linux-kernel - [PATCH] perf: double free at function perf_hpp__reset_output

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20170315021631.31980-1-changbin.du@intel.com>
Date:   Wed, 15 Mar 2017 10:16:31 +0800
From:   changbin.du@...el.com
To:     peterz@...radead.org, mingo@...hat.com, acme@...nel.org
Cc:     linux-kernel@...r.kernel.org, Changbin Du <changbin.du@...il.com>,
        Changbin Du <changbin.du@...el.com>
Subject: [PATCH] perf: double free at function perf_hpp__reset_output_field

From: Changbin Du <changbin.du@...il.com>

Some perf_hpp_fmt both registered at field and sort list. For such
instance, we only can free it when removed from the both lists.

Signed-off-by: Changbin Du <changbin.du@...il.com>
Signed-off-by: Changbin Du <changbin.du@...el.com>
---
 tools/perf/ui/hist.c | 25 +++++++++++++++----------
 1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index 5d632dc..f94b301 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -609,20 +609,25 @@ static void fmt_free(struct perf_hpp_fmt *fmt)
 
 void perf_hpp__reset_output_field(struct perf_hpp_list *list)
 {
-	struct perf_hpp_fmt *fmt, *tmp;
+	struct perf_hpp_fmt *field_fmt, *sort_fmt, *tmp1, *tmp2;
 
 	/* reset output fields */
-	perf_hpp_list__for_each_format_safe(list, fmt, tmp) {
-		list_del_init(&fmt->list);
-		list_del_init(&fmt->sort_list);
-		fmt_free(fmt);
+	perf_hpp_list__for_each_format_safe(list, field_fmt, tmp1) {
+		list_del_init(&field_fmt->list);
+		/* reset sort keys */
+		perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp2) {
+			if (field_fmt == sort_fmt) {
+				list_del_init(&field_fmt->sort_list);
+				break;
+			}
+		}
+		fmt_free(field_fmt);
 	}
 
-	/* reset sort keys */
-	perf_hpp_list__for_each_sort_list_safe(list, fmt, tmp) {
-		list_del_init(&fmt->list);
-		list_del_init(&fmt->sort_list);
-		fmt_free(fmt);
+	/* reset remaining sort keys */
+	perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp1) {
+		list_del_init(&sort_fmt->sort_list);
+		fmt_free(sort_fmt);
 	}
 }
 
-- 
2.7.4