[PATCH v2 1/3] perf: do not call zfree() on uninitialized pointer

[PATCH v2 1/3] perf: do not call zfree() on uninitialized pointer

[Jiri Slaby (SUSE)]

In add_drm_pmu(), the check for type > PERF_PMU_TYPE_DRM_END happens
before "drm" is allocated by zalloc(). The error path nevertheless
called zfree(&drm), i.e. free() on an uninitialized pointer, which
can crash. Remove this bogus zfree() -- nothing has been allocated
yet at this point, so there is nothing to free.

Fixes this compiler warning:
In function ‘__zfree’,
    inlined from ‘add_drm_pmu’ at util/drm_pmu.c:110:3,
    inlined from ‘read_drm_pmus_cb’ at util/drm_pmu.c:174:10:
../lib/zalloc.c:13:9: warning: ‘drm’ may be used uninitialized [-Wmaybe-uninitialized]
   13 |         free(*ptr);
      |         ^

Assisted-by: LLM
Fixes: 28917cb17f9d ("perf drm_pmu: Add a tool like PMU to expose DRM information")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Cc: Ian Rogers <irogers@google.com>
---
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: linux-perf-users@vger.kernel.org
---
 tools/perf/util/drm_pmu.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/perf/util/drm_pmu.c b/tools/perf/util/drm_pmu.c
index b8badae7015c..5e4bdd8e7fa8 100644
--- a/tools/perf/util/drm_pmu.c
+++ b/tools/perf/util/drm_pmu.c
@@ -107,7 +107,6 @@ static struct drm_pmu *add_drm_pmu(struct list_head *pmus, char *line, size_t li
 		type = PERF_PMU_TYPE_DRM_START;
 
 	if (type > PERF_PMU_TYPE_DRM_END) {
-		zfree(&drm);
 		pr_err("Unable to encode DRM PMU type for %s\n", name);
 		return NULL;
 	}
-- 
2.56.0

Re: [PATCH v2 1/3] perf: do not call zfree() on uninitialized pointer

[sashiko-bot]

> In add_drm_pmu(), the check for type > PERF_PMU_TYPE_DRM_END happens
> before "drm" is allocated by zalloc(). The error path nevertheless
> called zfree(&drm), i.e. free() on an uninitialized pointer, which
> can crash. Remove this bogus zfree() -- nothing has been allocated
> yet at this point, so there is nothing to free.
> 
> Fixes this compiler warning:
> In function ‘__zfree’,
>     inlined from ‘add_drm_pmu’ at util/drm_pmu.c:110:3,
>     inlined from ‘read_drm_pmus_cb’ at util/drm_pmu.c:174:10:
> ../lib/zalloc.c:13:9: warning: ‘drm’ may be used uninitialized [-Wmaybe-uninitialized]
>    13 |         free(*ptr);
>       |         ^
> 
> Assisted-by: LLM
> Fixes: 28917cb17f9d ("perf drm_pmu: Add a tool like PMU to expose DRM information")
> Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/8b245572903b8c4ed0dc569d7a71a8f4974e2455.1793867553.git.jirislaby@kernel.org?part=1

Re: [PATCH v2 1/3] perf: do not call zfree() on uninitialized pointer

[James Clark]

On 05/11/2026 08:33, Jiri Slaby (SUSE) wrote:
> In add_drm_pmu(), the check for type > PERF_PMU_TYPE_DRM_END happens
> before "drm" is allocated by zalloc(). The error path nevertheless
> called zfree(&drm), i.e. free() on an uninitialized pointer, which
> can crash. Remove this bogus zfree() -- nothing has been allocated
> yet at this point, so there is nothing to free.
> 
> Fixes this compiler warning:
> In function ‘__zfree’,
>      inlined from ‘add_drm_pmu’ at util/drm_pmu.c:110:3,
>      inlined from ‘read_drm_pmus_cb’ at util/drm_pmu.c:174:10:
> ../lib/zalloc.c:13:9: warning: ‘drm’ may be used uninitialized [-Wmaybe-uninitialized]
>     13 |         free(*ptr);
>        |         ^
> 
> Assisted-by: LLM
> Fixes: 28917cb17f9d ("perf drm_pmu: Add a tool like PMU to expose DRM information")
> Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
> Cc: Ian Rogers <irogers@google.com>
> ---
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Cc: Jiri Olsa <jolsa@kernel.org>
> Cc: Adrian Hunter <adrian.hunter@intel.com>
> Cc: James Clark <james.clark@linaro.org>
> Cc: linux-perf-users@vger.kernel.org
> ---
>   tools/perf/util/drm_pmu.c | 1 -
>   1 file changed, 1 deletion(-)
> 
> diff --git a/tools/perf/util/drm_pmu.c b/tools/perf/util/drm_pmu.c
> index b8badae7015c..5e4bdd8e7fa8 100644
> --- a/tools/perf/util/drm_pmu.c
> +++ b/tools/perf/util/drm_pmu.c
> @@ -107,7 +107,6 @@ static struct drm_pmu *add_drm_pmu(struct list_head *pmus, char *line, size_t li
>   		type = PERF_PMU_TYPE_DRM_START;
>   
>   	if (type > PERF_PMU_TYPE_DRM_END) {
> -		zfree(&drm);
>   		pr_err("Unable to encode DRM PMU type for %s\n", name);
>   		return NULL;
>   	}

Reviewed-by: James Clark <james.clark@linaro.org>

Re: [PATCH v2 1/3] perf: do not call zfree() on uninitialized pointer

[Namhyung Kim]

On Thu, 05 Nov 2026 09:33:50 +0100, Jiri Slaby (SUSE) wrote:

> In add_drm_pmu(), the check for type > PERF_PMU_TYPE_DRM_END happens
> before "drm" is allocated by zalloc(). The error path nevertheless
> called zfree(&drm), i.e. free() on an uninitialized pointer, which
> can crash. Remove this bogus zfree() -- nothing has been allocated
> yet at this point, so there is nothing to free.
> 
> Fixes this compiler warning:
> In function ‘__zfree’,
>     inlined from ‘add_drm_pmu’ at util/drm_pmu.c:110:3,
>     inlined from ‘read_drm_pmus_cb’ at util/drm_pmu.c:174:10:
> ../lib/zalloc.c:13:9: warning: ‘drm’ may be used uninitialized [-Wmaybe-uninitialized]
>    13 |         free(*ptr);
>       |         ^
> 
> [...]

Applied to perf-tools-next, thanks!

Best regards,
Namhyung

[PATCH v2 2/3] perf: do not call list_for_each_entry_safe() on uninitalized list

[Jiri Slaby (SUSE)]

In test__pmu_config_helpers(), when evlist__new() fails, the code jumped
to the err_out label, which calls parse_events_terms__exit(&terms). At
that point parse_events_terms__init(&terms) has not run yet, so the
terms list head is uninitialized and list_for_each_entry_safe() walks a
garbage pointer.

Fixes this compiler warning:
In function ‘parse_events_terms__exit’,
    inlined from ‘test__pmu_config_helpers’ at tests/pmu.c:296:2:
util/parse-events.c:2849:2: warning: ‘terms.terms.next’ may be used uninitia
tests/pmu.c: In function ‘test__pmu_config_helpers’:
tests/pmu.c:209:28: note: ‘terms’ declared here

Assisted-by: LLM
Fixes: 8e2ef85c66dc ("perf tests: Test evsel__set_config_if_unset() and config change tracking")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
Cc: James Clark <james.clark@linaro.org>
---
[v2] drop terms completely (Sashiko)

Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: linux-perf-users@vger.kernel.org
---
 tools/perf/tests/pmu.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
index 13e8d7fa80af..b6ad2806659c 100644
--- a/tools/perf/tests/pmu.c
+++ b/tools/perf/tests/pmu.c
@@ -206,9 +206,7 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
 {
 	const char *event = "perf-pmu-test/config=15,config1=4,krava02=170,"
 			    "krava03=1,krava11=27,krava12=1/";
-	struct parse_events_terms terms;
 	struct parse_events_error err;
-	LIST_HEAD(config_terms);
 	struct evlist *evlist;
 	struct perf_pmu *pmu;
 	struct evsel *evsel;
@@ -226,7 +224,6 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
 		goto err_out;
 	}
 
-	parse_events_terms__init(&terms);
 	ret = parse_events(evlist, event, &err);
 	if (ret) {
 		pr_debug("failed to parse event '%s', err %d\n", event, ret);
@@ -293,7 +290,6 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
 	TEST_ASSERT_EQUAL("krava23 not overwritten", (int) val, 0);
 	ret = TEST_OK;
 err_out:
-	parse_events_terms__exit(&terms);
 	evlist__put(evlist);
 	test_pmu_put(dir, pmu);
 	return ret;
-- 
2.56.0

Re: [PATCH v2 2/3] perf: do not call list_for_each_entry_safe() on uninitalized list

[sashiko-bot]

> In test__pmu_config_helpers(), when evlist__new() fails, the code jumped
> to the err_out label, which calls parse_events_terms__exit(&terms). At
> that point parse_events_terms__init(&terms) has not run yet, so the
> terms list head is uninitialized and list_for_each_entry_safe() walks a
> garbage pointer.
> 
> Fixes this compiler warning:
> In function ‘parse_events_terms__exit’,
>     inlined from ‘test__pmu_config_helpers’ at tests/pmu.c:296:2:
> util/parse-events.c:2849:2: warning: ‘terms.terms.next’ may be used uninitia
> tests/pmu.c: In function ‘test__pmu_config_helpers’:
> tests/pmu.c:209:28: note: ‘terms’ declared here
> 
> Assisted-by: LLM
> Fixes: 8e2ef85c66dc ("perf tests: Test evsel__set_config_if_unset() and config change tracking")
> Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/8b245572903b8c4ed0dc569d7a71a8f4974e2455.1793867553.git.jirislaby@kernel.org?part=2

Re: [PATCH v2 2/3] perf: do not call list_for_each_entry_safe() on uninitalized list

[James Clark]

On 05/11/2026 08:33, Jiri Slaby (SUSE) wrote:
> In test__pmu_config_helpers(), when evlist__new() fails, the code jumped
> to the err_out label, which calls parse_events_terms__exit(&terms). At
> that point parse_events_terms__init(&terms) has not run yet, so the
> terms list head is uninitialized and list_for_each_entry_safe() walks a
> garbage pointer.
> 
> Fixes this compiler warning:
> In function ‘parse_events_terms__exit’,
>      inlined from ‘test__pmu_config_helpers’ at tests/pmu.c:296:2:
> util/parse-events.c:2849:2: warning: ‘terms.terms.next’ may be used uninitia
> tests/pmu.c: In function ‘test__pmu_config_helpers’:
> tests/pmu.c:209:28: note: ‘terms’ declared here
> 
> Assisted-by: LLM
> Fixes: 8e2ef85c66dc ("perf tests: Test evsel__set_config_if_unset() and config change tracking")
> Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
> Cc: James Clark <james.clark@linaro.org>
> ---
> [v2] drop terms completely (Sashiko)
> 
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Cc: Jiri Olsa <jolsa@kernel.org>
> Cc: Ian Rogers <irogers@google.com>
> Cc: Adrian Hunter <adrian.hunter@intel.com>
> Cc: linux-perf-users@vger.kernel.org
> ---
>   tools/perf/tests/pmu.c | 4 ----
>   1 file changed, 4 deletions(-)
> 
> diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
> index 13e8d7fa80af..b6ad2806659c 100644
> --- a/tools/perf/tests/pmu.c
> +++ b/tools/perf/tests/pmu.c
> @@ -206,9 +206,7 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
>   {
>   	const char *event = "perf-pmu-test/config=15,config1=4,krava02=170,"
>   			    "krava03=1,krava11=27,krava12=1/";
> -	struct parse_events_terms terms;
>   	struct parse_events_error err;
> -	LIST_HEAD(config_terms);
>   	struct evlist *evlist;
>   	struct perf_pmu *pmu;
>   	struct evsel *evsel;
> @@ -226,7 +224,6 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
>   		goto err_out;
>   	}
>   
> -	parse_events_terms__init(&terms);
>   	ret = parse_events(evlist, event, &err);
>   	if (ret) {
>   		pr_debug("failed to parse event '%s', err %d\n", event, ret);
> @@ -293,7 +290,6 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
>   	TEST_ASSERT_EQUAL("krava23 not overwritten", (int) val, 0);
>   	ret = TEST_OK;
>   err_out:
> -	parse_events_terms__exit(&terms);
>   	evlist__put(evlist);
>   	test_pmu_put(dir, pmu);
>   	return ret;

Reviewed-by: James Clark <james.clark@linaro.org>

[PATCH v2 3/3] perf: initialize and destroy error list in test__pmu_config_helpers()

[Jiri Slaby (SUSE)]

test__pmu_config_helpers() passes an uninitialized "err" to parse_events()
without ever calling parse_events_error__init() on it first. Sashiko
pointed this out in review:
> When parse_events() fails and records an error via
> parse_events_error__handle(), list_add(&entry->list, &err->list) and the
> subsequent list_for_each_entry() walks in parse_events_error__print() and
> parse_events_error__contains() will dereference the uninitialized err.list
> pointers on the stack, and any allocated parse_events_error_entry objects
> will be leaked.

Fix it by calling parse_events_error__init(&err) before parse_events(), and
by releasing the list with parse_events_error__exit(&err) on the new
err_out_errlist path taken once the list has been initialized.

Assisted-by: LLM
Fixes: 8e2ef85c66dc ("perf tests: Test evsel__set_config_if_unset() and config change tracking")
Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
---
[v2] this is new in v2

Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Mark Rutland <mark.rutland@arm.com>
Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: James Clark <james.clark@linaro.org>
Cc: linux-perf-users@vger.kernel.org
---
 tools/perf/tests/pmu.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
index b6ad2806659c..f208932590df 100644
--- a/tools/perf/tests/pmu.c
+++ b/tools/perf/tests/pmu.c
@@ -224,13 +224,14 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
 		goto err_out;
 	}
 
+	parse_events_error__init(&err);
 	ret = parse_events(evlist, event, &err);
 	if (ret) {
 		pr_debug("failed to parse event '%s', err %d\n", event, ret);
 		parse_events_error__print(&err, event);
 		if (parse_events_error__contains(&err, "can't access trace events"))
 			ret = TEST_SKIP;
-		goto err_out;
+		goto err_out_errlist;
 	}
 	evsel = evlist__first(evlist);
 
@@ -289,6 +290,8 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
 	evsel__get_config_val(evsel, "krava23", &val);
 	TEST_ASSERT_EQUAL("krava23 not overwritten", (int) val, 0);
 	ret = TEST_OK;
+err_out_errlist:
+	parse_events_error__exit(&err);
 err_out:
 	evlist__put(evlist);
 	test_pmu_put(dir, pmu);
-- 
2.56.0

Re: [PATCH v2 3/3] perf: initialize and destroy error list in test__pmu_config_helpers()

[sashiko-bot]

> test__pmu_config_helpers() passes an uninitialized "err" to parse_events()
> without ever calling parse_events_error__init() on it first. Sashiko
> pointed this out in review:
> > When parse_events() fails and records an error via
> > parse_events_error__handle(), list_add(&entry->list, &err->list) and the
> > subsequent list_for_each_entry() walks in parse_events_error__print() and
> > parse_events_error__contains() will dereference the uninitialized err.list
> > pointers on the stack, and any allocated parse_events_error_entry objects
> > will be leaked.
> 
> Fix it by calling parse_events_error__init(&err) before parse_events(), and
> by releasing the list with parse_events_error__exit(&err) on the new
> err_out_errlist path taken once the list has been initialized.
> 
> Assisted-by: LLM
> Fixes: 8e2ef85c66dc ("perf tests: Test evsel__set_config_if_unset() and config change tracking")
> Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/8b245572903b8c4ed0dc569d7a71a8f4974e2455.1793867553.git.jirislaby@kernel.org?part=3

Re: [PATCH v2 3/3] perf: initialize and destroy error list in test__pmu_config_helpers()

[James Clark]

On 05/11/2026 08:33, Jiri Slaby (SUSE) wrote:
> test__pmu_config_helpers() passes an uninitialized "err" to parse_events()
> without ever calling parse_events_error__init() on it first. Sashiko
> pointed this out in review:
>> When parse_events() fails and records an error via
>> parse_events_error__handle(), list_add(&entry->list, &err->list) and the
>> subsequent list_for_each_entry() walks in parse_events_error__print() and
>> parse_events_error__contains() will dereference the uninitialized err.list
>> pointers on the stack, and any allocated parse_events_error_entry objects
>> will be leaked.
> 
> Fix it by calling parse_events_error__init(&err) before parse_events(), and
> by releasing the list with parse_events_error__exit(&err) on the new
> err_out_errlist path taken once the list has been initialized.
> 
> Assisted-by: LLM
> Fixes: 8e2ef85c66dc ("perf tests: Test evsel__set_config_if_unset() and config change tracking")
> Signed-off-by: Jiri Slaby (SUSE) <jirislaby@kernel.org>
> ---
> [v2] this is new in v2
> 
> Cc: Peter Zijlstra <peterz@infradead.org>
> Cc: Ingo Molnar <mingo@redhat.com>
> Cc: Arnaldo Carvalho de Melo <acme@kernel.org>
> Cc: Namhyung Kim <namhyung@kernel.org>
> Cc: Mark Rutland <mark.rutland@arm.com>
> Cc: Alexander Shishkin <alexander.shishkin@linux.intel.com>
> Cc: Jiri Olsa <jolsa@kernel.org>
> Cc: Ian Rogers <irogers@google.com>
> Cc: Adrian Hunter <adrian.hunter@intel.com>
> Cc: James Clark <james.clark@linaro.org>
> Cc: linux-perf-users@vger.kernel.org
> ---
>   tools/perf/tests/pmu.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/perf/tests/pmu.c b/tools/perf/tests/pmu.c
> index b6ad2806659c..f208932590df 100644
> --- a/tools/perf/tests/pmu.c
> +++ b/tools/perf/tests/pmu.c
> @@ -224,13 +224,14 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
>   		goto err_out;
>   	}
>   
> +	parse_events_error__init(&err);
>   	ret = parse_events(evlist, event, &err);
>   	if (ret) {
>   		pr_debug("failed to parse event '%s', err %d\n", event, ret);
>   		parse_events_error__print(&err, event);
>   		if (parse_events_error__contains(&err, "can't access trace events"))
>   			ret = TEST_SKIP;
> -		goto err_out;
> +		goto err_out_errlist;
>   	}
>   	evsel = evlist__first(evlist);
>   
> @@ -289,6 +290,8 @@ static int test__pmu_config_helpers(struct test_suite *test __maybe_unused,
>   	evsel__get_config_val(evsel, "krava23", &val);
>   	TEST_ASSERT_EQUAL("krava23 not overwritten", (int) val, 0);
>   	ret = TEST_OK;
> +err_out_errlist:
> +	parse_events_error__exit(&err);
>   err_out:
>   	evlist__put(evlist);
>   	test_pmu_put(dir, pmu);

Reviewed-by: James Clark <james.clark@linaro.org>