[PATCH] perf parse-events: Avoid free on non malloc-ed memory

From: Ian Rogers <irogers@google.com>
To: Peter Zijlstra <peterz@infradead.org>,
	Ingo Molnar <mingo@redhat.com>,
	Arnaldo Carvalho de Melo <acme@kernel.org>,
	Mark Rutland <mark.rutland@arm.com>,
	Alexander Shishkin <alexander.shishkin@linux.intel.com>,
	Jiri Olsa <jolsa@redhat.com>, Namhyung Kim <namhyung@kernel.org>,
	Adrian Hunter <adrian.hunter@intel.com>,
	Leo Yan <leo.yan@linaro.org>, Jin Yao <yao.jin@linux.intel.com>,
	linux-kernel@vger.kernel.org
Cc: Stephane Eranian <eranian@google.com>, Ian Rogers <irogers@google.com>
Subject: [PATCH] perf parse-events: Avoid free on non malloc-ed memory
Date: Tue, 12 May 2020 16:52:02 -0700	[thread overview]
Message-ID: <20200512235202.7619-1-irogers@google.com> (raw)

Caught by libfuzzer, there is a segfault with:
$ perf stat -e i/bs,tsc,L2/o sleep 1
As a config_term is added that isn't a string.

Fixes: e8dfb81838b1 (perf parse-events: Fix memory leaks found on parse_events)
Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/util/parse-events.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c
index e9464b04f149..e37a6a3e6217 100644
--- a/tools/perf/util/parse-events.c
+++ b/tools/perf/util/parse-events.c
@@ -1480,7 +1480,8 @@ int parse_events_add_pmu(struct parse_events_state *parse_state,
 
 		list_for_each_entry_safe(pos, tmp, &config_terms, list) {
 			list_del_init(&pos->list);
-			zfree(&pos->val.str);
+			if (pos->free_str)
+				zfree(&pos->val.str);
 			free(pos);
 		}
 		return -EINVAL;
-- 
2.26.2.645.ge9eca65c58-goog

