[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-Id: <20190729190712.439276151@linuxfoundation.org>
Date: Mon, 29 Jul 2019 21:22:38 +0200
From: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
To: linux-kernel@...r.kernel.org
Cc: Greg Kroah-Hartman <gregkh@...uxfoundation.org>,
stable@...r.kernel.org, Leo Yan <leo.yan@...aro.org>,
Jiri Olsa <jolsa@...nel.org>,
Adrian Hunter <adrian.hunter@...el.com>,
Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
Alexey Budankov <alexey.budankov@...ux.intel.com>,
Alexios Zavras <alexios.zavras@...el.com>,
Andi Kleen <ak@...ux.intel.com>,
Changbin Du <changbin.du@...el.com>,
"David S. Miller" <davem@...emloft.net>,
Davidlohr Bueso <dave@...olabs.net>,
Eric Saint-Etienne <eric.saint.etienne@...cle.com>,
Jin Yao <yao.jin@...ux.intel.com>,
Konstantin Khlebnikov <khlebnikov@...dex-team.ru>,
Mathieu Poirier <mathieu.poirier@...aro.org>,
Namhyung Kim <namhyung@...nel.org>,
Peter Zijlstra <peterz@...radead.org>,
Rasmus Villemoes <linux@...musvillemoes.dk>,
Song Liu <songliubraving@...com>,
Suzuki Poulouse <suzuki.poulose@....com>,
Thomas Gleixner <tglx@...utronix.de>,
Thomas Richter <tmricht@...ux.ibm.com>,
linux-arm-kernel@...ts.infradead.org,
Arnaldo Carvalho de Melo <acme@...hat.com>,
Sasha Levin <sashal@...nel.org>
Subject: [PATCH 4.19 071/113] perf annotate: Fix dereferencing freed memory found by the smatch tool
[ Upstream commit 600c787dbf6521d8d07ee717ab7606d5070103ea ]
Based on the following report from Smatch, fix the potential
dereferencing freed memory check.
tools/perf/util/annotate.c:1125
disasm_line__parse() error: dereferencing freed memory 'namep'
tools/perf/util/annotate.c
1100 static int disasm_line__parse(char *line, const char **namep, char **rawp)
1101 {
1102 char tmp, *name = ltrim(line);
[...]
1114 *namep = strdup(name);
1115
1116 if (*namep == NULL)
1117 goto out_free_name;
[...]
1124 out_free_name:
1125 free((void *)namep);
^^^^^
1126 *namep = NULL;
^^^^^^
1127 return -1;
1128 }
If strdup() fails to allocate memory space for *namep, we don't need to
free memory with pointer 'namep', which is resident in data structure
disasm_line::ins::name; and *namep is NULL pointer for this failure, so
it's pointless to assign NULL to *namep again.
Committer note:
Freeing namep, which is the address of the first entry of the 'struct
ins' that is the first member of struct disasm_line would in fact free
that disasm_line instance, if it was allocated via malloc/calloc, which,
later, would a dereference of freed memory.
Signed-off-by: Leo Yan <leo.yan@...aro.org>
Acked-by: Jiri Olsa <jolsa@...nel.org>
Cc: Adrian Hunter <adrian.hunter@...el.com>
Cc: Alexander Shishkin <alexander.shishkin@...ux.intel.com>
Cc: Alexey Budankov <alexey.budankov@...ux.intel.com>
Cc: Alexios Zavras <alexios.zavras@...el.com>
Cc: Andi Kleen <ak@...ux.intel.com>
Cc: Changbin Du <changbin.du@...el.com>
Cc: David S. Miller <davem@...emloft.net>
Cc: Davidlohr Bueso <dave@...olabs.net>
Cc: Eric Saint-Etienne <eric.saint.etienne@...cle.com>
Cc: Jin Yao <yao.jin@...ux.intel.com>
Cc: Konstantin Khlebnikov <khlebnikov@...dex-team.ru>
Cc: Mathieu Poirier <mathieu.poirier@...aro.org>
Cc: Namhyung Kim <namhyung@...nel.org>
Cc: Peter Zijlstra <peterz@...radead.org>
Cc: Rasmus Villemoes <linux@...musvillemoes.dk>
Cc: Song Liu <songliubraving@...com>
Cc: Suzuki Poulouse <suzuki.poulose@....com>
Cc: Thomas Gleixner <tglx@...utronix.de>
Cc: Thomas Richter <tmricht@...ux.ibm.com>
Cc: linux-arm-kernel@...ts.infradead.org
Link: http://lkml.kernel.org/r/20190702103420.27540-5-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@...hat.com>
Signed-off-by: Sasha Levin <sashal@...nel.org>
---
tools/perf/util/annotate.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index c357051dd2b6..daea1fdf7385 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1079,16 +1079,14 @@ static int disasm_line__parse(char *line, const char **namep, char **rawp)
*namep = strdup(name);
if (*namep == NULL)
- goto out_free_name;
+ goto out;
(*rawp)[0] = tmp;
*rawp = ltrim(*rawp);
return 0;
-out_free_name:
- free((void *)namep);
- *namep = NULL;
+out:
return -1;
}
--
2.20.1
Powered by blists - more mailing lists