Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1600996 > unrolled thread

[PATCH] perf: double free at function perf_hpp__reset_output_field

Back to article view | Back to linux.kernel

Contents

  [PATCH] perf: double free at function perf_hpp__reset_output_field changbin.du@intel.com - 2017-03-15 03:20 +0100
    [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field changbin.du@intel.com - 2017-03-27 08:30 +0200

#1600996 — [PATCH] perf: double free at function perf_hpp__reset_output_field

From: Changbin Du <changbin.du@gmail.com>

Some perf_hpp_fmt both registered at field and sort list. For such
instance, we only can free it when removed from the both lists.

Signed-off-by: Changbin Du <changbin.du@gmail.com>
Signed-off-by: Changbin Du <changbin.du@intel.com>
---
 tools/perf/ui/hist.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index 5d632dc..f94b301 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -609,20 +609,25 @@ static void fmt_free(struct perf_hpp_fmt *fmt)
 
 void perf_hpp__reset_output_field(struct perf_hpp_list *list)
 {
-	struct perf_hpp_fmt *fmt, *tmp;
+	struct perf_hpp_fmt *field_fmt, *sort_fmt, *tmp1, *tmp2;
 
 	/* reset output fields */
-	perf_hpp_list__for_each_format_safe(list, fmt, tmp) {
-		list_del_init(&fmt->list);
-		list_del_init(&fmt->sort_list);
-		fmt_free(fmt);
+	perf_hpp_list__for_each_format_safe(list, field_fmt, tmp1) {
+		list_del_init(&field_fmt->list);
+		/* reset sort keys */
+		perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp2) {
+			if (field_fmt == sort_fmt) {
+				list_del_init(&field_fmt->sort_list);
+				break;
+			}
+		}
+		fmt_free(field_fmt);
 	}
 
-	/* reset sort keys */
-	perf_hpp_list__for_each_sort_list_safe(list, fmt, tmp) {
-		list_del_init(&fmt->list);
-		list_del_init(&fmt->sort_list);
-		fmt_free(fmt);
+	/* reset remaining sort keys */
+	perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp1) {
+		list_del_init(&sort_fmt->sort_list);
+		fmt_free(sort_fmt);
 	}
 }
 
-- 
2.7.4

[toc] | [next] | [standalone]

#1609494 — [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field

From: Changbin Du <changbin.du@intel.com>

Some perf_hpp_fmt both registered at field and sort list. For such
instance, we only can free it when removed from the both lists. This
function currently only used by self-test code, but still should fix
it.

Signed-off-by: Changbin Du <changbin.du@intel.com>
---
v2: removed redundant Signed-off.

---
 tools/perf/ui/hist.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index 5d632dc..f94b301 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -609,20 +609,25 @@ static void fmt_free(struct perf_hpp_fmt *fmt)
 
 void perf_hpp__reset_output_field(struct perf_hpp_list *list)
 {
-	struct perf_hpp_fmt *fmt, *tmp;
+	struct perf_hpp_fmt *field_fmt, *sort_fmt, *tmp1, *tmp2;
 
 	/* reset output fields */
-	perf_hpp_list__for_each_format_safe(list, fmt, tmp) {
-		list_del_init(&fmt->list);
-		list_del_init(&fmt->sort_list);
-		fmt_free(fmt);
+	perf_hpp_list__for_each_format_safe(list, field_fmt, tmp1) {
+		list_del_init(&field_fmt->list);
+		/* reset sort keys */
+		perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp2) {
+			if (field_fmt == sort_fmt) {
+				list_del_init(&field_fmt->sort_list);
+				break;
+			}
+		}
+		fmt_free(field_fmt);
 	}
 
-	/* reset sort keys */
-	perf_hpp_list__for_each_sort_list_safe(list, fmt, tmp) {
-		list_del_init(&fmt->list);
-		list_del_init(&fmt->sort_list);
-		fmt_free(fmt);
+	/* reset remaining sort keys */
+	perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp1) {
+		list_del_init(&sort_fmt->sort_list);
+		fmt_free(sort_fmt);
 	}
 }
 
-- 
2.7.4

[toc] | [prev] | [standalone]

Back to top | Article view | linux.kernel

csiph-web