Re: [PATCH v2 2/4] perf tools: Fix double free and memory leak in kvm_events_record()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] The patch addresses an array-mutation bug in `kvm_events_record()` but leaves identical instances of the bug unfixed in `__cmd_record()`, `__cmd_report()`, `__cmd_buildid_list()`, and `__cmd_top()`.
--

--- Patch [2]: [PATCH v2 2/4] perf tools: Fix double free and memory leak in kvm_events_record() ---
commit de06a9553df4c03dc3591b78a5d37cfb9f36b1e0
Author: Michalis Niarchos <michael.niarchos@gmail.com>

perf tools: Fix double free and memory leak in kvm_events_record()

cmd_record() reorders the contents of the rec_argv pointer array, causing
an issue where pointers are freed twice and others never freed. This patch
fixes the double free and memory leak by referencing literals directly
instead of duplicating them, removing the need to track and free each entry.

> diff --git a/tools/perf/builtin-kvm.c b/tools/perf/builtin-kvm.c
> index 44c6998f2ee5d..45c92ab74fdd6 100644
> --- a/tools/perf/builtin-kvm.c
> +++ b/tools/perf/builtin-kvm.c

[ ... ]

> @@ -1717,9 +1717,6 @@ kvm_events_record(struct perf_kvm_stat *kvm, int argc, const char **argv)
>  	record_usage = kvm_stat_record_usage;
>  	ret = cmd_record(i, rec_argv);
>  
> -EXIT:
> -	for (i = 0; i < rec_argc; i++)
> -		free((void *)rec_argv[i]);

[Severity: Medium]
This is a pre-existing issue, but does this exact same array-mutation bug still
exist in other functions within this file?

It looks like __cmd_record(), __cmd_report(), __cmd_buildid_list(), and
__cmd_top() all have this identical cleanup loop:

	for (i = 0; i < rec_argc; i++)
		free((void *)rec_argv[i]);

Since these functions also pass the allocated rec_argv array to command handlers
that use parse_options() (which consumes options in-place and shifts non-option
arguments forward), do these other commands also suffer from a double-free
and memory leak?

>  	free(rec_argv);
>  	return ret;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260803-perf-kvm-fixes-v2-0-1b337189fffc@gmail.com?part=2