Re: [PATCH 4/4] perf timechart: Remove unnecessary copy of backtrace

[Arnaldo Carvalho de Melo <acme@kernel.org>]

On Thu, Jun 04, 2026 at 07:18:17PM +0000, sashiko-bot@kernel.org wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [Medium] Removing `free(backtrace)` causes severe memory leaks when the backtrace string is not consumed by the sample tracking logic.
> --

From a quick look the suggestions seems legit, will wait for v2 then.

- Arnaldo
 
> commit 8d24fd58d3a0d2702142c45fce31ca640b59f748
> Author: Namhyung Kim <namhyung@kernel.org>
> 
> perf timechart: Remove unnecessary copy of backtrace
> 
> This commit updates timechart to use the backtrace string directly instead
> of duplicating it with strdup(). It updates pid_put_sample() and
> sched_wakeup() to store the original pointer and removes the free()
> calls in the process_sample routines.
> 
> > diff --git a/tools/perf/builtin-timechart.c b/tools/perf/builtin-timechart.c
> > index 4efac73a714c5..2fd24d3aaa837 100644
> > --- a/tools/perf/builtin-timechart.c
> > +++ b/tools/perf/builtin-timechart.c
> 
> [ ... ]
> 
> > @@ -434,7 +434,7 @@ static void sched_wakeup(struct timechart *tchart, int cpu, u64 timestamp,
> >  
> >  	we->time = timestamp;
> >  	we->waker = waker;
> > -	we->backtrace = backtrace ? strdup(backtrace) : NULL;
> > +	we->backtrace = backtrace;
> 
> [Severity: Medium]
> Does this leak the dynamically allocated backtrace string from
> cat_backtrace() if the wake_event allocation fails?
> 
> tools/perf/builtin-timechart.c:sched_wakeup() {
> 	struct wake_event *we = zalloc(sizeof(*we));
> 
> 	if (!we)
> 		return;
>     ...
> }
> 
> Because the unconditional free() was removed from
> process_sample_sched_wakeup(), the backtrace pointer is dropped and
> leaked if zalloc() fails.
> 
> >  
> >  	if ((flags & TRACE_FLAG_HARDIRQ) || (flags & TRACE_FLAG_SOFTIRQ))
> >  		we->waker = -1;
> 
> [ ... ]
> 
> > @@ -678,7 +677,6 @@ process_sample_sched_switch(struct timechart *tchart,
> >  	backtrace = cat_backtrace(sample, &tchart->session->machines.host);
> >  	sched_switch(tchart, sample->cpu, sample->time, prev_pid, next_pid,
> >  		     prev_state, backtrace);
> > -	free((char *)backtrace);
> 
> [Severity: Medium]
> Will this leak the backtrace string if sched_switch() does not consume it?
> 
> tools/perf/builtin-timechart.c:sched_switch() {
> 	if (prev_p->current && prev_p->current->state != TYPE_NONE)
> 		pid_put_sample(tchart, prev_pid, TYPE_RUNNING, cpu,
> 			       prev_p->current->state_since, timestamp,
> 			       backtrace);
> 
> 	if (p && p->current) {
> 		if (p->current->state != TYPE_NONE)
> 			pid_put_sample(tchart, next_pid, p->current->state, cpu,
> 				       p->current->state_since, timestamp,
> 				       backtrace);
> 	}
>     ...
> }
> 
> If both TYPE_NONE conditions evaluate to true, pid_put_sample() is not
> called. The backtrace string goes unreferenced and is permanently lost
> now that the unconditional free() has been removed.
> 
> >  	return 0;
> >  }
> >
> 
> -- 
> Sashiko AI review · https://sashiko.dev/#/patchset/20260604190812.2168118-1-namhyung@kernel.org?part=4