Re: [PATCH V5 5/6] tools/perf: Add powerpc HTM auxtrace event processing support

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] If multiple `PERF_RECORD_AUXTRACE_INFO` events are encountered, `session->auxtrace` is overwritten without freeing the previously allocated structures, leading to a memory leak.
--

--- Patch [5]: [PATCH V5 5/6] tools/perf: Add powerpc HTM auxtrace event processing support ---
commit bdf509e26b28cea056c3306c8b70fad62802e9ca
Author: Athira Rajeev <atrajeev@linux.ibm.com>

tools/perf: Add powerpc HTM auxtrace event processing support

Add the powerpc-htm.c decode stub and wire the dispatch in
perf_event__process_auxtrace_info() to call
powerpc_htm_process_auxtrace_info().

> diff --git a/tools/perf/util/powerpc-htm.c b/tools/perf/util/powerpc-htm.c
> new file mode 100644
> index 0000000000000..0ef7ecd18c6f3
> --- /dev/null
> +++ b/tools/perf/util/powerpc-htm.c
[ ... ]
> +int powerpc_htm_process_auxtrace_info(union perf_event *event,
> +				      struct perf_session *session)
> +{
> +	struct perf_record_auxtrace_info *auxtrace_info = &event->auxtrace_info;
> +	struct powerpc_htm *htm;
> +	int err;
[ ... ]
> +	htm = zalloc(sizeof(struct powerpc_htm));
> +	if (!htm)
> +		return -ENOMEM;
> +
> +	err = auxtrace_queues__init(&htm->queues);
> +	if (err) {
> +		free(htm);
> +		return err;
> +	}
> +
> +	htm->session = session;
> +	htm->machine = &session->machines.host;
> +	htm->auxtrace.process_event = powerpc_htm_process_event;
> +	htm->auxtrace.process_auxtrace_event = powerpc_htm_process_auxtrace_event;
> +	htm->auxtrace.flush_events = powerpc_htm_flush;
> +	htm->auxtrace.free_events = powerpc_htm_free_events;
> +	htm->auxtrace.free = powerpc_htm_free;
> +	session->auxtrace = &htm->auxtrace;

[Severity: Medium]
This isn't a bug introduced by this patch, but if multiple
PERF_RECORD_AUXTRACE_INFO events are encountered in
powerpc_htm_process_auxtrace_info(), does this overwrite session->auxtrace
without freeing the previously allocated structures?

Could a maliciously crafted perf.data file containing multiple such events
trigger a memory leak here?

> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260807144135.2607-1-atrajeev@linux.ibm.com?part=5