[PATCH v1 01/26] perf threads: Fix uninitialized pointer put when thread removal misses

[Ian Rogers <irogers@google.com>]

Unlike hashmap_insert(), hashmap_delete() leaves old_key and old_value
untouched when the requested key is not present in the map. In
threads__remove() and threads__remove_all_threads(), old_value was left
uninitialized and passed unconditionally to thread__put() without
checking hashmap__delete()'s return value. If the thread is not present
in the shard, thread__put() dereferences uninitialized stack memory.

Initialize old_value to NULL and only call thread__put() when
hashmap__delete() returns true.

Fixes: 412a2ff473ac ("perf threads: Switch from rbtree to hashmap")
Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/util/threads.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/tools/perf/util/threads.c b/tools/perf/util/threads.c
index 6ca0b178fb6c..98cf7edaf748 100644
--- a/tools/perf/util/threads.c
+++ b/tools/perf/util/threads.c
@@ -142,10 +142,10 @@ void threads__remove_all_threads(struct threads *threads)
 		down_write(&table->lock);
 		__threads_table_entry__set_last_match(table, NULL);
 		hashmap__for_each_entry_safe(&table->shard, cur, tmp, bkt) {
-			struct thread *old_value;
+			struct thread *old_value = NULL;
 
-			hashmap__delete(&table->shard, cur->key, /*old_key=*/NULL, &old_value);
-			thread__put(old_value);
+			if (hashmap__delete(&table->shard, cur->key, /*old_key=*/NULL, &old_value))
+				thread__put(old_value);
 		}
 		up_write(&table->lock);
 	}
@@ -154,14 +154,14 @@ void threads__remove_all_threads(struct threads *threads)
 void threads__remove(struct threads *threads, struct thread *thread)
 {
 	struct threads_table_entry *table  = threads__table(threads, thread__tid(thread));
-	struct thread *old_value;
+	struct thread *old_value = NULL;
 
 	down_write(&table->lock);
 	if (table->last_match && RC_CHK_EQUAL(table->last_match, thread))
 		__threads_table_entry__set_last_match(table, NULL);
 
-	hashmap__delete(&table->shard, thread__tid(thread), /*old_key=*/NULL, &old_value);
-	thread__put(old_value);
+	if (hashmap__delete(&table->shard, thread__tid(thread), /*old_key=*/NULL, &old_value))
+		thread__put(old_value);
 	up_write(&table->lock);
 }
 
-- 
2.56.1.703.gf848ed807c-goog