github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-10 17:11:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

perf synthetic-events: Fix schedstat event lifetime handling

Browse Source 
perf_event__synthesize_schedstat() has two event lifetime issues.

After a successful iteration, event is freed but retains its value. If
the next iteration starts with an unrecognized schedstat record type,
neither synthesizer assigns a new value. The stale pointer then passes
the NULL check, may be passed to process(), and is freed again.

In addition, when user_requested_cpus filters out a synthesized event,
the continue path skips free(event), leaking the event.

Make event local to each loop iteration so it always starts as NULL.
Also avoid the filter continue and unconditionally free each synthesized
event at the end of the iteration.

Fixes: c3030995f2 ("perf sched stats: Add record and rawdump support")
Reviewed-by: Ian Rogers <irogers@google.com>
Signed-off-by: Hui Su <sh_def@163.com>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
This commit is contained in:
Hui Su 2026-09-12 14:56:19 +09:00 committed by Arnaldo Carvalho de Melo
parent d023b2110d
commit cf3d239189
1 changed files with 7 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
tools/perf/util/synthetic-events.c
View File

@ -2855,7 +2855,6 @@ int perf_event__synthesize_schedstat(const struct perf_tool *tool,
struct perf_cpu_map *user_requested_cpus)
{
char *line = NULL, path[PATH_MAX];
union perf_event *event = NULL;
size_t line_len = 0;
char bf[BUFSIZ];
__u64 timestamp;
@ -2896,6 +2895,7 @@ int perf_event__synthesize_schedstat(const struct perf_tool *tool,
* for filtered out cpus.
*/
for (ch = io__get_char(&io); !io.eof; ch = io__get_char(&io)) {
union perf_event *event = NULL;
struct perf_cpu this_cpu;
if (ch == 'c') {
@ -2910,12 +2910,12 @@ int perf_event__synthesize_schedstat(const struct perf_tool *tool,
this_cpu.cpu = cpu;
if (user_requested_cpus && !perf_cpu_map__has(user_requested_cpus, this_cpu))
continue;
if (process(tool, event, NULL, NULL) < 0) {
free(event);
goto out_free_line;
if (!user_requested_cpus ||
perf_cpu_map__has(user_requested_cpus, this_cpu)) {
if (process(tool, event, NULL, NULL) < 0) {
free(event);
goto out_free_line;
}
}
free(event);