Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751396AbdCOCTD (ORCPT ); Tue, 14 Mar 2017 22:19:03 -0400 Received: from mga02.intel.com ([134.134.136.20]:35018 "EHLO mga02.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750847AbdCOCTB (ORCPT ); Tue, 14 Mar 2017 22:19:01 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,166,1486454400"; d="scan'208";a="76911793" From: changbin.du@intel.com To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org Cc: linux-kernel@vger.kernel.org, Changbin Du , Changbin Du Subject: [PATCH] perf: double free at function perf_hpp__reset_output_field Date: Wed, 15 Mar 2017 10:16:31 +0800 Message-Id: <20170315021631.31980-1-changbin.du@intel.com> X-Mailer: git-send-email 2.7.4 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1592 Lines: 53 From: Changbin Du Some perf_hpp_fmt both registered at field and sort list. For such instance, we only can free it when removed from the both lists. Signed-off-by: Changbin Du Signed-off-by: Changbin Du --- tools/perf/ui/hist.c | 25 +++++++++++++++---------- 1 file changed, 15 insertions(+), 10 deletions(-) diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c index 5d632dc..f94b301 100644 --- a/tools/perf/ui/hist.c +++ b/tools/perf/ui/hist.c @@ -609,20 +609,25 @@ static void fmt_free(struct perf_hpp_fmt *fmt) void perf_hpp__reset_output_field(struct perf_hpp_list *list) { - struct perf_hpp_fmt *fmt, *tmp; + struct perf_hpp_fmt *field_fmt, *sort_fmt, *tmp1, *tmp2; /* reset output fields */ - perf_hpp_list__for_each_format_safe(list, fmt, tmp) { - list_del_init(&fmt->list); - list_del_init(&fmt->sort_list); - fmt_free(fmt); + perf_hpp_list__for_each_format_safe(list, field_fmt, tmp1) { + list_del_init(&field_fmt->list); + /* reset sort keys */ + perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp2) { + if (field_fmt == sort_fmt) { + list_del_init(&field_fmt->sort_list); + break; + } + } + fmt_free(field_fmt); } - /* reset sort keys */ - perf_hpp_list__for_each_sort_list_safe(list, fmt, tmp) { - list_del_init(&fmt->list); - list_del_init(&fmt->sort_list); - fmt_free(fmt); + /* reset remaining sort keys */ + perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp1) { + list_del_init(&sort_fmt->sort_list); + fmt_free(sort_fmt); } } -- 2.7.4