[PATCH] perf tools: Fix segfault in cpu_cache_level__read

[PATCH] perf tools: Fix segfault in cpu_cache_level__read

[Jiri Olsa]

We release wrong pointer on error path in
cpu_cache_level__read function, leading to
segfault:

  (gdb) r record ls
  Starting program: /root/perf/tools/perf/perf record ls
  ...
  [ perf record: Woken up 1 times to write data ]
  double free or corruption (out)

  Thread 1 "perf" received signal SIGABRT, Aborted.
  0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
  (gdb) bt
  #0  0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
  #1  0x00007ffff7443bac in abort () from /lib64/power9/libc.so.6
  #2  0x00007ffff74af8bc in __libc_message () from /lib64/power9/libc.so.6
  #3  0x00007ffff74b92b8 in malloc_printerr () from /lib64/power9/libc.so.6
  #4  0x00007ffff74bb874 in _int_free () from /lib64/power9/libc.so.6
  #5  0x0000000010271260 in __zfree (ptr=0x7fffffffa0b0) at ../../lib/zalloc..
  #6  0x0000000010139340 in cpu_cache_level__read (cache=0x7fffffffa090, cac..
  #7  0x0000000010143c90 in build_caches (cntp=0x7fffffffa118, size=<optimiz..
  ...

Releasing the proper pointer.

Link: http://lkml.kernel.org/n/tip-e7js6xoi4y18kydxqehh0ihx@git.kernel.org
Signed-off-by: Jiri Olsa <jolsa@kernel.org>
---
 tools/perf/util/header.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
index b0c34dda30a0..3527b9897b6f 100644
--- a/tools/perf/util/header.c
+++ b/tools/perf/util/header.c
@@ -1081,7 +1081,7 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
 
 	scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path);
 	if (sysfs__read_str(file, &cache->map, &len)) {
-		zfree(&cache->map);
+		zfree(&cache->size);
 		zfree(&cache->type);
 		return -1;
 	}
-- 
2.21.0

Re: [PATCH] perf tools: Fix segfault in cpu_cache_level__read

[Arnaldo Carvalho de Melo]

Em Thu, Sep 12, 2019 at 12:52:35PM +0200, Jiri Olsa escreveu:
> We release wrong pointer on error path in
> cpu_cache_level__read function, leading to
> segfault:
> 
>   (gdb) r record ls
>   Starting program: /root/perf/tools/perf/perf record ls
>   ...
>   [ perf record: Woken up 1 times to write data ]
>   double free or corruption (out)
> 
>   Thread 1 "perf" received signal SIGABRT, Aborted.
>   0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
>   (gdb) bt
>   #0  0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
>   #1  0x00007ffff7443bac in abort () from /lib64/power9/libc.so.6
>   #2  0x00007ffff74af8bc in __libc_message () from /lib64/power9/libc.so.6
>   #3  0x00007ffff74b92b8 in malloc_printerr () from /lib64/power9/libc.so.6
>   #4  0x00007ffff74bb874 in _int_free () from /lib64/power9/libc.so.6
>   #5  0x0000000010271260 in __zfree (ptr=0x7fffffffa0b0) at ../../lib/zalloc..
>   #6  0x0000000010139340 in cpu_cache_level__read (cache=0x7fffffffa090, cac..
>   #7  0x0000000010143c90 in build_caches (cntp=0x7fffffffa118, size=<optimiz..
>   ...
> 
> Releasing the proper pointer.

You forgot to add:

Fixes: 720e98b5faf1 ("perf tools: Add perf data cache feature")
Cc: stable@vger.kernel.org: # v4.6+

I did it, please consider doing it next time,

- Arnaldo
 
> Link: http://lkml.kernel.org/n/tip-e7js6xoi4y18kydxqehh0ihx@git.kernel.org
> Signed-off-by: Jiri Olsa <jolsa@kernel.org>
> ---
>  tools/perf/util/header.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index b0c34dda30a0..3527b9897b6f 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c
> @@ -1081,7 +1081,7 @@ static int cpu_cache_level__read(struct cpu_cache_level *cache, u32 cpu, u16 lev
>  
>  	scnprintf(file, PATH_MAX, "%s/shared_cpu_list", path);
>  	if (sysfs__read_str(file, &cache->map, &len)) {
> -		zfree(&cache->map);
> +		zfree(&cache->size);
>  		zfree(&cache->type);
>  		return -1;
>  	}
> -- 
> 2.21.0

-- 

- Arnaldo

Re: [PATCH] perf tools: Fix segfault in cpu_cache_level__read

[Jiri Olsa]

On Fri, Sep 20, 2019 at 03:20:26PM -0300, Arnaldo Carvalho de Melo wrote:
> Em Thu, Sep 12, 2019 at 12:52:35PM +0200, Jiri Olsa escreveu:
> > We release wrong pointer on error path in
> > cpu_cache_level__read function, leading to
> > segfault:
> > 
> >   (gdb) r record ls
> >   Starting program: /root/perf/tools/perf/perf record ls
> >   ...
> >   [ perf record: Woken up 1 times to write data ]
> >   double free or corruption (out)
> > 
> >   Thread 1 "perf" received signal SIGABRT, Aborted.
> >   0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
> >   (gdb) bt
> >   #0  0x00007ffff7463798 in raise () from /lib64/power9/libc.so.6
> >   #1  0x00007ffff7443bac in abort () from /lib64/power9/libc.so.6
> >   #2  0x00007ffff74af8bc in __libc_message () from /lib64/power9/libc.so.6
> >   #3  0x00007ffff74b92b8 in malloc_printerr () from /lib64/power9/libc.so.6
> >   #4  0x00007ffff74bb874 in _int_free () from /lib64/power9/libc.so.6
> >   #5  0x0000000010271260 in __zfree (ptr=0x7fffffffa0b0) at ../../lib/zalloc..
> >   #6  0x0000000010139340 in cpu_cache_level__read (cache=0x7fffffffa090, cac..
> >   #7  0x0000000010143c90 in build_caches (cntp=0x7fffffffa118, size=<optimiz..
> >   ...
> > 
> > Releasing the proper pointer.
> 
> You forgot to add:
> 
> Fixes: 720e98b5faf1 ("perf tools: Add perf data cache feature")
> Cc: stable@vger.kernel.org: # v4.6+
> 
> I did it, please consider doing it next time,

will do, sry

jirka