Re: [PATCH v6 2/2] perf inject: Fix itrace branch stack synthesis

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The patch introduces a reliable NULL pointer dereference in `intel_pt_do_synth_pebs_sample` when branch stack injection is requested via `perf inject --itrace=L`.
--

commit 2c77e921627255ed5c1e2aee4ca756b993e7acc3
Author: Ian Rogers <irogers@google.com>

perf inject: Fix itrace branch stack synthesis

When using "perf inject --itrace=L" to synthesize branch stacks from AUX data,
this commit fixes several issues, including missing PERF_SAMPLE_BRANCH_STACK
flags, incorrect sample types early in __cmd_inject, and other validation and
memory problems in sample repiping.

> diff --git a/tools/perf/util/intel-pt.c b/tools/perf/util/intel-pt.c
> index dd2637678b405..7153b48cfe63a 100644
> --- a/tools/perf/util/intel-pt.c
> +++ b/tools/perf/util/intel-pt.c

[ ... ]

> @@ -2505,7 +2505,7 @@ static int intel_pt_do_synth_pebs_sample(struct intel_pt_queue *ptq, struct evse
>  		intel_pt_add_xmm(intr_regs, pos, items, regs_mask);
>  	}
>  
> -	if (sample_type & PERF_SAMPLE_BRANCH_STACK) {
> +	if ((sample_type | evsel->synth_sample_type) & PERF_SAMPLE_BRANCH_STACK) {
>  		if (items->mask[INTEL_PT_LBR_0_POS] ||
>  		    items->mask[INTEL_PT_LBR_1_POS] ||
>  		    items->mask[INTEL_PT_LBR_2_POS]) {
> 			intel_pt_add_lbrs(ptq->last_branch, items);
> 		} else if (pt->synth_opts.last_branch) {
> 			thread_stack__br_sample(ptq->thread, ptq->cpu,
> 						ptq->last_branch,
> 						pt->br_stack_sz);
> 		} else {
> 			ptq->last_branch->nr = 0;
> 		}
> 		sample.branch_stack = ptq->last_branch;
> 	}

Could this lead to a NULL pointer dereference when running perf inject
--itrace=L?

When branch stack injection is requested, pt->synth_opts.add_last_branch is
true, but pt->synth_opts.last_branch and pt->synth_opts.other_events remain
false. This bypasses the allocation of ptq->last_branch in
intel_pt_alloc_queue(), leaving it as NULL.

Simultaneously, intel_pt_br_stack_init() sets the PERF_SAMPLE_BRANCH_STACK
flag in evsel->synth_sample_type for all evsels. By checking
(sample_type | evsel->synth_sample_type) & PERF_SAMPLE_BRANCH_STACK,
execution is forced into this branch stack handling block for PEBS samples.

Inside this block, the code dereferences ptq->last_branch either in
intel_pt_add_lbrs() or by assigning ptq->last_branch->nr = 0. Since
ptq->last_branch is NULL, this leads to a segmentation fault.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260518184939.2901713-1-irogers@google.com?part=2