Messages in this thread | | | From | Ian Rogers <> | Date | Sat, 14 Mar 2020 09:54:40 -0700 | Subject | Re: [PATCH] perf parse-events: fix 3 use after frees |
| |
On Sat, Mar 14, 2020 at 6:59 AM Jiri Olsa <jolsa@redhat.com> wrote: > > On Fri, Mar 13, 2020 at 04:02:49PM -0700, Ian Rogers wrote: > > Reproducible with a clang asan build and then running perf test in > > particular 'Parse event definition strings'. > > > > Signed-off-by: Ian Rogers <irogers@google.com> > > --- > > tools/perf/util/parse-events.c | 6 +++--- > > 1 file changed, 3 insertions(+), 3 deletions(-) > > > > diff --git a/tools/perf/util/parse-events.c b/tools/perf/util/parse-events.c > > index a14995835d85..593b6b03785d 100644 > > --- a/tools/perf/util/parse-events.c > > +++ b/tools/perf/util/parse-events.c > > @@ -1449,7 +1449,7 @@ int parse_events_add_pmu(struct parse_events_state *parse_state, > > evsel = __add_event(list, &parse_state->idx, &attr, NULL, pmu, NULL, > > auto_merge_stats, NULL); > > if (evsel) { > > - evsel->pmu_name = name; > > + evsel->pmu_name = name ? strdup(name) : NULL; > > evsel->use_uncore_alias = use_uncore_alias; > > return 0; > > } else { > > @@ -1497,7 +1497,7 @@ int parse_events_add_pmu(struct parse_events_state *parse_state, > > evsel->snapshot = info.snapshot; > > evsel->metric_expr = info.metric_expr; > > evsel->metric_name = info.metric_name; > > - evsel->pmu_name = name; > > + evsel->pmu_name = name ? strdup(name) : NULL; > > so it's pmu->name pointer.. does pmu get destroyed before the evsel? > also should we free that then like below? > > > evsel->use_uncore_alias = use_uncore_alias; > > evsel->percore = config_term_percore(&evsel->config_terms); > > } > > @@ -1547,7 +1547,7 @@ int parse_events_multi_pmu_add(struct parse_events_state *parse_state, > > if (!parse_events_add_pmu(parse_state, list, > > pmu->name, head, > > true, true)) { > > - pr_debug("%s -> %s/%s/\n", config, > > + pr_debug("%s -> %s/%s/\n", str, > > nice catch ;-) > > > pmu->name, alias->str); > > ok++; > > } > > -- > > 2.25.1.481.gfbce0eb801-goog > > > > thanks, > jirka > > > --- > diff --git a/tools/perf/util/evsel.c b/tools/perf/util/evsel.c > index 816d930d774e..15ccd193483f 100644 > --- a/tools/perf/util/evsel.c > +++ b/tools/perf/util/evsel.c > @@ -1287,6 +1287,7 @@ void perf_evsel__exit(struct evsel *evsel) > perf_thread_map__put(evsel->core.threads); > zfree(&evsel->group_name); > zfree(&evsel->name); > + zfree(&evsel->pmu_name); > perf_evsel__object.fini(evsel); > }
Agreed on the zfree! I'll upload a v2 with it. I've tested with address sanitizer in case of double frees, etc. I haven't yet fuzz tested the latest version of parse events, libfuzz detects memory leaks between iterations so I expect there will be future small patches like this coming.
Thanks, Ian
| |