[PATCH] perf: double free at function perf_hpp__reset_output_field

From: changbin . du
Date: Tue Mar 14 2017 - 22:19:06 EST


From: Changbin Du <changbin.du@xxxxxxxxx>

Some perf_hpp_fmt both registered at field and sort list. For such
instance, we only can free it when removed from the both lists.

Signed-off-by: Changbin Du <changbin.du@xxxxxxxxx>
Signed-off-by: Changbin Du <changbin.du@xxxxxxxxx>
---
tools/perf/ui/hist.c | 25 +++++++++++++++----------
1 file changed, 15 insertions(+), 10 deletions(-)

diff --git a/tools/perf/ui/hist.c b/tools/perf/ui/hist.c
index 5d632dc..f94b301 100644
--- a/tools/perf/ui/hist.c
+++ b/tools/perf/ui/hist.c
@@ -609,20 +609,25 @@ static void fmt_free(struct perf_hpp_fmt *fmt)

void perf_hpp__reset_output_field(struct perf_hpp_list *list)
{
- struct perf_hpp_fmt *fmt, *tmp;
+ struct perf_hpp_fmt *field_fmt, *sort_fmt, *tmp1, *tmp2;

/* reset output fields */
- perf_hpp_list__for_each_format_safe(list, fmt, tmp) {
- list_del_init(&fmt->list);
- list_del_init(&fmt->sort_list);
- fmt_free(fmt);
+ perf_hpp_list__for_each_format_safe(list, field_fmt, tmp1) {
+ list_del_init(&field_fmt->list);
+ /* reset sort keys */
+ perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp2) {
+ if (field_fmt == sort_fmt) {
+ list_del_init(&field_fmt->sort_list);
+ break;
+ }
+ }
+ fmt_free(field_fmt);
}

- /* reset sort keys */
- perf_hpp_list__for_each_sort_list_safe(list, fmt, tmp) {
- list_del_init(&fmt->list);
- list_del_init(&fmt->sort_list);
- fmt_free(fmt);
+ /* reset remaining sort keys */
+ perf_hpp_list__for_each_sort_list_safe(list, sort_fmt, tmp1) {
+ list_del_init(&sort_fmt->sort_list);
+ fmt_free(sort_fmt);
}
}

--
2.7.4