Re: [PATCH v8 7/8] perf cs-etm: Synthesize callchains for instruction samples

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The error path in the newly introduced `cs_etm__context()` overwrites `tidq->frontend_thread` with NULL without releasing the reference handle, leading to a memory leak and a subsequent NULL pointer dereference.
--

commit bbd0982199b3bebe7c4ff65cda463eab43f1b9d7
Author: Leo Yan <leo.yan@linux.dev>

perf cs-etm: Synthesize callchains for instruction samples

This commit adds synthesized callchain support for instruction samples in CS
ETM. It allocates a callchain buffer and utilizes thread_stack__sample() when
synthesizing the samples. The patch also introduces cs_etm__context() to handle
context packets and update thread info.

> diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
> index 830618763d8b1..f37aa41b3587a 100644
> --- a/tools/perf/util/cs-etm.c
> +++ b/tools/perf/util/cs-etm.c

[ ... ]

> @@ -1895,6 +1932,34 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,
>  	return 0;
>  }
>  
> +static int cs_etm__context(struct cs_etm_queue *etmq,
> +			   struct cs_etm_traceid_queue *tidq)
> +{
> +	ocsd_ex_level el = tidq->packet->el;
> +	struct machine *machine;
> +	int ret;
> +
> +	machine = cs_etm__get_machine(etmq, el);
> +	if (!machine) {
> +		ret = -EINVAL;
> +		goto err;
> +	}
> +
> +	tidq->kernel_start = machine__kernel_start(machine);
> +
> +	ret = cs_etm__etmq_update_thread(etmq, el, tidq->packet->tid,
> +					 &tidq->frontend_thread);
> +	if (ret)
> +		goto err;
> +
> +	return 0;
> +
> +err:
> +	tidq->frontend_thread = NULL;

[Severity: High]
Does overwriting tidq->frontend_thread with NULL here without calling
thread__zput() first cause a memory leak of the reference-counted thread
handle?

Additionally, if the caller ignores the -EINVAL error and continues processing,
could the next CS_ETM_RANGE packet cause a NULL pointer dereference when
cs_etm__synth_instruction_sample() unconditionally calls
thread__pid(tidq->frontend_thread)?

> +	tidq->kernel_start = 0;
> +	return ret;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611-b4-arm_cs_callchain_support_v1-v8-0-737948584fea@arm.com?part=7