2024-05-07 15:30:06

by Arnaldo Carvalho de Melo

Subject: [PATCH 1/1] perf probe: Use zfree() to avoid possibly accessing dangling pointers

When freeing a->b it is good practice to set a->b to NULL using
zfree(&a->b) so that when we have a bug where a reference to a freed 'a'
pointer is kept somewhere, we can more quickly cause a segfault if some
code tries to use a->b.

Convert one such case in the 'perf probe' codebase.

Cc: Adrian Hunter <[email protected]>
Cc: Ian Rogers <[email protected]>
Cc: Jiri Olsa <[email protected]>
Cc: Kan Liang <[email protected]>
Cc: Namhyung Kim <[email protected]>
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
---
tools/perf/builtin-probe.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
index 019fef8da6a8e60f..003a3bcebfdfc2d1 100644
--- a/tools/perf/builtin-probe.c
+++ b/tools/perf/builtin-probe.c
@@ -325,7 +325,7 @@ static void cleanup_params(void)
for (i = 0; i < params->nevents; i++)
clear_perf_probe_event(params->events + i);
line_range__clear(&params->line_range);
- free(params->target);
+ zfree(&params->target);
strfilter__delete(params->filter);
nsinfo__put(params->nsi);
zfree(&params);
--
2.44.0

2024-05-09 06:43:37

by Ian Rogers

Subject: Re: [PATCH 1/1] perf probe: Use zfree() to avoid possibly accessing dangling pointers

On Tue, May 7, 2024 at 7:58 AM Arnaldo Carvalho de Melo <[email protected]> wrote:
>
> When freeing a->b it is good practice to set a->b to NULL using
> zfree(&a->b) so that when we have a bug where a reference to a freed 'a'
> pointer is kept somewhere, we can more quickly cause a segfault if some
> code tries to use a->b.
>
> Convert one such case in the 'perf probe' codebase.
>
> Cc: Adrian Hunter <[email protected]>
> Cc: Ian Rogers <[email protected]>
> Cc: Jiri Olsa <[email protected]>
> Cc: Kan Liang <[email protected]>
> Cc: Namhyung Kim <[email protected]>
> Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>
> ---
> tools/perf/builtin-probe.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/perf/builtin-probe.c b/tools/perf/builtin-probe.c
> index 019fef8da6a8e60f..003a3bcebfdfc2d1 100644
> --- a/tools/perf/builtin-probe.c
> +++ b/tools/perf/builtin-probe.c
> @@ -325,7 +325,7 @@ static void cleanup_params(void)
> for (i = 0; i < params->nevents; i++)
> clear_perf_probe_event(params->events + i);
> line_range__clear(&params->line_range);
> - free(params->target);
> + zfree(&params->target);
> strfilter__delete(params->filter);
> nsinfo__put(params->nsi);
> zfree(&params);

The change is fine but params is freed here, so the potential to read
"->target" is small.

Reviewed-by: Ian Rogers <[email protected]>

Thanks,
Ian

> --
> 2.44.0
>