Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1619847
| From | Jiri Olsa <jolsa@redhat.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field |
| Date | 2017-04-10 13:40 +0200 |
| Message-ID | <tuFPP-8ur-9@gated-at.bofh.it> (permalink) |
| References | <tl6HE-OK-17@gated-at.bofh.it> <tpwka-3HQ-17@gated-at.bofh.it> <tsyps-6A1-15@gated-at.bofh.it> <tuDbk-6MH-19@gated-at.bofh.it> <tuEK5-7QB-19@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Mon, Apr 10, 2017 at 06:21:12PM +0800, Du, Changbin wrote:
> On Mon, Apr 10, 2017 at 10:39:50AM +0200, Jiri Olsa wrote:
> > On Tue, Apr 04, 2017 at 12:19:40PM -0300, Arnaldo Carvalho de Melo wrote:
> >
> > SNIP
> >
> > > > ---
> > > > tools/perf/ui/hist.c | 25 +++++++++++++++----------
> > > > 1 file changed, 15 insertions(+), 10 deletions(-)
> > > >
> > > > diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
> > > > index 5d632dc..f94b301 100644
> > > > --- a/tools/perf/ui/hist.c
> > > > +++ b/tools/perf/ui/hist.c
> > > > @@ -609,20 +609,25 @@ static void fmt_free(struct perf_hpp_fmt *fmt)
> > > >
> > > > void perf_hpp__reset_output_field(struct perf_hpp_list *list)
> > > > {
> > > > - struct perf_hpp_fmt *fmt, *tmp;
> > > > + struct perf_hpp_fmt *field_fmt, *sort_fmt, *tmp1, *tmp2;
> > > >
> > > > /* reset output fields */
> > > > - perf_hpp_list__for_each_format_safe(list, fmt, tmp) {
> > > > - list_del_init(&fmt->list);
> > > > - list_del_init(&fmt->sort_list);
> > > > - fmt_free(fmt);
> > > > + perf_hpp_list__for_each_format_safe(list, field_fmt, tmp1) {
> > > > + list_del_init(&field_fmt->list);
> > > > + /* reset sort keys */
> > > > + perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp2) {
> > > > + if (field_fmt == sort_fmt) {
> > > > + list_del_init(&field_fmt->sort_list);
> > > > + break;
> > > > + }
> > > > + }
> >
> > I agree with Namhyung in here.. seems like the only thing you
> > added is to check if the field_fmt was also linked in as a sort
> > entry before you call list_del_init on it
> >
> This is correct.
>
> > which I think should be also done with list_empty function, but
> > more importantly I dont see a reason for that.. list_del_init
> > call should be fine on empty list
> >
> You didn't catch the problem here. The problem is double free a fmt.
> For exampe, fmt A is linked to both list. Then it will be first free
> by the first iteration over list, then it will be freed again at the
> second iteration over sort_list. This must cause application crash.
the original code takes it out of both lists,
so the next itaration won't go over that entry
jirka
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Arnaldo Carvalho de Melo <acme@kernel.org> - 2017-04-04 17:20 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Namhyung Kim <namhyung@kernel.org> - 2017-04-04 17:40 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Arnaldo Carvalho de Melo <acme@kernel.org> - 2017-04-04 18:00 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field "Du, Changbin" <changbin.du@intel.com> - 2017-04-05 04:50 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Jiri Olsa <jolsa@redhat.com> - 2017-04-09 19:10 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field "Du, Changbin" <changbin.du@intel.com> - 2017-04-10 04:20 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Jiri Olsa <jolsa@redhat.com> - 2017-04-10 10:50 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field "Du, Changbin" <changbin.du@intel.com> - 2017-04-10 12:30 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Jiri Olsa <jolsa@redhat.com> - 2017-04-10 13:40 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field "Du, Changbin" <changbin.du@intel.com> - 2017-04-11 05:10 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Jiri Olsa <jolsa@redhat.com> - 2017-04-11 09:40 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field "Du, Changbin" <changbin.du@intel.com> - 2017-04-11 10:30 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field "Du, Changbin" <changbin.du@intel.com> - 2017-04-11 12:20 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Jiri Olsa <jolsa@redhat.com> - 2017-04-11 12:40 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field "Du, Changbin" <changbin.du@intel.com> - 2017-04-12 04:00 +0200
Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output_field Jiri Olsa <jolsa@redhat.com> - 2017-04-11 12:30 +0200
csiph-web