Re: [PATCH v10 8/9] perf cs-etm: Synthesize callchains for instruction samples

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The error path in `cs_etm__context()` destructively nullifies `tidq->frontend_thread`, leading to a predictable NULL pointer dereference crash in the perf tool when processing subsequent packets.
--

commit 3e6647ae053d9c4c2c79da5f0062f4a5c6da23e3
Author: Leo Yan <leo.yan@linux.dev>

perf cs-etm: Synthesize callchains for instruction samples

This patch adds callchain synthesis for instruction samples in CS ETM. It
allocates a callchain buffer and introduces cs_etm__context() to handle
context packets. The synthetic instruction events are updated to advertise
PERF_SAMPLE_CALLCHAIN.

> diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
> index 30536b919af73..67885ed43bab9 100644
> --- a/tools/perf/util/cs-etm.c
> +++ b/tools/perf/util/cs-etm.c

[ ... ]

> @@ -1910,6 +1947,34 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,
>  	return 0;
>  }
>  
> +static int cs_etm__context(struct cs_etm_queue *etmq,
> +			   struct cs_etm_traceid_queue *tidq)
> +{
> +	ocsd_ex_level el = tidq->packet->el;
> +	struct machine *machine;
> +	int ret;
> +
> +	machine = cs_etm__get_machine(etmq, el);
> +	if (!machine) {
> +		ret = -EINVAL;
> +		goto err;
> +	}
> +
> +	tidq->kernel_start = machine__kernel_start(machine);
> +
> +	ret = cs_etm__etmq_update_thread(etmq, el, tidq->packet->tid,
> +					 &tidq->frontend_thread);
> +	if (ret)
> +		goto err;
> +
> +	return 0;
> +
> +err:
> +	thread__zput(tidq->frontend_thread);

[Severity: Medium]
Can this error path lead to a NULL pointer dereference crash in the perf tool?

If cs_etm__get_machine() fails, we take the err path and nullify
tidq->frontend_thread here.

If the caller, such as cs_etm__run_per_thread_timeless_decoder(), ignores
the error and continues processing the trace buffer, a subsequent
CS_ETM_RANGE packet will call cs_etm__synth_instruction_sample(). That function
unconditionally accesses the nullified pointer:

    sample.pid = thread__pid(tidq->frontend_thread);
    sample.tid = thread__tid(tidq->frontend_thread);

> +	tidq->kernel_start = 0;
> +	return ret;
> +}
> +

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260617-b4-arm_cs_callchain_support_v1-v10-0-e8b6e5d63db5@arm.com?part=8