* Re: [PATCH v2] perf mem2node: avoid double free related to realloc
2020-03-20 18:23 [PATCH v2] perf mem2node: avoid double free related to realloc Ian Rogers
@ 2020-04-29 17:40 ` Ian Rogers
2020-04-29 17:45 ` Arnaldo Carvalho de Melo
2020-04-30 8:15 ` Jiri Olsa
2020-05-08 13:04 ` [tip: perf/core] perf mem2node: Avoid " tip-bot2 for Ian Rogers
2 siblings, 1 reply; 6+ messages in thread
From: Ian Rogers @ 2020-04-29 17:40 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Mark Rutland, Alexander Shishkin, Jiri Olsa, Namhyung Kim, LKML,
clang-built-linux
Cc: Stephane Eranian
Ping. This is missing an Acked-by:
v2 addressed Jiri's review comments:
https://lore.kernel.org/lkml/20200315093013.GC492969@krava/
Thanks,
Ian
On Fri, Mar 20, 2020 at 11:23 AM Ian Rogers <irogers@google.com> wrote:
>
> Realloc of size zero is a free not an error, avoid this causing a double
> free. Caught by clang's address sanitizer:
>
> ==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
> #0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
> #1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
> #2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
> #3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
> #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #8 0x564965942e41 in main tools/perf/perf.c:538:3
>
> 0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
> freed by thread T0 here:
> #0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
> #1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
> #2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> #3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #7 0x564965942e41 in main tools/perf/perf.c:538:3
>
> previously allocated by thread T0 here:
> #0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
> #1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
> #2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
> #3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #8 0x564965942e41 in main tools/perf/perf.c:538:3
>
> v2: add a WARN_ON_ONCE when the free condition arises.
>
> Signed-off-by: Ian Rogers <irogers@google.com>
> ---
> tools/perf/util/mem2node.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
> index 797d86a1ab09..c84f5841c7ab 100644
> --- a/tools/perf/util/mem2node.c
> +++ b/tools/perf/util/mem2node.c
> @@ -1,5 +1,6 @@
> #include <errno.h>
> #include <inttypes.h>
> +#include <asm/bug.h>
> #include <linux/bitmap.h>
> #include <linux/kernel.h>
> #include <linux/zalloc.h>
> @@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
>
> /* Cut unused entries, due to merging. */
> tmp_entries = realloc(entries, sizeof(*entries) * j);
> - if (tmp_entries)
> + if (tmp_entries || WARN_ON_ONCE(j == 0))
> entries = tmp_entries;
>
> for (i = 0; i < j; i++) {
> --
> 2.25.1.696.g5e7596f4ac-goog
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2] perf mem2node: avoid double free related to realloc
2020-04-29 17:40 ` Ian Rogers
@ 2020-04-29 17:45 ` Arnaldo Carvalho de Melo
0 siblings, 0 replies; 6+ messages in thread
From: Arnaldo Carvalho de Melo @ 2020-04-29 17:45 UTC (permalink / raw)
To: Ian Rogers
Cc: Peter Zijlstra, Ingo Molnar, Mark Rutland, Alexander Shishkin,
Jiri Olsa, Namhyung Kim, LKML, clang-built-linux,
Stephane Eranian
Em Wed, Apr 29, 2020 at 10:40:06AM -0700, Ian Rogers escreveu:
> Ping. This is missing an Acked-by:
> v2 addressed Jiri's review comments:
> https://lore.kernel.org/lkml/20200315093013.GC492969@krava/
Jiri?
> Thanks,
> Ian
>
>
> On Fri, Mar 20, 2020 at 11:23 AM Ian Rogers <irogers@google.com> wrote:
> >
> > Realloc of size zero is a free not an error, avoid this causing a double
> > free. Caught by clang's address sanitizer:
> >
> > ==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
> > #0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
> > #1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
> > #2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
> > #3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
> > #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> > #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> > #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> > #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> > #8 0x564965942e41 in main tools/perf/perf.c:538:3
> >
> > 0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
> > freed by thread T0 here:
> > #0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
> > #1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
> > #2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> > #3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> > #4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> > #5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> > #6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> > #7 0x564965942e41 in main tools/perf/perf.c:538:3
> >
> > previously allocated by thread T0 here:
> > #0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
> > #1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
> > #2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
> > #3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> > #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> > #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> > #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> > #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> > #8 0x564965942e41 in main tools/perf/perf.c:538:3
> >
> > v2: add a WARN_ON_ONCE when the free condition arises.
> >
> > Signed-off-by: Ian Rogers <irogers@google.com>
> > ---
> > tools/perf/util/mem2node.c | 3 ++-
> > 1 file changed, 2 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
> > index 797d86a1ab09..c84f5841c7ab 100644
> > --- a/tools/perf/util/mem2node.c
> > +++ b/tools/perf/util/mem2node.c
> > @@ -1,5 +1,6 @@
> > #include <errno.h>
> > #include <inttypes.h>
> > +#include <asm/bug.h>
> > #include <linux/bitmap.h>
> > #include <linux/kernel.h>
> > #include <linux/zalloc.h>
> > @@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
> >
> > /* Cut unused entries, due to merging. */
> > tmp_entries = realloc(entries, sizeof(*entries) * j);
> > - if (tmp_entries)
> > + if (tmp_entries || WARN_ON_ONCE(j == 0))
> > entries = tmp_entries;
> >
> > for (i = 0; i < j; i++) {
> > --
> > 2.25.1.696.g5e7596f4ac-goog
> >
--
- Arnaldo
^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [PATCH v2] perf mem2node: avoid double free related to realloc
2020-03-20 18:23 [PATCH v2] perf mem2node: avoid double free related to realloc Ian Rogers
2020-04-29 17:40 ` Ian Rogers
@ 2020-04-30 8:15 ` Jiri Olsa
2020-04-30 13:23 ` Arnaldo Carvalho de Melo
2020-05-08 13:04 ` [tip: perf/core] perf mem2node: Avoid " tip-bot2 for Ian Rogers
2 siblings, 1 reply; 6+ messages in thread
From: Jiri Olsa @ 2020-04-30 8:15 UTC (permalink / raw)
To: Ian Rogers
Cc: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Mark Rutland, Alexander Shishkin, Namhyung Kim, linux-kernel,
clang-built-linux, Stephane Eranian
On Fri, Mar 20, 2020 at 11:23:47AM -0700, Ian Rogers wrote:
> Realloc of size zero is a free not an error, avoid this causing a double
> free. Caught by clang's address sanitizer:
>
> ==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
> #0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
> #1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
> #2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
> #3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
> #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #8 0x564965942e41 in main tools/perf/perf.c:538:3
>
> 0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
> freed by thread T0 here:
> #0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
> #1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
> #2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> #3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #7 0x564965942e41 in main tools/perf/perf.c:538:3
>
> previously allocated by thread T0 here:
> #0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
> #1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
> #2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
> #3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
> #4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
> #5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
> #6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
> #7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
> #8 0x564965942e41 in main tools/perf/perf.c:538:3
>
> v2: add a WARN_ON_ONCE when the free condition arises.
>
> Signed-off-by: Ian Rogers <irogers@google.com>
I overlooked v2 for this, sry
Acked-by: Jiri Olsa <jolsa@redhat.com>
thanks,
jirka
> ---
> tools/perf/util/mem2node.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
> index 797d86a1ab09..c84f5841c7ab 100644
> --- a/tools/perf/util/mem2node.c
> +++ b/tools/perf/util/mem2node.c
> @@ -1,5 +1,6 @@
> #include <errno.h>
> #include <inttypes.h>
> +#include <asm/bug.h>
> #include <linux/bitmap.h>
> #include <linux/kernel.h>
> #include <linux/zalloc.h>
> @@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
>
> /* Cut unused entries, due to merging. */
> tmp_entries = realloc(entries, sizeof(*entries) * j);
> - if (tmp_entries)
> + if (tmp_entries || WARN_ON_ONCE(j == 0))
> entries = tmp_entries;
>
> for (i = 0; i < j; i++) {
> --
> 2.25.1.696.g5e7596f4ac-goog
>
^ permalink raw reply [flat|nested] 6+ messages in thread* Re: [PATCH v2] perf mem2node: avoid double free related to realloc
2020-04-30 8:15 ` Jiri Olsa
@ 2020-04-30 13:23 ` Arnaldo Carvalho de Melo
0 siblings, 0 replies; 6+ messages in thread
From: Arnaldo Carvalho de Melo @ 2020-04-30 13:23 UTC (permalink / raw)
To: Jiri Olsa
Cc: Ian Rogers, Peter Zijlstra, Ingo Molnar, Mark Rutland,
Alexander Shishkin, Namhyung Kim, linux-kernel, clang-built-linux,
Stephane Eranian
Em Thu, Apr 30, 2020 at 10:15:41AM +0200, Jiri Olsa escreveu:
> On Fri, Mar 20, 2020 at 11:23:47AM -0700, Ian Rogers wrote:
> > Realloc of size zero is a free not an error, avoid this causing a double
> > free. Caught by clang's address sanitizer:
> > ==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
> > #0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
> > v2: add a WARN_ON_ONCE when the free condition arises.
> > Signed-off-by: Ian Rogers <irogers@google.com>
> I overlooked v2 for this, sry
> Acked-by: Jiri Olsa <jolsa@redhat.com>
Thanks, applied,
- Arnaldo
^ permalink raw reply [flat|nested] 6+ messages in thread
* [tip: perf/core] perf mem2node: Avoid double free related to realloc
2020-03-20 18:23 [PATCH v2] perf mem2node: avoid double free related to realloc Ian Rogers
2020-04-29 17:40 ` Ian Rogers
2020-04-30 8:15 ` Jiri Olsa
@ 2020-05-08 13:04 ` tip-bot2 for Ian Rogers
2 siblings, 0 replies; 6+ messages in thread
From: tip-bot2 for Ian Rogers @ 2020-05-08 13:04 UTC (permalink / raw)
To: linux-tip-commits
Cc: Ian Rogers, Jiri Olsa, Alexander Shishkin, Mark Rutland,
Namhyung Kim, Peter Zijlstra, Stephane Eranian, clang-built-linux,
Arnaldo Carvalho de Melo, x86, LKML
The following commit has been merged into the perf/core branch of tip:
Commit-ID: 266150c94c69429cf6d18e130237224a047f5061
Gitweb: https://git.kernel.org/tip/266150c94c69429cf6d18e130237224a047f5061
Author: Ian Rogers <irogers@google.com>
AuthorDate: Fri, 20 Mar 2020 11:23:47 -07:00
Committer: Arnaldo Carvalho de Melo <acme@redhat.com>
CommitterDate: Tue, 05 May 2020 16:35:30 -03:00
perf mem2node: Avoid double free related to realloc
Realloc of size zero is a free not an error, avoid this causing a double
free. Caught by clang's address sanitizer:
==2634==ERROR: AddressSanitizer: attempting double-free on 0x6020000015f0 in thread T0:
#0 0x5649659297fd in free llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:123:3
#1 0x5649659e9251 in __zfree tools/lib/zalloc.c:13:2
#2 0x564965c0f92c in mem2node__exit tools/perf/util/mem2node.c:114:2
#3 0x564965a08b4c in perf_c2c__report tools/perf/builtin-c2c.c:2867:2
#4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#8 0x564965942e41 in main tools/perf/perf.c:538:3
0x6020000015f0 is located 0 bytes inside of 1-byte region [0x6020000015f0,0x6020000015f1)
freed by thread T0 here:
#0 0x564965929da3 in realloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:164:3
#1 0x564965c0f55e in mem2node__init tools/perf/util/mem2node.c:97:16
#2 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
#3 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#4 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#5 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#6 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#7 0x564965942e41 in main tools/perf/perf.c:538:3
previously allocated by thread T0 here:
#0 0x564965929c42 in calloc third_party/llvm/llvm-project/compiler-rt/lib/asan/asan_malloc_linux.cpp:154:3
#1 0x5649659e9220 in zalloc tools/lib/zalloc.c:8:9
#2 0x564965c0f32d in mem2node__init tools/perf/util/mem2node.c:61:12
#3 0x564965a08956 in perf_c2c__report tools/perf/builtin-c2c.c:2803:8
#4 0x564965a0616a in cmd_c2c tools/perf/builtin-c2c.c:2989:10
#5 0x564965944348 in run_builtin tools/perf/perf.c:312:11
#6 0x564965943235 in handle_internal_command tools/perf/perf.c:364:8
#7 0x5649659440c4 in run_argv tools/perf/perf.c:408:2
#8 0x564965942e41 in main tools/perf/perf.c:538:3
v2: add a WARN_ON_ONCE when the free condition arises.
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Jiri Olsa <jolsa@redhat.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Stephane Eranian <eranian@google.com>
Cc: clang-built-linux@googlegroups.com
Link: http://lore.kernel.org/lkml/20200320182347.87675-1-irogers@google.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
---
tools/perf/util/mem2node.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/tools/perf/util/mem2node.c b/tools/perf/util/mem2node.c
index 797d86a..c84f584 100644
--- a/tools/perf/util/mem2node.c
+++ b/tools/perf/util/mem2node.c
@@ -1,5 +1,6 @@
#include <errno.h>
#include <inttypes.h>
+#include <asm/bug.h>
#include <linux/bitmap.h>
#include <linux/kernel.h>
#include <linux/zalloc.h>
@@ -95,7 +96,7 @@ int mem2node__init(struct mem2node *map, struct perf_env *env)
/* Cut unused entries, due to merging. */
tmp_entries = realloc(entries, sizeof(*entries) * j);
- if (tmp_entries)
+ if (tmp_entries || WARN_ON_ONCE(j == 0))
entries = tmp_entries;
for (i = 0; i < j; i++) {
^ permalink raw reply related [flat|nested] 6+ messages in thread