releases/4.20.16/perf-ordered_events-fix-crash-in-ordered_events__fre.patch

   1 From ad30af46b10906b05e29bbe63c987f350cd21d1b Mon Sep 17 00:00:00 2001
   2 From: Jiri Olsa <jolsa@kernel.org>
   3 Date: Thu, 17 Jan 2019 12:30:17 +0100
   4 Subject: perf ordered_events: Fix crash in ordered_events__free
   5
   6 [ Upstream commit 99d86c8b88393e29cf07c020585f2c8afbcdd97d ]
   7
   8 Song Liu reported crash in 'perf record':
   9
  10   > #0  0x0000000000500055 in ordered_events(float, long double,...)(...) ()
  11   > #1  0x0000000000500196 in ordered_events.reinit ()
  12   > #2  0x00000000004fe413 in perf_session.process_events ()
  13   > #3  0x0000000000440431 in cmd_record ()
  14   > #4  0x00000000004a439f in run_builtin ()
  15   > #5  0x000000000042b3e5 in main ()"
  16
  17 This can happen when we get out of buffers during event processing.
  18
  19 The subsequent ordered_events__free() call assumes oe->buffer != NULL
  20 and crashes. Add a check to prevent that.
  21
  22 Reported-by: Song Liu <liu.song.a23@gmail.com>
  23 Signed-off-by: Jiri Olsa <jolsa@kernel.org>
  24 Reviewed-by: Song Liu <liu.song.a23@gmail.com>
  25 Tested-by: Song Liu <liu.song.a23@gmail.com>
  26 Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
  27 Cc: Namhyung Kim <namhyung@kernel.org>
  28 Cc: Peter Zijlstra <peterz@infradead.org>
  29 Cc: Stephane Eranian <eranian@google.com>
  30 Link: http://lkml.kernel.org/r/20190117113017.12977-1-jolsa@kernel.org
  31 Fixes: d5ceb62b3654 ("perf ordered_events: Add 'struct ordered_events_buffer' layer")
  32 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
  33 Signed-off-by: Sasha Levin <sashal@kernel.org>
  34 ---
  35  tools/perf/util/ordered-events.c | 6 ++++--
  36  1 file changed, 4 insertions(+), 2 deletions(-)
  37
  38 diff --git a/tools/perf/util/ordered-events.c b/tools/perf/util/ordered-events.c
  39 index 1904e7f6ec84..77126a5fa9b6 100644
  40 --- a/tools/perf/util/ordered-events.c
  41 +++ b/tools/perf/util/ordered-events.c
  42 @@ -359,8 +359,10 @@ void ordered_events__free(struct ordered_events *oe)
  43          * Current buffer might not have all the events allocated
  44          * yet, we need to free only allocated ones ...
  45          */
  46 -       list_del(&oe->buffer->list);
  47 -       ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
  48 +       if (oe->buffer) {
  49 +               list_del(&oe->buffer->list);
  50 +               ordered_events_buffer__free(oe->buffer, oe->buffer_idx, oe);
  51 +       }
  52
  53         /* ... and continue with the rest */
  54         list_for_each_entry_safe(buffer, tmp, &oe->to_free, list) {
  55 --
  56 2.19.1
  57