github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf thread: Free the comm read from procfs

Browse Source 
procfs__read_str() allocates the buffer it hands back and
thread__set_comm() only stores an interned copy of the string, so the
caller owns the buffer. thread__set_comm_from_proc() freed it when the
read came back empty but not once it had been used, leaking it on
every successful call.

Free it on both paths. The empty read still returns -1, err being
untouched in that case.

Found with leak sanitizer while running 'perf trace':

  Direct leak of 7 byte(s) in 1 object(s) allocated from:
      #1 io__getdelim fs/../io.h:179
      #2 filename__read_str fs/fs.c:365
      #3 procfs__read_str fs/fs.c:402
      #4 thread__set_comm_from_proc util/thread.c:297
      #5 syscall_arg__scnprintf_pid trace/beauty/pid.c:15

Assisted-by: Antigravity:gemini-3.1-pro
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Ian Rogers 2026-09-17 23:32:49 -07:00 committed by Arnaldo Carvalho de Melo
parent 0cf5416f48
commit 5d0e31779b
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
tools/perf/util/thread.c
View File

@ -296,12 +296,12 @@ int thread__set_comm_from_proc(struct thread *thread)
thread__pid(thread), thread__tid(thread)) >= (int)sizeof(path)) &&
procfs__read_str(path, &comm, &sz) == 0) {
/* sz==0: read got nothing, e.g. race during exit teardown */
if (sz == 0) {
free(comm);
return -1;
if (sz > 0) {
comm[sz - 1] = '\0';
err = thread__set_comm(thread, comm, 0);
}
comm[sz - 1] = '\0';
err = thread__set_comm(thread, comm, 0);
/* thread__set_comm() copies the string, so release the buffer. */
free(comm);
}
return err;