Re: [PATCH 4/7] perf annotate-data: Bound the member nesting recursion

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] perf: primitive fields incorrectly marked as truncated at max depth
--

commit 53c26f5303c3adc8952e84e580aba93503743c50
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf annotate-data: Bound the member nesting recursion

This commit introduces a recursion depth limit of 32 when adding members
from DWARF debug information. It prevents infinite recursion caused by
broken DIEs that point back to their own ancestors by marking deep members
as truncated and stopping further parsing.

> diff --git a/tools/perf/util/annotate-data.c b/tools/perf/util/annotate-data.c
> index 2ad6d012e069c..f44fb333bc674 100644
> --- a/tools/perf/util/annotate-data.c
> +++ b/tools/perf/util/annotate-data.c

[ ... ]

> @@ -289,10 +300,19 @@ static int __add_member_cb(Dwarf_Die *die, void *arg)
>  	}
>  	member->size = size;
>  	member->offset = loc + parent->offset;
> +	member->depth = parent->depth + 1;
>  	INIT_LIST_HEAD(&member->children);
>  	list_add_tail(&member->node, &parent->children);
>  
>  	tag = dwarf_tag(&die_mem);
> +	if (member->depth >= MAX_MEMBER_DEPTH) {
> +		/* Reported by the JSON exporter so consumers can tell a truncated tree. */
> +		member->truncated = true;
> +		pr_debug_dtp("member nesting limit reached at %s\n",
> +			     member->type_name ?: "(unknown type)");
> +		return DIE_FIND_CB_SIBLING;
> +	}
> +

[Severity: Medium]
Will this depth check incorrectly flag primitive fields as truncated?

Because this check happens before evaluating the member's DWARF tag, when a
structure at depth 31 is processed, all of its fields reach depth 32.

If one of those fields is a primitive type (like an int) that inherently has
no children, it seems it will still be marked with member->truncated = true
and trigger the pr_debug_dtp() log.

Should this depth limit evaluation happen after confirming the member is an
aggregate type (like a structure or union) that actually has children to
expand?

>  	switch (tag) {
>  	case DW_TAG_structure_type:
>  	case DW_TAG_union_type:
>  		die_find_child(&die_mem, __add_member_cb, member, &die_mem);
>  		break;
>  	default:
>  		break;
>  	}
>  	return DIE_FIND_CB_SIBLING;
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260921164813.6727-1-acme@kernel.org?part=4