linux-kernel - Re: [PATCH] perf hist: fix memory leak if histogram entry is reused

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20190221162858.GA3940@krava>
Date:   Thu, 21 Feb 2019 17:28:58 +0100
From:   Jiri Olsa <jolsa@...hat.com>
To:     Jonas Rabenstein <jonas.rabenstein@...dium.uni-erlangen.de>
Cc:     linux-perf-users@...r.kernel.org,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Arnaldo Carvalho de Melo <acme@...nel.org>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Namhyung Kim <namhyung@...nel.org>,
        linux-kernel@...r.kernel.org
Subject: Re: [PATCH] perf hist: fix memory leak if histogram entry is reused

On Thu, Feb 21, 2019 at 02:53:20PM +0100, Jonas Rabenstein wrote:
> On Thu, Feb 21, 2019 at 01:39:09PM +0100, Jiri Olsa wrote:
> > On Thu, Feb 21, 2019 at 01:23:06PM +0100, Jonas Rabenstein wrote:
> > > In __hists__add_entry the srcline of the addr_location is duplicated
> > > for the hist_entry. If hists__findnew_entry returns an already existing
> > > hist_entry the srcline has to be freed again as no further reference to
> > > that duplicated srcline would exists anymore.
> > > 
> > > Signed-off-by: Jonas Rabenstein <jonas.rabenstein@...dium.uni-erlangen.de>
> > > ---
> > >  tools/perf/util/hist.c | 3 +++
> > >  1 file changed, 3 insertions(+)
> > > 
> > > diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
> > > index 8aad8330e392..25b8dbdbbe87 100644
> > > --- a/tools/perf/util/hist.c
> > > +++ b/tools/perf/util/hist.c
> > > @@ -623,6 +623,9 @@ __hists__add_entry(struct hists *hists,
> > >  		.ops = ops,
> > >  	}, *he = hists__findnew_entry(hists, &entry, al, sample_self);
> > >  
> > > +	if (he && he->srcline != entry.srcline)
> > > +		free(entry.srcline);
> > > +
> > >  	if (!hists->has_callchains && he && he->callchain_size != 0)
> > >  		hists->has_callchains = true;
> > >  	return he;
> > 
> > nice, do we have similar issue in here?
> > 
> > jirka
> > 
> > 
> > ---
> > diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
> > index 216388003dea..e65e6822c848 100644
> > --- a/tools/perf/util/hist.c
> > +++ b/tools/perf/util/hist.c
> > @@ -966,7 +966,7 @@ iter_add_next_cumulative_entry(struct hist_entry_iter *iter,
> >  			.map = al->map,
> >  			.sym = al->sym,
> >  		},
> > -		.srcline = al->srcline ? strdup(al->srcline) : NULL,
> > +		.srcline = al->srcline,
> While this shouldn't leak the memory, we may end up with an al->srcline
> to get free afterwards while still having a reference on it within the
> hist_entry... Also I could not find where/how the hist_entry is freed up
> so we may get an double free if both of al and he clean the srcline.
> Of course, with your solution we could spare the useless strdup/free if
> we find an hist_entry (which should be the typical case for hotspots..).
> Taking a deeper look thus should be beneficial - but I do not have the
> time for that right now because I'm still working on the inline-symbol
> integration which is more important for me...

ok, I'll check it 

jirka