Re: [PATCH 04/11] perf tools: NULL bitmap pointers after bitmap_free()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] mmap__munmap() sets map->affinity_mask.bits to NULL but fails to reset nbits, causing a NULL pointer dereference on reuse
--

commit 94be33133bc6900d241e747a65660202c60936fa
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf tools: NULL bitmap pointers after bitmap_free()

Two call sites free bitmaps without NULLing the pointer, risking
double-free if the structure is reused or cleanup is called twice.

> diff --git a/tools/perf/builtin-record.c b/tools/perf/builtin-record.c
> index a33c78f030d91..e915390556752 100644
> --- a/tools/perf/builtin-record.c
> +++ b/tools/perf/builtin-record.c
> @@ -3084,6 +3084,7 @@ static int record__mmap_cpu_mask_alloc(struct mmap_cpu_mask *mask, int nr_bits)
>  static void record__mmap_cpu_mask_free(struct mmap_cpu_mask *mask)
>  {
>  	bitmap_free(mask->bits);
> +	mask->bits = NULL;
>  	mask->nbits = 0;
>  }

[ ... ]

> diff --git a/tools/perf/util/mmap.c b/tools/perf/util/mmap.c
> index d64aec6c7c843..c6bd4c37d50ee 100644
> --- a/tools/perf/util/mmap.c
> +++ b/tools/perf/util/mmap.c
> @@ -238,6 +238,7 @@ static void perf_mmap__aio_munmap(struct mmap *map __maybe_unused)
>  void mmap__munmap(struct mmap *map)
>  {
>  	bitmap_free(map->affinity_mask.bits);
> +	map->affinity_mask.bits = NULL;

[Severity: Medium]
In record__mmap_cpu_mask_free() above, nbits is reset to 0, but it is not
reset here.

If this struct mmap is later reused and mmap__mmap() is called with
mp->affinity == PERF_AFFINITY_SYS, perf_mmap__setup_affinity_mask()
is bypassed, leaving bits as NULL while nbits retains its old, positive value.

If the user runs perf with -vv, mmap__mmap() calls mmap_cpu_mask__scnprintf(),
which passes the NULL pointer and positive nbits to bitmap_scnprintf().

Could this cause find_first_bit() to unconditionally dereference the NULL
pointer array and crash the tool?

Should we also add map->affinity_mask.nbits = 0 here?

>  
>  	zstd_fini(&map->zstd_data);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609010526.1998472-1-acme@kernel.org?part=4