]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf c2c: Fix use-after-free in he__get_c2c_hists() error path
authorArnaldo Carvalho de Melo <acme@redhat.com>
Sat, 6 Jun 2026 14:19:10 +0000 (11:19 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Sat, 6 Jun 2026 16:44:46 +0000 (13:44 -0300)
commit5e5e6196d737c5be03d20647428316b36621608d
tree30cac78fdb21b28053f8a4c39bc91d0a02aae345
parentafa4363a91a19dff65dceb7fbce7bba689bbc854
perf c2c: Fix use-after-free in he__get_c2c_hists() error path

he__get_c2c_hists() assigns c2c_he->hists before calling
c2c_hists__init().  If init fails, the error path calls free(hists)
but leaves c2c_he->hists pointing to freed memory.  On teardown,
c2c_he_free() finds the non-NULL pointer and calls
hists__delete_entries() on it, causing a use-after-free.

Set c2c_he->hists to NULL before freeing so teardown skips the
already-freed allocation.

Fixes: b2252ae67b687d2b ("perf c2c report: Decode c2c_stats for hist entries")
Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/builtin-c2c.c