diff options
| author | Ian Rogers <irogers@google.com> | 2024-02-09 19:17:44 -0800 |
|---|---|---|
| committer | Namhyung Kim <namhyung@kernel.org> | 2024-02-12 12:35:41 -0800 |
| commit | 39a27325e6099e9f9a10d8b5f3b2470a3c10efa5 (patch) | |
| tree | 408c5e465935ca0fa8da2244f6e65ba1c3b42e4b | |
| parent | 107ef66cb054f8d54e336236a31631a8cc167c1f (diff) | |
| download | lwn-39a27325e6099e9f9a10d8b5f3b2470a3c10efa5.tar.gz lwn-39a27325e6099e9f9a10d8b5f3b2470a3c10efa5.zip | |
perf maps: Get map before returning in maps__find_next_entry
Finding a map is done under a lock, returning the map without a
reference count means it can be removed without notice and causing
uses after free. Grab a reference count to the map within the lock
region and return this. Fix up locations that need a map__put
following this.
Signed-off-by: Ian Rogers <irogers@google.com>
Acked-by: Namhyung Kim <namhyung@kernel.org>
Cc: K Prateek Nayak <kprateek.nayak@amd.com>
Cc: James Clark <james.clark@arm.com>
Cc: Vincent Whitchurch <vincent.whitchurch@axis.com>
Cc: Alexey Dobriyan <adobriyan@gmail.com>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: Changbin Du <changbin.du@huawei.com>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Song Liu <song@kernel.org>
Cc: Leo Yan <leo.yan@linux.dev>
Cc: Athira Rajeev <atrajeev@linux.vnet.ibm.com>
Cc: Liam Howlett <liam.howlett@oracle.com>
Cc: Artem Savkov <asavkov@redhat.com>
Cc: bpf@vger.kernel.org
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Link: https://lore.kernel.org/r/20240210031746.4057262-5-irogers@google.com
| -rw-r--r-- | tools/perf/util/machine.c | 4 | ||||
| -rw-r--r-- | tools/perf/util/maps.c | 2 |
2 files changed, 4 insertions, 2 deletions
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c index 7031f6fddcae..4911734411b5 100644 --- a/tools/perf/util/machine.c +++ b/tools/perf/util/machine.c @@ -1761,8 +1761,10 @@ int machine__create_kernel_maps(struct machine *machine) struct map *next = maps__find_next_entry(machine__kernel_maps(machine), machine__kernel_map(machine)); - if (next) + if (next) { machine__set_kernel_mmap(machine, start, map__start(next)); + map__put(next); + } } out_put: diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c index ea8fa684e8c6..df0c8041899e 100644 --- a/tools/perf/util/maps.c +++ b/tools/perf/util/maps.c @@ -962,7 +962,7 @@ struct map *maps__find_next_entry(struct maps *maps, struct map *map) down_read(maps__lock(maps)); i = maps__by_address_index(maps, map); if (i < maps__nr_maps(maps)) - result = maps__maps_by_address(maps)[i]; // TODO: map__get + result = map__get(maps__maps_by_address(maps)[i]); up_read(maps__lock(maps)); return result; |