perf probe: Fix possible double free on error

A double free occurred when get source file path failed. If lr->path
failed to assign a new value, it will be freed as the old path and then
be freed again during line_range__clear(), and causes this:

  $ perf probe -L do_execve -k vmlinux
  *** Error in `/usr/bin/perf': double free or corruption (fasttop):
      0x0000000000a9ac50 ***
  ======= Backtrace: =========
  ../lib64/libc.so.6(+0x6eeef)[0x7ffff5e44eef]
  ../lib64/libc.so.6(+0x78cae)[0x7ffff5e4ecae]
  ../lib64/libc.so.6(+0x79987)[0x7ffff5e4f987]
  ../bin/perf[0x4ab41f]
  ...

This patch fix this problem.

Signed-off-by: He Kuang <[email protected]>
Acked-by: Masami Hiramatsu <[email protected]>
Cc: Ingo Molnar <[email protected]>
Cc: Peter Zijlstra <[email protected]>
Cc: Wang Nan <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: Arnaldo Carvalho de Melo <[email protected]>

diff --git a/tools/perf/util/probe-event.c b/tools/perf/util/probe-event.c
index 8af8e7f55254aadb3a2829039ccdf5d64a384a4f..e2bf620f98cb29b6d5cc89010fa0fbdc8ce589bc 100644 (file)
--- a/tools/perf/util/probe-event.c
+++ b/tools/perf/util/probe-event.c
@@ -790,7 +790,11 @@ static int __show_line_range(struct line_range *lr, const char *module,
        /* Convert source file path */
        tmp = lr->path;
        ret = get_real_path(tmp, lr->comp_dir, &lr->path);
-       free(tmp);      /* Free old path */
+
+       /* Free old path when new path is assigned */
+       if (tmp != lr->path)
+               free(tmp);
+
        if (ret < 0) {
                pr_warning("Failed to find source file path.\n");
                return ret;