From mboxrd@z Thu Jan 1 00:00:00 1970 From: Michalis Niarchos Date: Mon, 03 Aug 2026 15:05:41 +0200 Subject: [PATCH v2 2/4] perf tools: Fix double free and memory leak in kvm_events_record() MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Message-Id: <20260803-perf-kvm-fixes-v2-2-1b337189fffc@gmail.com> References: <20260803-perf-kvm-fixes-v2-0-1b337189fffc@gmail.com> In-Reply-To: <20260803-perf-kvm-fixes-v2-0-1b337189fffc@gmail.com> To: Peter Zijlstra , Ingo Molnar , Arnaldo Carvalho de Melo , Namhyung Kim , Mark Rutland , Alexander Shishkin , Jiri Olsa , Ian Rogers , Adrian Hunter , James Clark Cc: linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org, Michalis Niarchos X-Mailer: b4 0.15.2 X-Developer-Signature: v=1; a=ed25519-sha256; t=1785762361; l=2074; i=michael.niarchos@gmail.com; s=20260731; h=from:subject:message-id; bh=O4wX5Z9XY/f99VY/L+7vtzDWIkAT23LI4gDz7eAJLVw=; b=AGVv+jzerEN8qKo06dvufUIJ+fTvE/22TkhBdPTa0G/RDASZSKG8MeBmjIcFKttgr1s72JDVU REleaOY68BmDwHxULGkwN3JCkCBZWEh1tySaV75zcaCZ9Kz7XqibSMu X-Developer-Key: i=michael.niarchos@gmail.com; a=ed25519; pk=/LBZRQzfuxTnSaZhgZE8EP7mHr0poyqlKeFssNqkzFE= X-Endpoint-Received: by B4 Relay for michael.niarchos@gmail.com/20260731 with auth_id=912 List-Id: B4 Relay Submissions cmd_record() reorders the contents of the rec_argv pointer array, so its entry order no longer matches the order in which the caller originally allocated them. Freeing the contents of rec_argv by iterating the reordered array results in some pointers being freed twice and others never freed. All the entries of rec_argv come from literals or pointers that are valid for the lifetime of this call. Reference them directly instead of duplicating to remove the need to individually track and free each entry. Signed-off-by: Michalis Niarchos --- tools/perf/builtin-kvm.c | 15 ++++++--------- 1 file changed, 6 insertions(+), 9 deletions(-) diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c index 44c6998f2ee5..45c92ab74fdd 100644 --- a/tools/perf/builtin-kvm.c +++ b/tools/perf/builtin-kvm.c @@ -1681,18 +1681,18 @@ kvm_events_record(struct perf_kvm_stat *kvm, int argc, const char **argv) return -ENOMEM; for (i = 0; i < ARRAY_SIZE(record_args); i++) - rec_argv[i] = STRDUP_FAIL_EXIT(record_args[i]); + rec_argv[i] = record_args[i]; for (j = 0; j < events_tp_size; j++) { - rec_argv[i++] = STRDUP_FAIL_EXIT("-e"); - rec_argv[i++] = STRDUP_FAIL_EXIT(kvm_events_tp(e_machine)[j]); + rec_argv[i++] = "-e"; + rec_argv[i++] = kvm_events_tp(e_machine)[j]; } - rec_argv[i++] = STRDUP_FAIL_EXIT("-o"); - rec_argv[i++] = STRDUP_FAIL_EXIT(kvm->file_name); + rec_argv[i++] = "-o"; + rec_argv[i++] = kvm->file_name; for (j = 1; j < (unsigned int)argc; j++, i++) - rec_argv[i] = STRDUP_FAIL_EXIT(argv[j]); + rec_argv[i] = argv[j]; set_option_flag(record_options, 'e', "event", PARSE_OPT_HIDDEN); set_option_flag(record_options, 0, "filter", PARSE_OPT_HIDDEN); @@ -1717,9 +1717,6 @@ kvm_events_record(struct perf_kvm_stat *kvm, int argc, const char **argv) record_usage = kvm_stat_record_usage; ret = cmd_record(i, rec_argv); -EXIT: - for (i = 0; i < rec_argc; i++) - free((void *)rec_argv[i]); free(rec_argv); return ret; } -- 2.55.0