>
> #include <linux/bitmap.h>
> #include <linux/kernel.h>
> #include <linux/zalloc.h>
> @@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
>
> /* Cut unused entries, due to merging. */
> tmp_entries = realloc(entries, sizeof(*entries) * j);
> - if (tmp_entries)
> + if (tmp_entries || WARN_ON_ONCE(j == 0))
> entries = tmp_entries;
>
> for (i = 0; i < j; i++) {
> --
> 2.25.1.696.g5e7596f4ac-goog
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] perf mem2node: avoid double free related to realloc
2020-04-29 17:40 ` Ian Rogers
@ 2020-04-29 17:45 ` Arnaldo Carvalho de Melo
0 siblings, 0 replies; 6+ messages in thread
From: Arnaldo Carvalho de Melo @ 2020-04-29 17:45 UTC (permalink / raw)
To: Ian Rogers
Cc: Peter Zijlstra, Ingo Molnar, Mark Rutland, Alexander Shishkin,
Jiri Olsa, Namhyung Kim, LKML, clang-built-linux,
Stephane Eranian
Em Wed, Apr 29, 2020 at 10:40:06AM -0700, Ian Rogers escreveu:
> Ping. This is missing an Acked-by:
> v2 addressed Jiri's review comments:
> https://lore.kernel.org/lkml/20200315093013.GC492969@krava/
Jiri?
> Thanks,
> Ian
>
>
> On Fri, Mar 20, 2020 at 11:23 AM Ian Rogers <irogers@google.com> wrote:
> >
> > Realloc of size zero is a free not an error, avoid this causing a double
> > free. Caught by clang's address sanitizer:
> >
> > ==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
> > #0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
> > #1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
> > #2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
> > #3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
> > #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> > #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> > #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> > #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> > #8 0x564965942e41 in main tools/perf/perf.c:538:3
> >
> > 0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
> > freed by thread T0 here:
> > #0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
> > #1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
> > #2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> > #3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> > #4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> > #5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> > #6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> > #7 0x564965942e41 in main tools/perf/perf.c:538:3
> >
> > previously allocated by thread T0 here:
> > #0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
> > #1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
> > #2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
> > #3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> > #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> > #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> > #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> > #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> > #8 0x564965942e41 in main tools/perf/perf.c:538:3
> >
> > v2: add a WARN_ON_ONCE when the free condition arises.
> >
> > Signed-off-by: Ian Rogers <irogers@google.com>
> > ---
> > tools/perf/util/mem2node.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
> > index 797d86a1ab09..c84f5841c7ab 100644
> > --- a/tools/perf/util/mem2node.c
> > +++ b/tools/perf/util/mem2node.c
> > @@ -1,5 +1,6 @@
> > #include <errno.h>
> > #include <inttypes.h>
> > +#include <asm/bug.h>
> > #include <linux/bitmap.h>
> > #include <linux/kernel.h>
> > #include <linux/zalloc.h>
> > @@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
> >
> > /* Cut unused entries, due to merging. */
> > tmp_entries = realloc(entries, sizeof(*entries) * j);
> > - if (tmp_entries)
> > + if (tmp_entries || WARN_ON_ONCE(j == 0))
> > entries = tmp_entries;
> >
> > for (i = 0; i < j; i++) {
> > --
> > 2.25.1.696.g5e7596f4ac-goog
> >
--
- Arnaldo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] perf mem2node: avoid double free related to realloc
2020-03-20 18:23 [PATCH v2] perf mem2node: avoid double free related to realloc Ian Rogers
2020-04-29 17:40 ` Ian Rogers
@ 2020-04-30 8:15 ` Jiri Olsa
2020-04-30 13:23 ` Arnaldo Carvalho de Melo
2020-05-08 13:04 ` [tip: perf/core] perf mem2node: Avoid " tip-bot2 for Ian Rogers
2 siblings, 1 reply; 6+ messages in thread
From: Jiri Olsa @ 2020-04-30 8:15 UTC (permalink / raw)
To: Ian Rogers
Cc: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Mark Rutland, Alexander Shishkin, Namhyung Kim, linux-kernel,
clang-built-linux, Stephane Eranian
On Fri, Mar 20, 2020 at 11:23:47AM -0700, Ian Rogers wrote:
> Realloc of size zero is a free not an error, avoid this causing a double
> free. Caught by clang's address sanitizer:
>
> ==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
> #0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
> #1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
> #2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
> #3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
> #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #8 0x564965942e41 in main tools/perf/perf.c:538:3
>
> 0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
> freed by thread T0 here:
> #0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
> #1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
> #2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> #3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #7 0x564965942e41 in main tools/perf/perf.c:538:3
>
> previously allocated by thread T0 here:
> #0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
> #1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
> #2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
> #3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #8 0x564965942e41 in main tools/perf/perf.c:538:3
>
> v2: add a WARN_ON_ONCE when the free condition arises.
>
> Signed-off-by: Ian Rogers <irogers@google.com>
I overlooked v2 for this, sry
Acked-by: Jiri Olsa <jolsa@redhat.com>
thanks,
jirka
> ---
> tools/perf/util/mem2node.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
> index 797d86a1ab09..c84f5841c7ab 100644
> --- a/tools/perf/util/mem2node.c
> +++ b/tools/perf/util/mem2node.c
> @@ -1,5 +1,6 @@
> #include <errno.h>
> #include <inttypes.h>
> +#include <asm/bug.h>
> #include <linux/bitmap.h>
> #include <linux/kernel.h>
> #include <linux/zalloc.h>
> @@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
>
> /* Cut unused entries, due to merging. */
> tmp_entries = realloc(entries, sizeof(*entries) * j);
> - if (tmp_entries)
> + if (tmp_entries || WARN_ON_ONCE(j == 0))
> entries = tmp_entries;
>
> for (i = 0; i < j; i++) {
> --
> 2.25.1.696.g5e7596f4ac-goog
>
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] perf mem2node: avoid double free related to realloc
2020-04-30 8:15 ` Jiri Olsa
@ 2020-04-30 13:23 ` Arnaldo Carvalho de Melo
0 siblings, 0 replies; 6+ messages in thread
From: Arnaldo Carvalho de Melo @ 2020-04-30 13:23 UTC (permalink / raw)
To: Jiri Olsa
Cc: Ian Rogers, Peter Zijlstra, Ingo Molnar, Mark Rutland,
Alexander Shishkin, Namhyung Kim, linux-kernel,
clang-built-linux, Stephane Eranian
Em Thu, Apr 30, 2020 at 10:15:41AM +0200, Jiri Olsa escreveu:
> On Fri, Mar 20, 2020 at 11:23:47AM -0700, Ian Rogers wrote:
> > Realloc of size zero is a free not an error, avoid this causing a double
> > free. Caught by clang's address sanitizer:
> > ==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
> > #0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
> > v2: add a WARN_ON_ONCE when the free condition arises.
> > Signed-off-by: Ian Rogers <irogers@google.com>
> I overlooked v2 for this, sry
> Acked-by: Jiri Olsa <jolsa@redhat.com>
Thanks, applied,
- Arnaldo
^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip: perf/core] perf mem2node: Avoid double free related to realloc
2020-03-20 18:23 [PATCH v2] perf mem2node: avoid double free related to realloc Ian Rogers
2020-04-29 17:40 ` Ian Rogers
2020-04-30 8:15 ` Jiri Olsa
@ 2020-05-08 13:04 ` tip-bot2 for Ian Rogers
2 siblings, 0 replies; 6+ messages in thread
From: tip-bot2 for Ian Rogers @ 2020-05-08 13:04 UTC (permalink / raw)
To: linux-tip-commits
Cc: Ian Rogers, Jiri Olsa, Alexander Shishkin, Mark Rutland,
Namhyung Kim, Peter Zijlstra, Stephane Eranian,
clang-built-linux, Arnaldo Carvalho de Melo, x86, LKML
The following commit has been merged into the perf/core branch of tip:
Commit-ID: 266150c94c69429cf6d18e130237224a047f5061
Gitweb: https://git.kernel.org/tip/266150c94c69429cf6d18e130237224a047f5061
Author: Ian Rogers <irogers@google.com>
AuthorDate: Fri, 20 Mar 2020 11:23:47 -07:00
Committer: Arnaldo Carvalho de Melo <acme@redhat.com>
CommitterDate: Tue, 05 May 2020 16:35:30 -03:00
perf mem2node: Avoid double free related to realloc
Realloc of size zero is a free not an error, avoid this causing a double
free. Caught by clang's address sanitizer:
==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
#0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
#1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
#2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
#3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
#4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#8 0x564965942e41 in main tools/perf/perf.c:538:3
0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
freed by thread T0 here:
#0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
#1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
#2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
#3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#7 0x564965942e41 in main tools/perf/perf.c:538:3
previously allocated by thread T0 here:
#0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
#1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
#2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
#3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
#4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#8 0x564965942e41 in main tools/perf/perf.c:538:3
v2: add a WARN_ON_ONCE when the free condition arises.
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: clang-built-linux@googlegroups.com
Link: http://lore.kernel.org/lkml/20200320182347.87675-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/util/mem2node.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
index 797d86a..c84f584 100644
--- a/tools/perf/util/mem2node.c
+++ b/tools/perf/util/mem2node.c
@@ -1,5 +1,6 @@
#include <errno.h>
#include <inttypes.h>
+#include <asm/bug.h>
#include <linux/bitmap.h>
#include <linux/kernel.h>
#include <linux/zalloc.h>
@@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
/* Cut unused entries, due to merging. */
tmp_entries = realloc(entries, sizeof(*entries) * j);
- if (tmp_entries)
+ if (tmp_entries || WARN_ON_ONCE(j == 0))
entries = tmp_entries;
for (i = 0; i < j; i++) {
^ permalink raw reply related [flat|nested] 6+ messages in thread
end of thread, other threads:[~2020-05-08 13:09 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-20 18:23 [PATCH v2] perf mem2node: avoid double free related to realloc Ian Rogers
2020-04-29 17:40 ` Ian Rogers
2020-04-29 17:45 ` Arnaldo Carvalho de Melo
2020-04-30 8:15 ` Jiri Olsa
2020-04-30 13:23 ` Arnaldo Carvalho de Melo
2020-05-08 13:04 ` [tip: perf/core] perf mem2node: Avoid " tip-bot2 for Ian Rogers
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.