[PATCH 4.19 071/113] perf annotate: Fix dereferencing freed memory found by the smatch tool - Greg Kroah-Hartman

From: Greg Kroah-Hartman <gregkh@linuxfoundation•org>
To: linux-kernel@vger•kernel.org
Cc: Song Liu <songliubraving@fb•com>,
	Konstantin Khlebnikov <khlebnikov@yandex-team•ru>,
	Rasmus Villemoes <linux@rasmusvillemoes•dk>,
	Jin Yao <yao.jin@linux•intel.com>,
	Sasha Levin <sashal@kernel•org>, Andi Kleen <ak@linux•intel.com>,
	Alexey Budankov <alexey.budankov@linux•intel.com>,
	Alexander Shishkin <alexander.shishkin@linux•intel.com>,
	Suzuki Poulouse <suzuki.poulose@arm•com>,
	Arnaldo Carvalho de Melo <acme@redhat•com>,
	Alexios Zavras <alexios.zavras@intel•com>,
	Davidlohr Bueso <dave@stgolabs•net>,
	Namhyung Kim <namhyung@kernel•org>,
	Thomas Gleixner <tglx@linutronix•de>,
	linux-arm-kernel@lists•infradead.org,
	Mathieu Poirier <mathieu.poirier@linaro•org>,
	Greg Kroah-Hartman <gregkh@linuxfoundation•org>,
	Thomas Richter <tmricht@linux•ibm.com>,
	Adrian Hunter <adrian.hunter@intel•com>,
	stable@vger•kernel.org, "David S. Miller" <davem@davemloft•net>,
	Changbin Du <changbin.du@intel•com>,
	Peter Zijlstra <peterz@infradead•org>,
	Jiri Olsa <jolsa@kernel•org>, Leo Yan <leo.yan@linaro•org>,
	Eric Saint-Etienne <eric.saint.etienne@oracle•com>
Subject: [PATCH 4.19 071/113] perf annotate: Fix dereferencing freed memory found by the smatch tool
Date: Mon, 29 Jul 2019 21:22:38 +0200	[thread overview]
Message-ID: <20190729190712.439276151@linuxfoundation.org> (raw)
In-Reply-To: <20190729190655.455345569@linuxfoundation.org>

[ Upstream commit 600c787dbf6521d8d07ee717ab7606d5070103ea ]

Based on the following report from Smatch, fix the potential
dereferencing freed memory check.

  tools/perf/util/annotate.c:1125
  disasm_line__parse() error: dereferencing freed memory 'namep'

  tools/perf/util/annotate.c
  1100 static int disasm_line__parse(char *line, const char **namep, char **rawp)
  1101 {
  1102         char tmp, *name = ltrim(line);

  [...]

  1114         *namep = strdup(name);
  1115
  1116         if (*namep == NULL)
  1117                 goto out_free_name;

  [...]

  1124 out_free_name:
  1125         free((void *)namep);
                            ^^^^^
  1126         *namep = NULL;
               ^^^^^^
  1127         return -1;
  1128 }

If strdup() fails to allocate memory space for *namep, we don't need to
free memory with pointer 'namep', which is resident in data structure
disasm_line::ins::name; and *namep is NULL pointer for this failure, so
it's pointless to assign NULL to *namep again.

Committer note:

Freeing namep, which is the address of the first entry of the 'struct
ins' that is the first member of struct disasm_line would in fact free
that disasm_line instance, if it was allocated via malloc/calloc, which,
later, would a dereference of freed memory.

Signed-off-by: Leo Yan <leo.yan@linaro•org>
Acked-by: Jiri Olsa <jolsa@kernel•org>
Cc: Adrian Hunter <adrian.hunter@intel•com>
Cc: Alexander Shishkin <alexander.shishkin@linux•intel.com>
Cc: Alexey Budankov <alexey.budankov@linux•intel.com>
Cc: Alexios Zavras <alexios.zavras@intel•com>
Cc: Andi Kleen <ak@linux•intel.com>
Cc: Changbin Du <changbin.du@intel•com>
Cc: David S. Miller <davem@davemloft•net>
Cc: Davidlohr Bueso <dave@stgolabs•net>
Cc: Eric Saint-Etienne <eric.saint.etienne@oracle•com>
Cc: Jin Yao <yao.jin@linux•intel.com>
Cc: Konstantin Khlebnikov <khlebnikov@yandex-team•ru>
Cc: Mathieu Poirier <mathieu.poirier@linaro•org>
Cc: Namhyung Kim <namhyung@kernel•org>
Cc: Peter Zijlstra <peterz@infradead•org>
Cc: Rasmus Villemoes <linux@rasmusvillemoes•dk>
Cc: Song Liu <songliubraving@fb•com>
Cc: Suzuki Poulouse <suzuki.poulose@arm•com>
Cc: Thomas Gleixner <tglx@linutronix•de>
Cc: Thomas Richter <tmricht@linux•ibm.com>
Cc: linux-arm-kernel@lists•infradead.org
Link: http://lkml.kernel.org/r/20190702103420.27540-5-leo.yan@linaro.org
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat•com>
Signed-off-by: Sasha Levin <sashal@kernel•org>
---
 tools/perf/util/annotate.c | 6 ++----
 1 file changed, 2 insertions(+), 4 deletions(-)

diff --git a/tools/perf/util/annotate.c b/tools/perf/util/annotate.c
index c357051dd2b6..daea1fdf7385 100644
--- a/tools/perf/util/annotate.c
+++ b/tools/perf/util/annotate.c
@@ -1079,16 +1079,14 @@ static int disasm_line__parse(char *line, const char **namep, char **rawp)
 	*namep = strdup(name);
 
 	if (*namep == NULL)
-		goto out_free_name;
+		goto out;
 
 	(*rawp)[0] = tmp;
 	*rawp = ltrim(*rawp);
 
 	return 0;
 
-out_free_name:
-	free((void *)namep);
-	*namep = NULL;
+out:
 	return -1;
 }
 
-- 
2.20.1




_______________________________________________
linux-arm-kernel mailing list
linux-arm-kernel@lists•infradead.org
http://lists.infradead.org/mailman/listinfo/linux-arm-kernel
