[PATCH] perf unwind: handle allocation failure in libdw__get_entries()

[PATCH] perf unwind: handle allocation failure in libdw__get_entries()

[Triet Hoang]

Check the return value of zalloc() before dereferencing the allocated
dwfl_ui_ti structure.

Return -ENOMEM when the allocation fails to avoid a NULL pointer
dereference.

Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
---
 tools/perf/util/unwind-libdw.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index 7f35042be567..ff36552ca175 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -379,6 +379,9 @@ int libdw__get_entries(unwind_entry_cb_t cb, void *arg,
 		dwfl = dwfl_ui_ti->dwfl;
 	} else {
 		dwfl_ui_ti = zalloc(sizeof(*dwfl_ui_ti));
+		if (!dwfl_ui_ti)
+			return -ENOMEM;
+
 		dwfl = dwfl_begin(&offline_callbacks);
 		if (!dwfl)
 			goto out;
-- 
2.53.0

Re: [PATCH] perf unwind: handle allocation failure in libdw__get_entries()

[sashiko-bot]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Memory leak of `ui` structure upon `dwfl_ui_ti` allocation failure.
--

--- Patch [1]: [PATCH] perf unwind: handle allocation failure in libdw__get_entries() ---
commit cfa13e49d271d0f1a99af3ba9b78fd579579b1d0
Author: Triet Hoang <triet.hoang.dev@gmail.com>

perf unwind: handle allocation failure in libdw__get_entries()

This commit adds a return value check for zalloc() when allocating the
dwfl_ui_ti structure. It returns -ENOMEM upon failure to avoid a NULL
pointer dereference.

> diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
> index 7f35042be5677..ff36552ca1759 100644
> --- a/tools/perf/util/unwind-libdw.c
> +++ b/tools/perf/util/unwind-libdw.c
[ ... ]
> @@ -379,6 +379,9 @@ int libdw__get_entries(unwind_entry_cb_t cb, void *arg,
>  		dwfl = dwfl_ui_ti->dwfl;
>  	} else {
>  		dwfl_ui_ti = zalloc(sizeof(*dwfl_ui_ti));
> +		if (!dwfl_ui_ti)
> +			return -ENOMEM;

[Severity: Medium]
Does this code leak the previously allocated ui structure?

Earlier in libdw__get_entries(), ui is allocated with:

    ui = zalloc(sizeof(*ui) + sizeof(ui->entries[0]) * max_stack);

Returning directly here bypasses the cleanup path at the out label, which
normally calls free(ui). Should we free the ui structure before returning
-ENOMEM?

> +
>  		dwfl = dwfl_begin(&offline_callbacks);
>  		if (!dwfl)
>  			goto out;

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260818142400.729633-1-triet.hoang.dev@gmail.com?part=1

[PATCH v2] perf unwind: handle allocation failure in libdw__get_entries()

[Triet Hoang]

Check the return value of zalloc() before dereferencing the allocated
dwfl_ui_ti structure.

Return -ENOMEM when the allocation fails to avoid a NULL pointer
dereference.

Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>
---
Changes in v2:
- Free the ui structure before returning -ENOMEM to avoid memory leak.
---
 tools/perf/util/unwind-libdw.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/tools/perf/util/unwind-libdw.c b/tools/perf/util/unwind-libdw.c
index 7f35042be567..fd8a5125468c 100644
--- a/tools/perf/util/unwind-libdw.c
+++ b/tools/perf/util/unwind-libdw.c
@@ -379,6 +379,11 @@ int libdw__get_entries(unwind_entry_cb_t cb, void *arg,
 		dwfl = dwfl_ui_ti->dwfl;
 	} else {
 		dwfl_ui_ti = zalloc(sizeof(*dwfl_ui_ti));
+		if (!dwfl_ui_ti) {
+			free(ui);
+			return -ENOMEM;
+		}
+
 		dwfl = dwfl_begin(&offline_callbacks);
 		if (!dwfl)
 			goto out;
-- 
2.53.0

Re: [PATCH v2] perf unwind: handle allocation failure in libdw__get_entries()

[sashiko-bot]

> Check the return value of zalloc() before dereferencing the allocated
> dwfl_ui_ti structure.
> 
> Return -ENOMEM when the allocation fails to avoid a NULL pointer
> dereference.
> 
> Signed-off-by: Triet Hoang <triet.hoang.dev@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260818144837.741469-1-triet.hoang.dev@gmail.com?part=1

Re: [PATCH v2] perf unwind: handle allocation failure in libdw__get_entries()

[Markus Elfring]

> Check the return value of zalloc() before dereferencing the allocated
> dwfl_ui_ti structure.
> 
> Return -ENOMEM when the allocation fails to avoid a NULL pointer
> dereference.

How do you think about to add any tags (like “Fixes” and “Cc”) accordingly?
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/submitting-patches.rst?h=v7.2#n145
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/Documentation/process/stable-kernel-rules.rst?h=v7.2#n34

https://elixir.bootlin.com/linux/v7.2-rc7/source/tools/perf/util/unwind-libdw.c#L342-L447

Regards,
Markus