linux-kernel - [tip:perf/urgent] perf annotate: Fix dereferencing freed memory found by the smatch tool

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <tip-600c787dbf6521d8d07ee717ab7606d5070103ea@git.kernel.org>
Date:   Sat, 13 Jul 2019 03:54:34 -0700
From:   tip-bot for Leo Yan <tipbot@...or.com>
To:     linux-tip-commits@...r.kernel.org
Cc:     hpa@...or.com, eric.saint.etienne@...cle.com, davem@...emloft.net,
        linux-kernel@...r.kernel.org, alexander.shishkin@...ux.intel.com,
        mathieu.poirier@...aro.org, songliubraving@...com,
        dave@...olabs.net, mingo@...nel.org, peterz@...radead.org,
        suzuki.poulose@....com, leo.yan@...aro.org, acme@...hat.com,
        adrian.hunter@...el.com, ak@...ux.intel.com, tmricht@...ux.ibm.com,
        khlebnikov@...dex-team.ru, changbin.du@...el.com,
        namhyung@...nel.org, jolsa@...nel.org, alexios.zavras@...el.com,
        tglx@...utronix.de, alexey.budankov@...ux.intel.com,
        linux@...musvillemoes.dk, yao.jin@...ux.intel.com
Subject: [tip:perf/urgent] perf annotate: Fix dereferencing freed memory
 found by the smatch tool

Commit-ID:  600c787dbf6521d8d07ee717ab7606d5070103ea
Gitweb:     https://git.kernel.org/tip/600c787dbf6521d8d07ee717ab7606d5070103ea
Author:     Leo Yan <leo.yan@...aro.org>
AuthorDate: Tue, 2 Jul 2019 18:34:13 +0800
Committer:  Arnaldo Carvalho de Melo <acme@...hat.com>
CommitDate: Tue, 9 Jul 2019 09:33:55 -0300

perf annotate: Fix dereferencing freed memory found by the smatch tool

Based on the following report from Smatch, fix the potential
dereferencing freed memory check.

  tools/perf/util/annotate.c:1125
  disasm_line__parse() error: dereferencing freed memory 'namep'

  tools/perf/util/annotate.c
  1100 static int disasm_line__parse(char *line, const char **namep, char **rawp)
  1101 {
  1102         char tmp, *name = ltrim(line);

  [...]

  1114         *namep = strdup(name);
  1115
  1116         if (*namep == NULL)
  1117                 goto out_free_name;

  [...]

  1124 out_free_name:
  1125         free((void *)namep);
                            ^^^^^
  1126         *namep = NULL;
               ^^^^^^
  1127         return -1;
  1128 }

If strdup() fails to allocate memory space for *namep, we don't need to
free memory with pointer 'namep', which is resident in data structure
disasm_line::ins::name; and *namep is NULL pointer for this failure, so
it's pointless to assign NULL to *namep again.

Committer note:

Freeing namep, which is the address of the first entry of the 'struct
ins' that is the first member of struct disasm_line would in fact free
that disasm_line instance, if it was allocated via malloc/calloc, which,
later, would a dereference of freed memory.

Signed-off-by: Leo Yan <leo.yan@...aro.org>
Acked-by: Jiri Olsa <jolsa@...nel.org>
Cc: Adrian Hunter <adrian.hunter@...el.com>
Cc: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Cc: Alexey Budankov <alexey.budankov@...ux.intel.com>
Cc: Alexios Zavras <alexios.zavras@...el.com>
Cc: Andi Kleen <ak@...ux.intel.com>
Cc: Changbin Du <changbin.du@...el.com>
Cc: David S. Miller <davem@...emloft.net>
Cc: Davidlohr Bueso <dave@...olabs.net>
Cc: Eric Saint-Etienne <eric.saint.etienne@...cle.com>
Cc: Jin Yao <yao.jin@...ux.intel.com>
Cc: Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
Cc: Mathieu Poirier <mathieu.poirier@...aro.org>
Cc: Namhyung Kim <namhyung@...nel.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Rasmus Villemoes <linux@...musvillemoes.dk>
Cc: Song Liu <songliubraving@...com>
Cc: Suzuki Poulouse <suzuki.poulose@....com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Thomas Richter <tmricht@...ux.ibm.com>
Cc: linux-arm-kernel@...ts.infradead.org
Link: http://lkml.kernel.org/r/20190702103420.27540-5-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
---
 tools/perf/util/annotate.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index ec7aaf31c2b2..944a6507a5e3 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1119,16 +1119,14 @@ static int disasm_line__parse(char *line, const char **namep, char **rawp)
 	*namep = strdup(name);
 
 	if (*namep == NULL)
-		goto out_free_name;
+		goto out;
 
 	(*rawp)[0] = tmp;
 	*rawp = skip_spaces(*rawp);
 
 	return 0;
 
-out_free_name:
-	free((void *)namep);
-	*namep = NULL;
+out:
 	return -1;
 }