From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752035AbbCJDgs (ORCPT ); Mon, 9 Mar 2015 23:36:48 -0400 Received: from szxga02-in.huawei.com ([119.145.14.65]:25575 "EHLO szxga02-in.huawei.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751161AbbCJDgr (ORCPT ); Mon, 9 Mar 2015 23:36:47 -0400 Message-ID: <54FE669E.10903@huawei.com> Date: Tue, 10 Mar 2015 11:35:58 +0800 From: He Kuang User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:31.0) Gecko/20100101 Thunderbird/31.3.0 MIME-Version: 1.0 To: Masami Hiramatsu , , , , "namhyung@kernel.org >> Namhyung Kim" CC: , Subject: Re: [PATCH] perf tools: Fix possible double free on error References: <1425463302-1687-1-git-send-email-hekuang@huawei.com> <54F6FEBF.40504@hitachi.com> In-Reply-To: <54F6FEBF.40504@hitachi.com> Content-Type: text/plain; charset="UTF-8"; format=flowed Content-Transfer-Encoding: 7bit X-Originating-IP: [10.110.54.65] X-CFilter-Loop: Reflected Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi, It seems this patch not appeared in any repo, so ping.. On 2015/3/4 20:46, Masami Hiramatsu wrote: > (2015/03/04 19:01), He Kuang wrote: >> A double free occurred when get source file path failed. If lr->path >> failed to assign a new value, it will be freed as the old path and then >> be freed again during line_range__clear(), and causes this: >> >> $ perf probe -L do_execve -k vmlinux >> *** Error in `/usr/bin/perf': double free or corruption (fasttop): >> 0x0000000000a9ac50 *** >> ======= Backtrace: ========= >> ../lib64/libc.so.6(+0x6eeef)[0x7ffff5e44eef] >> ../lib64/libc.so.6(+0x78cae)[0x7ffff5e4ecae] >> ../lib64/libc.so.6(+0x79987)[0x7ffff5e4f987] >> ../bin/perf[0x4ab41f] >> ... >> >> This patch fix this problem. > Good catch! > > Acked-by: Masami Hiramatsu > > Thank you, > >> Signed-off-by: He Kuang >> --- >> tools/perf/util/probe-event.c | 6 +++++- >> 1 file changed, 5 insertions(+), 1 deletion(-) >> >> diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c >> index 919937e..7df30bd 100644 >> --- a/tools/perf/util/probe-event.c >> +++ b/tools/perf/util/probe-event.c >> @@ -650,7 +650,11 @@ static int __show_line_range(struct line_range *lr, const char *module) >> /* Convert source file path */ >> tmp = lr->path; >> ret = get_real_path(tmp, lr->comp_dir, &lr->path); >> - free(tmp); /* Free old path */ >> + >> + /* Free old path when new path is assigned */ >> + if (tmp != lr->path) >> + free(tmp); >> + >> if (ret < 0) { >> pr_warning("Failed to find source file path.\n"); >> return ret; >> >