]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
perf timechart: Fix cat_backtrace() use-after-free on corrupted callchain
authorArnaldo Carvalho de Melo <acme@redhat.com>
Mon, 1 Jun 2026 22:24:42 +0000 (19:24 -0300)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 3 Jun 2026 19:31:04 +0000 (16:31 -0300)
commitfa06520fa0aae5a8e7386c1d6b622c4d8b6a400d
treef643330916de3e603177eddfcbf4b5c0b58af3f8
parent865224bfde78b31be8883302db496ecb3b7919ab
perf timechart: Fix cat_backtrace() use-after-free on corrupted callchain

cat_backtrace() uses open_memstream() to build a backtrace string.
When an invalid callchain context is encountered, zfree(&p) frees
the memstream buffer, then the exit path calls fclose(f), which
flushes to the already-freed buffer — a use-after-free.  The function
then returns a dangling pointer that the caller passes to a handler
and subsequently double-frees.

Fix by replacing the zfree(&p) with a 'corrupted' flag.  At the exit
label, always fclose(f) first (which finalizes the buffer), then
conditionally free it when corrupted.  This ensures the memstream
contract is honored: the buffer remains valid until fclose().

While here, update the machine__resolve failure message to include
file_offset and the event type name, matching the pattern from the
preceding series.  Also update the three legacy power event handlers
under SUPPORT_OLD_POWER_EVENTS to include file_offset in their
out-of-bounds CPU messages for consistency.

Reported-by: sashiko-bot@kernel.org # Running on a local machine
Reviewed-by: Ian Rogers <irogers@google.com>
Assisted-by: Claude:claude-opus-4.6
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/builtin-timechart.c