Skip to content

Commit

Permalink
convert: Fix double free of env.
Browse files Browse the repository at this point in the history
*** Error in `./perf-prof': double free or corruption (!prev): 0x0000000001691040 ***

(gdb) bt
 #0  0x00007fc6f717d3a7 in __GI_raise (sig=sig@entry=6) at ../nptl/sysdeps/unix/sysv/linux/raise.c:55
 #1  0x00007fc6f717ea98 in __GI_abort () at abort.c:90
 #2  0x00007fc6f71bfef7 in __libc_message (do_abort=do_abort@entry=2, fmt=fmt@entry=0x7fc6f72d2418 "*** Error in `%s': %s: 0x%s ***\n")
    at ../sysdeps/unix/sysv/linux/libc_fatal.c:196
 #3  0x00007fc6f71c86e9 in malloc_printerr (ar_ptr=0x7fc6f750f760 <main_arena>, ptr=<optimized out>, str=0x7fc6f72d2540 "double free or corruption (!prev)", action=3)
    at malloc.c:4967
 #4  _int_free (av=0x7fc6f750f760 <main_arena>, p=<optimized out>, have_lock=0) at malloc.c:3843
 #5  0x000000000041b3bb in perf_timespec_init (dev=dev@entry=0x169cec0) at convert.c:375
 #6  0x0000000000412cc4 in prof_dev_enable (dev=dev@entry=0x169cec0) at monitor.c:1820

(gdb) f 5
 #5  0x000000000041b3bb in perf_timespec_init (dev=dev@entry=0x169cec0) at convert.c:375

(gdb) info locals
 evlist = <optimized out>
 map = <optimized out>
 tidmap = 0x16686b0
 e = 0x1691040  ==> double free
 evt = 0x0

When prof_dev_open_cpu_thread_map() returns NULL, env has been freed.

Signed-off-by: duanery <corcpp@foxmail.com>
  • Loading branch information
duanery committed Mar 18, 2024
1 parent c06ad17 commit 5ab423d
Showing 1 changed file with 2 additions and 4 deletions.
6 changes: 2 additions & 4 deletions convert.c
Original file line number Diff line number Diff line change
Expand Up @@ -354,9 +354,9 @@ int perf_timespec_init(struct prof_dev *dev)
e->tsc_offset = dev->env->tsc_offset;

evt = prof_dev_open_cpu_thread_map(&evtime, e, NULL, tidmap, NULL);
if (!evt) goto NULL_evrt;

e = NULL;
if (!evt) goto NULL_e;

evt->private = dev;

// trigger getpid syscall
Expand All @@ -371,8 +371,6 @@ int perf_timespec_init(struct prof_dev *dev)
dev->time_ctx.base_timespec.tv_nsec = 0;
}

NULL_evrt:
if (e) free(e);
NULL_e:
perf_thread_map__put(tidmap);
NULL_tidmap:
Expand Down

0 comments on commit 5ab423d

Please sign in to comment.