Re: [PATCH v7 7/8] perf cs-etm: Synthesize callchains for instruction samples

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] The error path in the newly introduced `cs_etm__context()` leaks the thread reference count and causes a subsequent deterministic NULL pointer dereference.
--

commit 08ea8a8a8959ce5cc5f77e8d3b133c16e92cb0b7
Author: Leo Yan <leo.yan@linux.dev>

perf cs-etm: Synthesize callchains for instruction samples

This commit adds callchain synthesis for instruction samples in CS ETM.
It allocates a callchain buffer per queue and uses thread_stack__sample()
when synthesizing instruction samples, and introduces cs_etm__context()
for handling context packets.

> diff --git a/tools/perf/util/cs-etm.c b/tools/perf/util/cs-etm.c
> --- a/tools/perf/util/cs-etm.c
> +++ b/tools/perf/util/cs-etm.c

[ ... ]

> @@ -1895,6 +1932,34 @@ static int cs_etm__sample(struct cs_etm_queue *etmq,
>  	return 0;
>  }
>  
> +static int cs_etm__context(struct cs_etm_queue *etmq,
> +			   struct cs_etm_traceid_queue *tidq)
> +{
> +	ocsd_ex_level el = tidq->packet->el;
> +	struct machine *machine;
> +	int ret;
> +
> +	machine = cs_etm__get_machine(etmq, el);
> +	if (!machine) {
> +		ret = -EINVAL;
> +		goto err;
> +	}
> +
> +	tidq->kernel_start = machine__kernel_start(machine);
> +
> +	ret = cs_etm__etmq_update_thread(etmq, el, tidq->packet->tid,
> +					 &tidq->frontend_thread);
> +	if (ret)
> +		goto err;
> +
> +	return 0;
> +
> +err:
> +	tidq->frontend_thread = NULL;
> +	tidq->kernel_start = 0;
> +	return ret;
> +}

[Severity: Medium]
If the code jumps to the err label, it sets tidq->frontend_thread = NULL.
Since the thread struct uses reference counting, does this overwrite leak
the existing thread reference?

Additionally, if the outer decoding loop ignores this error and continues
processing trace packets, could this lead to a crash? When a subsequent
CS_ETM_RANGE packet is processed, cs_etm__synth_instruction_sample() will
unconditionally dereference the NULL thread pointer here:

tools/perf/util/cs-etm.c:cs_etm__synth_instruction_sample() {
	...
	sample.ip = addr;
	sample.pid = thread__pid(tidq->frontend_thread);
	sample.tid = thread__tid(tidq->frontend_thread);
	...
}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260611-b4-arm_cs_callchain_support_v1-v7-0-1ba770c862ae@arm.com?part=7