Re: [PATCH] perf stat: Merge CPU maps when merging uncore aliases

[sashiko-bot@kernel.org]

Sashiko AI review found 2 potential issue(s):
- [Medium] Expanding `evsel->core.cpus` without reallocating parallel arrays causes a deterministic NULL pointer dereference and out-of-bounds access.
- [Medium] Missing error handling for `perf_cpu_map__merge()`, masking memory allocation failures.
--

commit ca357f612c76d14c9a719708c9f0cdce0f262717
Author: Chun-Tse Shao <ctshao@google.com>

perf stat: Merge CPU maps when merging uncore aliases

This commit merges CPU maps for aliases in evsel__merge_aggr_counters() to
prevent the display logic from hiding sockets with zero counts. It aims to
ensure the aggregated event correctly reflects all underlying PMU instances.

> diff --git a/tools/perf/util/stat.c b/tools/perf/util/stat.c
> index 14d169e22e8f5..d696d217f98d6 100644
> --- a/tools/perf/util/stat.c
> +++ b/tools/perf/util/stat.c
[ ... ]
> @@ -535,6 +535,12 @@ static int evsel__merge_aggr_counters(struct evsel *evsel, struct evsel *alias)
>  		aggr_counts_a->run += aggr_counts_b->run;
>  	}
>  
> +	/*
> +	 * Merge the CPU maps so that the display logic (e.g. should_skip_zero_counter)
> +	 * knows this merged event covers all CPUs from both aliases.
> +	 */
> +	perf_cpu_map__merge(&evsel->core.cpus, alias->core.cpus);

perf_cpu_map__merge() can fail and return an error code like -ENOMEM.
Should we check the return value here and propagate the error, instead of
ignoring it?

Additionally, does expanding the CPU map in-place here cause out-of-bounds
memory accesses?

Arrays like evsel->counts and evsel->prev_raw_counts are allocated earlier
based on the original size of evsel->core.cpus:

tools/perf/util/stat.c:evsel__alloc_prev_raw_counts() {
	int cpu_map_nr = evsel__nr_cpus(evsel);
	int nthreads = perf_thread_map__nr(evsel->core.threads);
	struct perf_counts *counts;

	counts = perf_counts__new(cpu_map_nr, nthreads);
	...
}

If perf_cpu_map__merge() increases the number of CPUs in the map, later
iterations over the CPU map (such as in interval mode) will access these
parallel xyarrays out of bounds. When the loop index exceeds the original
array size, the access returns NULL and causes a segmentation fault when
unconditionally dereferenced.

Do we need to reallocate evsel->counts and evsel->prev_raw_counts when
merging these CPU maps?

> +
>  	return 0;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260416204828.1303734-1-ctshao@google.com?part=1