linux-kernel - Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 5 Apr 2017 10:44:22 +0800
From:   "Du, Changbin" <changbin.du@...el.com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:     Namhyung Kim <namhyung@...nel.org>, Jiri Olsa <jolsa@...nel.org>,
        changbin.du@...el.com, Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH v2] perf: fix double free at function
 perf_hpp__reset_output_field

On Tue, Apr 04, 2017 at 12:51:03PM -0300, Arnaldo Carvalho de Melo wrote:
> Em Wed, Apr 05, 2017 at 12:34:59AM +0900, Namhyung Kim escreveu:
> > Hi Arnaldo,
> > 
> > On Wed, Apr 5, 2017 at 12:19 AM, Arnaldo Carvalho de Melo
> > <acme@...nel.org> wrote:
> > > Em Mon, Mar 27, 2017 at 02:22:55PM +0800, changbin.du@...el.com escreveu:
> > >> From: Changbin Du <changbin.du@...el.com>
> > >>
> > >> Some perf_hpp_fmt both registered at field and sort list. For such
> > >> instance, we only can free it when removed from the both lists. This
> > >> function currently only used by self-test code, but still should fix
> > >> it.
> > >
> > > Looks sane, applying,
> > >
> > > Jiri, Namhyung, please holler (or ack) if needed,
> > 
> > Did you actually see the double free problem?  AFAICS the old code
> 
> I assumed that he had seen it, in some self-test code, Changbin, can you
> please show command output or further describe when this patch would be
> necessary?
> 
Arnaldo, I did observe this issue but not in self-test code. The self-test code
uses that function but does not have a case that a fmt linked to two both list. 
I found this issue when I try to add 'dynamic sort' feature to perf, which
I use this function to reset out fields.

Anyway, it is clear that this is a real bug, a potential issue need to fix.

> - Arnaldo
> 
> > removed a fmt from both list before free it.  In the first loop, fmt that
> > was linked to both output list and sort list will be remove.  And the
> > second loop frees fmt that was linked only to the sort list (IOW, it
> > frees fmt that was not freed in the first loop).
> >
This is right. It is to handle the fmts that linked to both two lists.

> > Thanks,
> > Namhyung
> > 
> > 
> > >
> > > - Arnaldo
> > >

-- 
Thanks,
Changbin Du

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)