linux-kernel - Re: [PATCH v1 1/2] perf disasm: Fix memory leak for locked operations

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZrvE-CR6ddxjcoDQ@x1>
Date: Tue, 13 Aug 2024 17:41:28 -0300
From: Arnaldo Carvalho de Melo <acme@...nel.org>
To: Ian Rogers <irogers@...gle.com>
Cc: Namhyung Kim <namhyung@...nel.org>,
	Peter Zijlstra <peterz@...radead.org>,
	Ingo Molnar <mingo@...hat.com>, Mark Rutland <mark.rutland@....com>,
	Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
	Jiri Olsa <jolsa@...nel.org>,
	Adrian Hunter <adrian.hunter@...el.com>,
	Kan Liang <kan.liang@...ux.intel.com>,
	Thomas Richter <tmricht@...ux.ibm.com>,
	Kajol Jain <kjain@...ux.ibm.com>,
	Athira Rajeev <atrajeev@...ux.vnet.ibm.com>,
	linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH v1 1/2] perf disasm: Fix memory leak for locked operations

On Tue, Aug 13, 2024 at 12:11:21PM -0700, Ian Rogers wrote:
> On Tue, Aug 13, 2024 at 11:11 AM Arnaldo Carvalho de Melo <acme@...nel.org> wrote:
> > On Tue, Aug 13, 2024 at 09:04:57AM -0700, Ian Rogers wrote:
> > > On Tue, Aug 13, 2024 at 7:53 AM Arnaldo Carvalho de Melo <acme@...nel.org> wrote:
> > > > On Mon, Aug 12, 2024 at 09:06:12PM -0700, Ian Rogers wrote:
> > > > > lock__parse calls disasm_line__parse passing
> > > > > &ops->locked.ins.name. Ensure ops->locked.ins.name is freed in
> > > > > lock__delete.

> > > > > Found with lock/leak sanitizer.

> > > Ooops, I meant address/leak sanitizer.

> > > > Applied both patches to perf-tools-next.

> > > Thanks, could you fix the commit message.

> > Sure,
 
> Also, it'd be good if maybe Namhyung could take a look. I did things
> this way as it made sense to me, but we have nested things going on
> and potentially the free would be more natural in ins_ops__delete.

ins_ops__delete() would have to look it is operating on a lock operation
to access the right member of the unnamed union (locked) to get that
string pointer to free.

lock__delete() is the 'lock' destructor, that knows these details, so
its the right place to do the freeing.

I.e.:

static struct ins_ops lock_ops = {
        .free      = lock__delete,
        .parse     = lock__parse,
        .scnprintf = lock__scnprintf,
};

When it was introduced:

commit c46219ac34f0f365bac700ca6a10ef979c643233
Author: Arnaldo Carvalho de Melo <acme@...hat.com>
Date:   Sat May 12 13:26:20 2012 -0300

    perf annotate: Introduce ->free() method in ins_ops
    
    So that we don't special case disasm_line__free, allowing each
    instruction class to provide a specialized destructor, like is needed
    for 'lock'.

- Arnaldo