From: Steven Rostedt <rostedt@goodmis.org>
To: Totoro W <tw19881113@gmail.com>
Cc: linux-trace-devel@vger.kernel.org
Subject: Re: [PATCH] fix double free issue in event_read_print_args
Date: Fri, 28 Jun 2024 11:35:36 -0400 [thread overview]
Message-ID: <20240628113536.0643fcc7@rorschach.local.home> (raw)
In-Reply-To: <CAFrM9ztDcGK4aP51uJEsQStyyf1tXebOKXiT-Ota2-gT3wVLyA@mail.gmail.com>
On Thu, 27 Jun 2024 14:51:42 +0800
Totoro W <tw19881113@gmail.com> wrote:
> commit cb227dfc63346a23fd019f2146b4f9f4f5a58b6a (HEAD -> fix_double_free)
> Author: Tw <tw19881113@gmail.com>
> Date: Thu Jun 27 14:40:09 2024 +0800
>
> Fix double free issue in event_read_print_args
>
> The corner case is that when we encounter a invalid right argument
> of a condition operation.
> Currently, we free token immediately, but it will also be freed
> when free `arg->op.op`.
>
> BTW, the crash calltrace as follows:
>
> Program received signal SIGSEGV, Segmentation fault.
> get_meta (p=<optimized out>) at
> /home/tw/code/zig/build/stage3/lib/zig/libc/musl/src/malloc/mallocng/meta.h:141
> 141 /home/tw/code/zig/build/stage3/lib/zig/libc/musl/src/malloc/mallocng/meta.h:
> No such file or directory.
> (gdb) bt
> at /home/tw/code/zig/build/stage3/lib/zig/libc/musl/src/malloc/mallocng/meta.h:141
> at /home/tw/code/zig/build/stage3/lib/zig/libc/musl/src/malloc/mallocng/free.c:105
> at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:1128
> list@entry=0x7ff7b18768)
> at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:1417
> at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:3895
> sys=<optimized out>)
> at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:7824
> size=<optimized out>, sys=sys@entry=0x7ff7ff51c0 "kvm")
> at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:7882
> buf=0x7ff7b0c610 "kvm_sys_access", size=549616874800,
> sys=0x7fffffe0b2 "me", sys@entry=0x7ff7ff51c0 "kvm")
> at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:7945
> tracing_dir=tracing_dir@entry=0x7ff7ffc660
> "/sys/kernel/tracing", system=system@entry=0x7ff7ff51c0 "kvm",
> check=false)
> at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1062
> system=0x7ff7ff51c0 "kvm")
> at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1084
> tep=tep@entry=0x7ff7ffc830, sys_names=sys_names@entry=0x0,
> parsing_failures=0x0,
> parsing_failures@entry=0x7fffffe7b0)
> at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1284
> sys_names@entry=0x7ffffff880)
> at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1355
> tracing_dir=0x6500006c6f6f62 <error: Cannot access memory at
> address 0x6500006c6f6f62>)
> at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1377
>
> Signed-off-by: Tw <tw19881113@gmail.com>
It's best to use git sendmail, for sending patches, as it will send them properly.
-- Steve
next prev parent reply other threads:[~2024-06-28 15:35 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-06-27 6:51 [PATCH] fix double free issue in event_read_print_args Totoro W
2024-06-28 15:35 ` Steven Rostedt [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-06-28 1:51 Totoro W
2024-06-28 15:34 ` Steven Rostedt
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240628113536.0643fcc7@rorschach.local.home \
--to=rostedt@goodmis.org \
--cc=linux-trace-devel@vger.kernel.org \
--cc=tw19881113@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.