* [PATCH] perf intel-bts: Free the old snapshot reference array after growing it
@ 2026-11-04 2:20 lirongqing
2026-11-04 10:00 ` James Clark
0 siblings, 1 reply; 3+ messages in thread
From: lirongqing @ 2026-11-04 2:20 UTC (permalink / raw)
To: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, James Clark, Li RongQing,
linux-perf-users, linux-kernel
From: Li RongQing <lirongqing@baidu.com>
The snapshot reference array grows when a mapping index exceeds its
capacity. Its old entries are copied into a new allocation, but the old
array is abandoned when snapshot_refs is replaced.
Release the old array after copying it so expanding past sixteen
mappings does not leak it.
Fixes: d0170af7004d ("perf tools: Add Intel BTS support")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
tools/perf/arch/x86/util/intel-bts.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/tools/perf/arch/x86/util/intel-bts.c b/tools/perf/arch/x86/util/intel-bts.c
index d44d568..9403681 100644
--- a/tools/perf/arch/x86/util/intel-bts.c
+++ b/tools/perf/arch/x86/util/intel-bts.c
@@ -299,6 +299,7 @@ static int intel_bts_alloc_snapshot_refs(struct intel_bts_recording *btsr,
memcpy(refs, btsr->snapshot_refs, cnt * sz);
+ free(btsr->snapshot_refs);
btsr->snapshot_refs = refs;
btsr->snapshot_ref_cnt = new_cnt;
--
2.9.4
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] perf intel-bts: Free the old snapshot reference array after growing it
2026-11-04 2:20 [PATCH] perf intel-bts: Free the old snapshot reference array after growing it lirongqing
@ 2026-11-04 10:00 ` James Clark
2026-11-04 21:18 ` Arnaldo Carvalho de Melo
0 siblings, 1 reply; 3+ messages in thread
From: James Clark @ 2026-11-04 10:00 UTC (permalink / raw)
To: lirongqing
Cc: Peter Zijlstra, Ingo Molnar, Arnaldo Carvalho de Melo,
Namhyung Kim, Mark Rutland, Alexander Shishkin, Jiri Olsa,
Ian Rogers, Adrian Hunter, linux-perf-users, linux-kernel
On 04/11/2026 02:20, lirongqing wrote:
> From: Li RongQing <lirongqing@baidu.com>
>
> The snapshot reference array grows when a mapping index exceeds its
> capacity. Its old entries are copied into a new allocation, but the old
> array is abandoned when snapshot_refs is replaced.
>
> Release the old array after copying it so expanding past sixteen
> mappings does not leak it.
>
> Fixes: d0170af7004d ("perf tools: Add Intel BTS support")
> Signed-off-by: Li RongQing <lirongqing@baidu.com>
> ---
> tools/perf/arch/x86/util/intel-bts.c | 1 +
> 1 file changed, 1 insertion(+)
>
> diff --git a/tools/perf/arch/x86/util/intel-bts.c b/tools/perf/arch/x86/util/intel-bts.c
> index d44d568..9403681 100644
> --- a/tools/perf/arch/x86/util/intel-bts.c
> +++ b/tools/perf/arch/x86/util/intel-bts.c
> @@ -299,6 +299,7 @@ static int intel_bts_alloc_snapshot_refs(struct intel_bts_recording *btsr,
>
> memcpy(refs, btsr->snapshot_refs, cnt * sz);
>
> + free(btsr->snapshot_refs);
> btsr->snapshot_refs = refs;
> btsr->snapshot_ref_cnt = new_cnt;
>
I made the same fix here [1] as well as turning BTS snapshots into the
generic one. But that doesn't have a fixes tag, so maybe this patch is
still useful.
Reviewed-by: James Clark <james.clark@linaro.org>
[1]:
https://lore.kernel.org/all/20261102-james-cs-unformatted-per-thread-fix-v3-10-dbcb0c281b9b@linaro.org/
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH] perf intel-bts: Free the old snapshot reference array after growing it
2026-11-04 10:00 ` James Clark
@ 2026-11-04 21:18 ` Arnaldo Carvalho de Melo
0 siblings, 0 replies; 3+ messages in thread
From: Arnaldo Carvalho de Melo @ 2026-11-04 21:18 UTC (permalink / raw)
To: James Clark
Cc: lirongqing, Peter Zijlstra, Ingo Molnar, Namhyung Kim,
Mark Rutland, Alexander Shishkin, Jiri Olsa, Ian Rogers,
Adrian Hunter, linux-perf-users, linux-kernel
On Wed, Nov 04, 2026 at 10:00:15AM +0000, James Clark wrote:
>
>
> On 04/11/2026 02:20, lirongqing wrote:
> > From: Li RongQing <lirongqing@baidu.com>
> >
> > The snapshot reference array grows when a mapping index exceeds its
> > capacity. Its old entries are copied into a new allocation, but the old
> > array is abandoned when snapshot_refs is replaced.
> >
> > Release the old array after copying it so expanding past sixteen
> > mappings does not leak it.
> >
> > Fixes: d0170af7004d ("perf tools: Add Intel BTS support")
> > Signed-off-by: Li RongQing <lirongqing@baidu.com>
> > ---
> > tools/perf/arch/x86/util/intel-bts.c | 1 +
> > 1 file changed, 1 insertion(+)
> >
> > diff --git a/tools/perf/arch/x86/util/intel-bts.c b/tools/perf/arch/x86/util/intel-bts.c
> > index d44d568..9403681 100644
> > --- a/tools/perf/arch/x86/util/intel-bts.c
> > +++ b/tools/perf/arch/x86/util/intel-bts.c
> > @@ -299,6 +299,7 @@ static int intel_bts_alloc_snapshot_refs(struct intel_bts_recording *btsr,
> > memcpy(refs, btsr->snapshot_refs, cnt * sz);
> > + free(btsr->snapshot_refs);
> > btsr->snapshot_refs = refs;
> > btsr->snapshot_ref_cnt = new_cnt;
>
> I made the same fix here [1] as well as turning BTS snapshots into the
> generic one. But that doesn't have a fixes tag, so maybe this patch is still
> useful.
>
> Reviewed-by: James Clark <james.clark@linaro.org>
>
> [1]: https://lore.kernel.org/all/20261102-james-cs-unformatted-per-thread-fix-v3-10-dbcb0c281b9b@linaro.org/
Thanks, applied for v7.4.
- Arnaldo
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-11-04 21:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-04 2:20 [PATCH] perf intel-bts: Free the old snapshot reference array after growing it lirongqing
2026-11-04 10:00 ` James Clark
2026-11-04 21:18 ` Arnaldo Carvalho de Melo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox