Re: [PATCH 7/8] perf sched: Use thread__put() in free_idle_threads()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Replacing thread__delete() with thread__put() fails to free idle threads when --idle-hist is enabled.
--

commit d621fd9eeb37b143f0b8551620d0ca4488e1be89
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf sched: Use thread__put() in free_idle_threads()

This commit changes the cleanup of idle threads from thread__delete() to
thread__put() to correctly balance reference counts. It aims to avoid
leaking pointer handles in REFCNT_CHECKING builds by routing the object
destruction through the reference count wrapper.

> diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c
> index e2df69a624765..b5a7a944f5c8c 100644
> --- a/tools/perf/builtin-sched.c
> +++ b/tools/perf/builtin-sched.c
> @@ -2442,7 +2442,7 @@ static void free_idle_threads(void)
>  			if (itr)
>  				thread__put(itr->last_thread);
>  
> -			thread__delete(idle);
> +			thread__put(idle);

[Severity: High]
Does this replace an intentional forceful deletion with a reference decrement
that causes a leak when the idle_hist option is enabled?

In timehist_get_thread(), an additional reference to the idle thread is
acquired if sched->idle_hist is enabled:

tools/perf/builtin-sched.c:timehist_get_thread() {
    ...
		if (sched->idle_hist) {
			struct thread *idle;
			struct idle_thread_runtime *itr;

			idle = get_idle_thread(sample->cpu);
			if (idle == NULL) {
    ...
			thread__put(itr->last_thread);
			itr->last_thread = thread__get(thread);
    ...
}

The reference acquired by get_idle_thread() is never released with a matching
thread__put() before the function returns.

Previously, thread__delete() forcefully destroyed the thread object
regardless of this inflated reference count.

Now that the cleanup relies on thread__put() and the reference count reaching
zero, the leaked reference from timehist_get_thread() prevents the thread
object from being freed.

Does this result in permanently leaking the idle thread objects, their
private idle_thread_runtime data, and accumulated callchains?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260605203316.1758661-1-acme@kernel.org?part=7