Re: [PATCH v4 2/3] perf dwarf-aux: Add C++ vtable helpers

[Namhyung Kim <namhyung@kernel.org>]

On Tue, Nov 03, 2026 at 04:22:30PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] perf dwarf-aux: unbounded recursion in __die_find_member_offset_cb()
> --
> 
> commit 3556b432528cd90397fc56862bef26cf9afde995
> Author: Yanbo Zhao <yzhao62@ncsu.edu>
> 
> perf dwarf-aux: Add C++ vtable helpers
> 
> This commit adds DWARF helper functions (die_get_vtable_index(),
> die_find_virtual_func(), die_is_vtbl_ptr_type(), die_get_vptr_class(), and
> die_deref_vptr_class()) to support static resolution of C++ virtual function
> calls during data type profiling.
> 
> > diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
> > index eb4b8f3475df1..10079f47a6c38 100644
> > --- a/tools/perf/util/dwarf-aux.c
> > +++ b/tools/perf/util/dwarf-aux.c
> > @@ -2293,6 +2293,239 @@ Dwarf_Die *die_get_member_type(Dwarf_Die *type_die, int offset,
> 
> [ ... ]
> 
> > +static int __die_find_primary_base_cb(Dwarf_Die *die_mem, void *arg __maybe_unused)
> > +{
> > +	Dwarf_Attribute attr;
> > +	Dwarf_Die base_die, vptr_die;
> > +	Dwarf_Word loc, virtuality;
> > +
> > +	if (dwarf_tag(die_mem) != DW_TAG_inheritance)
> > +		return DIE_FIND_CB_SIBLING;
> > +
> > +	/* The attribute can be present with DW_VIRTUALITY_none */
> > +	if (dwarf_attr_integrate(die_mem, DW_AT_virtuality, &attr) &&
> > +	    dwarf_formudata(&attr, &virtuality) == 0 &&
> > +	    virtuality != DW_VIRTUALITY_none)
> > +		return DIE_FIND_CB_SIBLING;
> > +
> > +	if (die_get_data_member_location(die_mem, &loc) < 0 || loc != 0)
> > +		return DIE_FIND_CB_SIBLING;
> > +
> > +	if (die_get_real_type(die_mem, &base_die) == NULL)
> > +		return DIE_FIND_CB_SIBLING;
> > +
> > +	/* It should have the vtable pointer at offset 0 */
> > +	if (die_get_vptr_class(&base_die, 0, &vptr_die) == NULL)
> > +		return DIE_FIND_CB_SIBLING;
> > +
> > +	return DIE_FIND_CB_END;
> > +}
> 
> [ ... ]
> 
> > +Dwarf_Die *die_get_vptr_class(Dwarf_Die *type_die, int offset,
> > +			      Dwarf_Die *die_mem)
> > +{
> > +	Dwarf_Die class_die = *type_die;
> > +	Dwarf_Die vptr_class = *type_die;
> > +	Dwarf_Die member_die, mb_type;
> > +	Dwarf_Word loc;
> > +	int chase = 0;
> > +
> > +	while (die_is_compound_type(&class_die)) {
> > +		if (++chase > MAX_TYPE_CHASE) {
> > +			pr_debug("DWARF: base class chase limit reached at DIE 0x%lx\n",
> > +				 (unsigned long)dwarf_dieoffset(type_die));
> > +			return NULL;
> > +		}
> > +
> > +		if (die_find_child(&class_die, __die_find_member_offset_cb,
> > +				   (void *)(long)offset, &member_die) == NULL)
> > +			return NULL;
> 
> [Severity: Medium]
> As reported by Namhyung Kim on v2 [1], broken DWARF debug info with cyclic
> inheritance requires recursion depth limits when chasing base classes.

Can you please address this?

Thanks,
Namhyung

> 
> While die_get_vptr_class() and die_find_virtual_func() add a MAX_TYPE_CHASE
> check on their outer loops, die_get_vptr_class() (which is also invoked by
> die_find_virtual_func() -> __die_find_primary_base_cb() ->
> die_get_vptr_class()) calls die_find_child() with
> __die_find_member_offset_cb() on its first iteration (chase == 1).
> 
> Inside __die_find_member_offset_cb(), when encountering a DW_TAG_inheritance
> child with offset >= loc, it recurses into base_die without a depth limit:
> 
> tools/perf/util/dwarf-aux.c:__die_find_member_offset_cb() {
> 	...
> 	if (tag == DW_TAG_inheritance) {
> 		Dwarf_Die base_die, member_die;
> 		...
> 		if (offset < loc)
> 			return DIE_FIND_CB_SIBLING;
> 
> 		if (die_get_real_type(die_mem, &base_die) == NULL)
> 			return DIE_FIND_CB_SIBLING;
> 
> 		if (die_find_child(&base_die, __die_find_member_offset_cb,
> 				   (void *)(long)(offset - loc), &member_die))
> 			return DIE_FIND_CB_END;
> 
> 		return DIE_FIND_CB_SIBLING;
> 	}
> 	...
> }
> 
> If a binary has malformed DWARF with cyclic DW_TAG_inheritance (for example,
> at offset 0), won't __die_find_member_offset_cb() recurse until stack
> exhaustion on the first iteration before returning to the outer MAX_TYPE_CHASE
> loop in die_get_vptr_class() or die_find_virtual_func()?
> 
> [1] https://lore.kernel.org/r/asA1u7LBRp2gqbWI@google.com
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20261103155650.269973-1-yzhao62@ncsu.edu?part=2