| Date | Thu, 2 Nov 2023 10:57:13 -0700 | Subject | [PATCH v4 31/53] perf maps: Get map before returning in maps__find_next_entry | From | Ian Rogers <> |
| |
Finding a map is done under a lock, returning the map without a reference count means it can be removed without notice and causing uses after free. Grab a reference count to the map within the lock region and return this. Fix up locations that need a map__put following this.
Signed-off-by: Ian Rogers <irogers@google.com> --- tools/perf/util/machine.c | 4 +++- tools/perf/util/maps.c | 2 +- 2 files changed, 4 insertions(+), 2 deletions(-)
diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c index d6b3f84cb935..42d73f00f9c1 100644 --- a/tools/perf/util/machine.c +++ b/tools/perf/util/machine.c @@ -1758,8 +1758,10 @@ int machine__create_kernel_maps(struct machine *machine) struct map *next = maps__find_next_entry(machine__kernel_maps(machine), machine__kernel_map(machine)); - if (next) + if (next) { machine__set_kernel_mmap(machine, start, map__start(next)); + map__put(next); + } } out_put: diff --git a/tools/perf/util/maps.c b/tools/perf/util/maps.c index 8a8c1f216b86..b3937e734cbf 100644 --- a/tools/perf/util/maps.c +++ b/tools/perf/util/maps.c @@ -942,7 +942,7 @@ struct map *maps__find_next_entry(struct maps *maps, struct map *map) down_read(maps__lock(maps)); i = maps__by_address_index(maps, map); if (i < maps__nr_maps(maps)) - result = maps__maps_by_address(maps)[i]; // TODO: map__get + result = map__get(maps__maps_by_address(maps)[i]); up_read(maps__lock(maps)); return result; -- 2.42.0.869.gea05f2083d-goog
|