• W
    fix use-after-free in perf_sched__lat · 4caf6d28
    Wei Li 提交于
    hulk inclusion
    category: bugfix
    bugzilla: 14378
    CVE: NA
    
    -------------------------------------------------
    
    After thread is added to machine->threads[i].dead in
    __machine__remove_thread, the machine->threads[i].dead is freed
    when calling free(session) in perf_session__delete(). So it get a
    Segmentation fault when accessing it in thread__put().
    
    In this patch, we delay the perf_session__delete until all threads
    have been deleted.
    
    This can be reproduced by following steps:
    	ulimit -c unlimited
    	export MALLOC_MMAP_THRESHOLD_=0
    	perf sched record sleep 10
    	perf sched latency --sort max
    	Segmentation fault (core dumped)
    Signed-off-by: NZhipeng Xie <xiezhipeng1@huawei.com>
    Signed-off-by: NWei Li <liwei391@huawei.com>
    Reviewed-by: NCheng Jian <cj.chengjian@huawei.com>
    Signed-off-by: NYang Yingliang <yangyingliang@huawei.com>
    4caf6d28
builtin-sched.c 87.8 KB