Subject: [PATCH 04/25] perf annotate: Fix dereferencing freed memory found by the smatch tool

From: Arnaldo Carvalho de Melo <[email-masked]>
Date: Tue, 9 Jul 2019 15:31:05 -0300

From: Leo Yan <[email-masked]>

Based on the following report from Smatch, fix the potential
dereferencing freed memory check.

  tools/perf/util/annotate.c:1125
  disasm_line__parse() error: dereferencing freed memory 'namep'

  tools/perf/util/annotate.c
  1100 static int disasm_line__parse(char *line, const char **namep, char **rawp)
  1101 {
  1102         char tmp, *name = ltrim(line);

  [...]

  1114         *namep = strdup(name);
  1115
  1116         if (*namep == NULL)
  1117                 goto out_free_name;

  [...]

  1124 out_free_name:
  1125         free((void *)namep);
                            ^^^^^
  1126         *namep = NULL;
               ^^^^^^
  1127         return -1;
  1128 }

If strdup() fails to allocate memory space for *namep, we don't need to
free memory with pointer 'namep', which is resident in data structure
disasm_line::ins::name; and *namep is NULL pointer for this failure, so
it's pointless to assign NULL to *namep again.

Committer note:

Freeing namep, which is the address of the first entry of the 'struct
ins' that is the first member of struct disasm_line would in fact free
that disasm_line instance, if it was allocated via malloc/calloc, which,
later, would a dereference of freed memory.

Signed-off-by: Leo Yan <[email-masked]>
Acked-by: Jiri Olsa <[email-masked]>
Cc: Adrian Hunter <[email-masked]>
Cc: Alexander Shishkin <[email-masked]>
Cc: Alexey Budankov <[email-masked]>
Cc: Alexios Zavras <[email-masked]>
Cc: Andi Kleen <[email-masked]>
Cc: Changbin Du <[email-masked]>
Cc: David S. Miller <[email-masked]>
Cc: Davidlohr Bueso <[email-masked]>
Cc: Eric Saint-Etienne <[email-masked]>
Cc: Jin Yao <[email-masked]>
Cc: Konstantin Khlebnikov <[email-masked]>
Cc: Mathieu Poirier <[email-masked]>
Cc: Namhyung Kim <[email-masked]>
Cc: Peter Zijlstra <[email-masked]>
Cc: Rasmus Villemoes <[email-masked]>
Cc: Song Liu <[email-masked]>
Cc: Suzuki Poulouse <[email-masked]>
Cc: Thomas Gleixner <[email-masked]>
Cc: Thomas Richter <[email-masked]>
Cc: [email-masked]
Link: http://lkml.kernel.org/r/[email-masked]
Signed-off-by: Arnaldo Carvalho de Melo <[email-masked]>
---
 tools/perf/util/annotate.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index ec7aaf31c2b2..944a6507a5e3 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1119,16 +1119,14 @@ static int disasm_line__parse(char *line, const char **namep, char **rawp)
 	*namep = strdup(name);
 
 	if (*namep == NULL)
-		goto out_free_name;
+		goto out;
 
 	(*rawp)[0] = tmp;
 	*rawp = skip_spaces(*rawp);
 
 	return 0;
 
-out_free_name:
-	free((void *)namep);
-	*namep = NULL;
+out:
 	return -1;
 }
 
-- 
2.21.0

_______________________________________________
linux-arm-kernel mailing list
[email-masked]
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel