Re: [PATCH 05/11] perf tools: NULL bitmap pointers after bitmap_free()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] Setting `nodesp[i].set = NULL` in `memory_node__delete_nodes` is a dead store and fails to prevent double-frees because the parent `nodesp` array is immediately freed.
--

commit 96984a1b2dbcef0f5989e5cb40505523a7726dd3
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf tools: NULL bitmap pointers after bitmap_free()

This commit modifies three call sites to set bitmap pointers to NULL after
they are freed using bitmap_free(). The purpose is to avoid double-free
scenarios if the structure is later reused or cleaned up multiple times.

[ ... ]

> diff --git a/tools/perf/util/header.c b/tools/perf/util/header.c
> index d7f41db7322cb..8d2ab440a1c8e 100644
> --- a/tools/perf/util/header.c
> +++ b/tools/perf/util/header.c
> @@ -1481,8 +1481,10 @@ static int memory_node__read(struct memory_node *n, unsigned long idx)
>  
>  static void memory_node__delete_nodes(struct memory_node *nodesp, u64 cnt)
>  {
> -	for (u64 i = 0; i < cnt; i++)
> +	for (u64 i = 0; i < cnt; i++) {
>  		bitmap_free(nodesp[i].set);
> +		nodesp[i].set = NULL;

[Severity: Low]
Since the entire nodesp array is freed immediately after this loop, does
nullifying this pointer provide any protection against double-frees?

If a cleanup function were called twice on this structure, wouldn't it result
in a use-after-free on the nodesp array itself before the set pointer could
even be evaluated?

> +	}
>  
>  	free(nodesp);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608013057.1942953-1-acme@kernel.org?part=5