trace_event__cleanup() frees t->pevent but never clears the pointer. It can be called twice on the same trace_event: once from trace_report()'s error path, and again from perf_session__delete() during session teardown, resulting in a double free / use-after-free.
Guard against re-entry by returning early if t->pevent is already NULL, and clear it after cleanup so a repeat call is a safe no-op. Signed-off-by: Tanushree Shah <[email protected]> --- tools/perf/util/trace-event.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/perf/util/trace-event.c b/tools/perf/util/trace-event.c index 6a8c66c64b70..cf40e98d1617 100644 --- a/tools/perf/util/trace-event.c +++ b/tools/perf/util/trace-event.c @@ -63,8 +63,12 @@ int trace_event__register_resolver(struct machine *machine, void trace_event__cleanup(struct trace_event *t) { + if (!t->pevent) + return; + tep_unload_plugins(t->plugin_list, t->pevent); tep_free(t->pevent); + t->pevent = NULL; } /* -- 2.47.3
