* [PATCH] perf intel-pt: Free the old snapshot reference array after growing it
@ 2026-11-04 2:19 lirongqing
2026-11-04 9:50 ` Adrian Hunter
0 siblings, 1 reply; 2+ messages in thread
From: lirongqing @ 2026-11-04 2:19 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, Li RongQing,
linux-perf-users, linux-kernel
From: Li RongQing <lirongqing@baidu.com>
Growing snapshot_refs allocates a new array and copies the old entries,
then overwrites the only pointer to the old array. Snapshot recording
with more than sixteen AUX mappings leaks that allocation on expansion.
Free the old array after copying its entries. The reference buffers are
still owned by the entries copied into the replacement array.
Fixes: 90e457f7be08 ("perf tools: Add Intel PT support")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
tools/perf/arch/x86/util/intel-pt.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c
index 5e38b9c..f034e3d 100644
--- a/tools/perf/arch/x86/util/intel-pt.c
+++ b/tools/perf/arch/x86/util/intel-pt.c
@@ -941,6 +941,7 @@ static int intel_pt_alloc_snapshot_refs(struct intel_pt_recording *ptr, int idx)
memcpy(refs, ptr->snapshot_refs, cnt * sz);
+ free(ptr->snapshot_refs);
ptr->snapshot_refs = refs;
ptr->snapshot_ref_cnt = new_cnt;
--
2.9.4
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] perf intel-pt: Free the old snapshot reference array after growing it
2026-11-04 2:19 [PATCH] perf intel-pt: Free the old snapshot reference array after growing it lirongqing
@ 2026-11-04 9:50 ` Adrian Hunter
0 siblings, 0 replies; 2+ messages in thread
From: Adrian Hunter @ 2026-11-04 9:50 UTC (permalink / raw)
To: lirongqing, Peter Zijlstra, Ingo Molnar,
Arnaldo Carvalho de Melo, Namhyung Kim, Mark Rutland,
Alexander Shishkin, Jiri Olsa, Ian Rogers, James Clark,
linux-perf-users, linux-kernel
On 04/11/2026 04:19, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
>
> Growing snapshot_refs allocates a new array and copies the old entries,
> then overwrites the only pointer to the old array. Snapshot recording
> with more than sixteen AUX mappings leaks that allocation on expansion.
>
> Free the old array after copying its entries. The reference buffers are
> still owned by the entries copied into the replacement array.
>
> Fixes: 90e457f7be08 ("perf tools: Add Intel PT support")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
Reviewed-by: Adrian Hunter <adrian.hunter@intel.com>
> ---
> tools/perf/arch/x86/util/intel-pt.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/tools/perf/arch/x86/util/intel-pt.c b/tools/perf/arch/x86/util/intel-pt.c
> index 5e38b9c..f034e3d 100644
> --- a/tools/perf/arch/x86/util/intel-pt.c
> +++ b/tools/perf/arch/x86/util/intel-pt.c
> @@ -941,6 +941,7 @@ static int intel_pt_alloc_snapshot_refs(struct intel_pt_recording *ptr, int idx)
>
> memcpy(refs, ptr->snapshot_refs, cnt * sz);
>
> + free(ptr->snapshot_refs);
> ptr->snapshot_refs = refs;
> ptr->snapshot_ref_cnt = new_cnt;
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-11-04 9:50 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-11-04 2:19 [PATCH] perf intel-pt: Free the old snapshot reference array after growing it lirongqing
2026-11-04 9:50 ` Adrian Hunter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®