Igt-dev Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH] tests/intel/perf_pmu: Fix double free of drpc in test_rc6
@ 2026-09-09  6:29 krishnaveni.palanisamy
  2026-09-09  8:23 ` Anirban, Sk
                   ` (4 more replies)
  0 siblings, 5 replies; 7+ messages in thread
From: krishnaveni.palanisamy @ 2026-09-09  6:29 UTC (permalink / raw)
  To: igt-dev
  Cc: sk.anirban, kamil.konieczny, riana.tauro, anshuman.gupta,
	Krishnaveni Palanisamy

From: Krishnaveni Palanisamy <krishnaveni.palanisamy@intel.com>

test_rc6() frees the 'drpc' buffer returned by igt_sysfs_get() at the
end of each phase (initial wakeup, post-S3, post-idle) but leaves the
pointer dangling. If a subsequent phase is skipped or returns early,
the same pointer could be freed again, resulting in a
"double free detected in tcache" abort from glibc when the test exits.

Set drpc to NULL after each free() so the pointer cannot be reused
accidentally.

Signed-off-by: Krishnaveni Palanisamy <krishnaveni.palanisamy@intel.com>
---
 tests/intel/perf_pmu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/intel/perf_pmu.c b/tests/intel/perf_pmu.c
index 1e389958f..f48e1af57 100644
--- a/tests/intel/perf_pmu.c
+++ b/tests/intel/perf_pmu.c
@@ -1766,6 +1766,7 @@ test_rc6(int gem_fd, unsigned int gt, unsigned int num_gt, unsigned int flags)
 					    ts[1] - ts[0],
 					    tolerance, drpc);
 		free(drpc);
+		drpc=NULL;
 	}
 
 	if (flags & TEST_S3) {
@@ -1806,6 +1807,7 @@ test_rc6(int gem_fd, unsigned int gt, unsigned int num_gt, unsigned int flags)
 					    ts[1] - ts[0],
 					    tolerance, drpc);
 		free(drpc);
+		drpc=NULL;
 	}
 
 	/* Wake up device and check no RC6. */
@@ -1847,6 +1849,7 @@ test_rc6(int gem_fd, unsigned int gt, unsigned int num_gt, unsigned int flags)
 						    ts[1] - ts[0],
 						    tolerance, drpc);
 		free(drpc);
+		drpc=NULL;
 	}
 }
 
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread
* [PATCH] tests/intel/perf_pmu: Fix double free of drpc in test_rc6
@ 2026-09-09  5:52 krishnaveni.palanisamy
  0 siblings, 0 replies; 7+ messages in thread
From: krishnaveni.palanisamy @ 2026-09-09  5:52 UTC (permalink / raw)
  To: igt-dev
  Cc: sk.anirban, kamil.konieczny, riana.tauro, anshuman.gupta,
	Krishnaveni Palanisamy

From: Krishnaveni Palanisamy <krishnaveni.palanisamy@intel.com>

test_rc6() frees the 'drpc' buffer returned by igt_sysfs_get() at the
end of each phase (initial wakeup, post-S3, post-idle) but leaves the
pointer dangling. If a subsequent phase is skipped or returns early,
the same pointer could be freed again, resulting in a
"double free detected in tcache" abort from glibc when the test exits.

Set drpc to NULL after each free() so the pointer cannot be reused
accidentally.

Signed-off-by: Krishnaveni Palanisamy <krishnaveni.palanisamy@intel.com>
---
 tests/intel/perf_pmu.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tests/intel/perf_pmu.c b/tests/intel/perf_pmu.c
index 1e389958f..f48e1af57 100644
--- a/tests/intel/perf_pmu.c
+++ b/tests/intel/perf_pmu.c
@@ -1766,6 +1766,7 @@ test_rc6(int gem_fd, unsigned int gt, unsigned int num_gt, unsigned int flags)
 					    ts[1] - ts[0],
 					    tolerance, drpc);
 		free(drpc);
+		drpc=NULL;
 	}
 
 	if (flags & TEST_S3) {
@@ -1806,6 +1807,7 @@ test_rc6(int gem_fd, unsigned int gt, unsigned int num_gt, unsigned int flags)
 					    ts[1] - ts[0],
 					    tolerance, drpc);
 		free(drpc);
+		drpc=NULL;
 	}
 
 	/* Wake up device and check no RC6. */
@@ -1847,6 +1849,7 @@ test_rc6(int gem_fd, unsigned int gt, unsigned int num_gt, unsigned int flags)
 						    ts[1] - ts[0],
 						    tolerance, drpc);
 		free(drpc);
+		drpc=NULL;
 	}
 }
 
-- 
2.53.0


^ permalink raw reply related	[flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-09-10  1:52 UTC | newest]

Thread overview: 7+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-09-09  6:29 [PATCH] tests/intel/perf_pmu: Fix double free of drpc in test_rc6 krishnaveni.palanisamy
2026-09-09  8:23 ` Anirban, Sk
2026-09-09  9:37 ` ✓ i915.CI.BAT: success for " Patchwork
2026-09-09  9:41 ` ✓ Xe.CI.BAT: " Patchwork
2026-09-09 14:54 ` ✗ Xe.CI.FULL: failure " Patchwork
2026-09-10  1:51 ` ✗ i915.CI.Full: " Patchwork
  -- strict thread matches above, loose matches on Subject: below --
2026-09-09  5:52 [PATCH] " krishnaveni.palanisamy

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox