perf map: Fix double 'struct map' reference free found with -DREFCNT_CHECKING=1

When quitting after running a 'perf report', the refcount checker finds
some double frees. The issue is that map__put() is called on a function
argument so it removes the refcount wrapper that someone else was using.

Fix it by only calling map__put() on a reference that is owned by this
function.

Committer notes:

Narrowed the map_ref scope as suggested by Ian, removed the symbol-elf
part as it was already fixed by another patch, from Ian.

Signed-off-by: James Clark <james.clark@arm.com>
Acked-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: https://lore.kernel.org/r/20230612150424.198914-1-james.clark@arm.com
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

diff --git a/tools/perf/util/symbol.c b/tools/perf/util/symbol.c
index 6b9c55784b56a4be3db2a79680f235ee293ce568..d275d3bef7d54a40837445b36e45d14ff5d845ea 100644 (file)
--- a/tools/perf/util/symbol.c
+++ b/tools/perf/util/symbol.c
@@ -1458,16 +1458,18 @@ static int dso__load_kcore(struct dso *dso, struct map *map,
                list_del_init(&new_node->node);
 
                if (RC_CHK_ACCESS(new_map) == RC_CHK_ACCESS(replacement_map)) {
+                       struct map *map_ref;
+
                        map__set_start(map, map__start(new_map));
                        map__set_end(map, map__end(new_map));
                        map__set_pgoff(map, map__pgoff(new_map));
                        map__set_map_ip(map, map__map_ip_ptr(new_map));
                        map__set_unmap_ip(map, map__unmap_ip_ptr(new_map));
                        /* Ensure maps are correctly ordered */
-                       map__get(map);
-                       maps__remove(kmaps, map);
-                       err = maps__insert(kmaps, map);
-                       map__put(map);
+                       map_ref = map__get(map);
+                       maps__remove(kmaps, map_ref);
+                       err = maps__insert(kmaps, map_ref);
+                       map__put(map_ref);
                        map__put(new_map);
                        if (err)
                                goto out_err;