linux-kernel - Re: [PATCH v2] perf: fix double free at function perf_hpp__reset_output

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 Apr 2017 18:21:12 +0800
From:   "Du, Changbin" <changbin.du@...el.com>
To:     Jiri Olsa <jolsa@...hat.com>
Cc:     Arnaldo Carvalho de Melo <acme@...nel.org>,
        Namhyung Kim <namhyung@...nel.org>,
        Jiri Olsa <jolsa@...nel.org>, changbin.du@...el.com,
        peterz@...radead.org, mingo@...hat.com,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH v2] perf: fix double free at function
 perf_hpp__reset_output_field

On Mon, Apr 10, 2017 at 10:39:50AM +0200, Jiri Olsa wrote:
> On Tue, Apr 04, 2017 at 12:19:40PM -0300, Arnaldo Carvalho de Melo wrote:
> 
> SNIP
> 
> > > ---
> > >  tools/perf/ui/hist.c | 25 +++++++++++++++----------
> > >  1 file changed, 15 insertions(+), 10 deletions(-)
> > > 
> > > diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
> > > index 5d632dc..f94b301 100644
> > > --- a/tools/perf/ui/hist.c
> > > +++ b/tools/perf/ui/hist.c
> > > @@ -609,20 +609,25 @@ static void fmt_free(struct perf_hpp_fmt *fmt)
> > >  
> > >  void perf_hpp__reset_output_field(struct perf_hpp_list *list)
> > >  {
> > > -	struct perf_hpp_fmt *fmt, *tmp;
> > > +	struct perf_hpp_fmt *field_fmt, *sort_fmt, *tmp1, *tmp2;
> > >  
> > >  	/* reset output fields */
> > > -	perf_hpp_list__for_each_format_safe(list, fmt, tmp) {
> > > -		list_del_init(&fmt->list);
> > > -		list_del_init(&fmt->sort_list);
> > > -		fmt_free(fmt);
> > > +	perf_hpp_list__for_each_format_safe(list, field_fmt, tmp1) {
> > > +		list_del_init(&field_fmt->list);
> > > +		/* reset sort keys */
> > > +		perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp2) {
> > > +			if (field_fmt == sort_fmt) {
> > > +				list_del_init(&field_fmt->sort_list);
> > > +				break;
> > > +			}
> > > +		}
> 
> I agree with Namhyung in here.. seems like the only thing you
> added is to check if the field_fmt was also linked in as a sort
> entry before you call list_del_init on it
>
This is correct.

> which I think should be also done with list_empty function, but
> more importantly I dont see a reason for that.. list_del_init
> call should be fine on empty list
> 
You didn't catch the problem here. The problem is double free a fmt.
For exampe, fmt A is linked to both list. Then it will be first free
by the first iteration over list, then it will be freed again at the
second iteration over sort_list. This must cause application crash.

> please describe the issue in more details, perhaps we'ew missing
> something
> 
> jirka

-- 
Thanks,
Changbin Du

Download attachment "signature.asc" of type "application/pgp-signature" (474 bytes)