[PATCH] fix double free issue in event_read_print_args

Totoro W <[email protected]>
Newsgroups org.kernel.vger.linux-trace-devel
Message-ID <CAFrM9ztDcGK4aP51uJEsQStyyf1tXebOKXiT-Ota2-gT3wVLyA@mail.gmail.com>
commit cb227dfc63346a23fd019f2146b4f9f4f5a58b6a (HEAD -> fix_double_free)
Author: Tw <[email protected]>
Date:   Thu Jun 27 14:40:09 2024 +0800

    Fix double free issue in event_read_print_args

    The corner case is that when we encounter a invalid right argument
of a condition operation.
    Currently, we free token immediately, but it will also be freed
when free `arg->op.op`.

    BTW, the crash calltrace as follows:

    Program received signal SIGSEGV, Segmentation fault.
    get_meta (p=<optimized out>) at
/home/tw/code/zig/build/stage3/lib/zig/libc/musl/src/malloc/mallocng/meta.h:141
    141     /home/tw/code/zig/build/stage3/lib/zig/libc/musl/src/malloc/mallocng/meta.h:
No such file or directory.
    (gdb) bt
        at /home/tw/code/zig/build/stage3/lib/zig/libc/musl/src/malloc/mallocng/meta.h:141
        at /home/tw/code/zig/build/stage3/lib/zig/libc/musl/src/malloc/mallocng/free.c:105
        at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:1128
        list@entry=0x7ff7b18768)
        at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:1417
        at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:3895
        sys=<optimized out>)
        at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:7824
        size=<optimized out>, sys=sys@entry=0x7ff7ff51c0 "kvm")
        at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:7882
        buf=0x7ff7b0c610 "kvm_sys_access", size=549616874800,
sys=0x7fffffe0b2 "me", sys@entry=0x7ff7ff51c0 "kvm")
        at /tmp/.cache/zig/p/12207a2e4477bf4414e7df3eb2172c698ab916695a0d3eefbf16f65b0c969dd81184/src/event-parse.c:7945
        tracing_dir=tracing_dir@entry=0x7ff7ffc660
"/sys/kernel/tracing", system=system@entry=0x7ff7ff51c0 "kvm",
        check=false)
        at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1062
        system=0x7ff7ff51c0 "kvm")
        at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1084
        tep=tep@entry=0x7ff7ffc830, sys_names=sys_names@entry=0x0,
parsing_failures=0x0,
        parsing_failures@entry=0x7fffffe7b0)
        at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1284
        sys_names@entry=0x7ffffff880)
        at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1355
        tracing_dir=0x6500006c6f6f62 <error: Cannot access memory at
address 0x6500006c6f6f62>)
        at /tmp/.cache/zig/p/1220c1c006cbf05434d240b65f343c84f3d7f837fbef31f2cade733ec911cc3ed76b/src/tracefs-events.c:1377

    Signed-off-by: Tw <[email protected]>
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.