Re: [PATCH v4 2/3] perf dwarf-aux: Add C++ vtable helpers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] perf dwarf-aux: unbounded recursion in __die_find_member_offset_cb()
--

commit 3556b432528cd90397fc56862bef26cf9afde995
Author: Yanbo Zhao <yzhao62@ncsu.edu>

perf dwarf-aux: Add C++ vtable helpers

This commit adds DWARF helper functions (die_get_vtable_index(),
die_find_virtual_func(), die_is_vtbl_ptr_type(), die_get_vptr_class(), and
die_deref_vptr_class()) to support static resolution of C++ virtual function
calls during data type profiling.

> diff --git a/tools/perf/util/dwarf-aux.c b/tools/perf/util/dwarf-aux.c
> index eb4b8f3475df1..10079f47a6c38 100644
> --- a/tools/perf/util/dwarf-aux.c
> +++ b/tools/perf/util/dwarf-aux.c
> @@ -2293,6 +2293,239 @@ Dwarf_Die *die_get_member_type(Dwarf_Die *type_die, int offset,

[ ... ]

> +static int __die_find_primary_base_cb(Dwarf_Die *die_mem, void *arg __maybe_unused)
> +{
> +	Dwarf_Attribute attr;
> +	Dwarf_Die base_die, vptr_die;
> +	Dwarf_Word loc, virtuality;
> +
> +	if (dwarf_tag(die_mem) != DW_TAG_inheritance)
> +		return DIE_FIND_CB_SIBLING;
> +
> +	/* The attribute can be present with DW_VIRTUALITY_none */
> +	if (dwarf_attr_integrate(die_mem, DW_AT_virtuality, &attr) &&
> +	    dwarf_formudata(&attr, &virtuality) == 0 &&
> +	    virtuality != DW_VIRTUALITY_none)
> +		return DIE_FIND_CB_SIBLING;
> +
> +	if (die_get_data_member_location(die_mem, &loc) < 0 || loc != 0)
> +		return DIE_FIND_CB_SIBLING;
> +
> +	if (die_get_real_type(die_mem, &base_die) == NULL)
> +		return DIE_FIND_CB_SIBLING;
> +
> +	/* It should have the vtable pointer at offset 0 */
> +	if (die_get_vptr_class(&base_die, 0, &vptr_die) == NULL)
> +		return DIE_FIND_CB_SIBLING;
> +
> +	return DIE_FIND_CB_END;
> +}

[ ... ]

> +Dwarf_Die *die_get_vptr_class(Dwarf_Die *type_die, int offset,
> +			      Dwarf_Die *die_mem)
> +{
> +	Dwarf_Die class_die = *type_die;
> +	Dwarf_Die vptr_class = *type_die;
> +	Dwarf_Die member_die, mb_type;
> +	Dwarf_Word loc;
> +	int chase = 0;
> +
> +	while (die_is_compound_type(&class_die)) {
> +		if (++chase > MAX_TYPE_CHASE) {
> +			pr_debug("DWARF: base class chase limit reached at DIE 0x%lx\n",
> +				 (unsigned long)dwarf_dieoffset(type_die));
> +			return NULL;
> +		}
> +
> +		if (die_find_child(&class_die, __die_find_member_offset_cb,
> +				   (void *)(long)offset, &member_die) == NULL)
> +			return NULL;

[Severity: Medium]
As reported by Namhyung Kim on v2 [1], broken DWARF debug info with cyclic
inheritance requires recursion depth limits when chasing base classes.

While die_get_vptr_class() and die_find_virtual_func() add a MAX_TYPE_CHASE
check on their outer loops, die_get_vptr_class() (which is also invoked by
die_find_virtual_func() -> __die_find_primary_base_cb() ->
die_get_vptr_class()) calls die_find_child() with
__die_find_member_offset_cb() on its first iteration (chase == 1).

Inside __die_find_member_offset_cb(), when encountering a DW_TAG_inheritance
child with offset >= loc, it recurses into base_die without a depth limit:

tools/perf/util/dwarf-aux.c:__die_find_member_offset_cb() {
	...
	if (tag == DW_TAG_inheritance) {
		Dwarf_Die base_die, member_die;
		...
		if (offset < loc)
			return DIE_FIND_CB_SIBLING;

		if (die_get_real_type(die_mem, &base_die) == NULL)
			return DIE_FIND_CB_SIBLING;

		if (die_find_child(&base_die, __die_find_member_offset_cb,
				   (void *)(long)(offset - loc), &member_die))
			return DIE_FIND_CB_END;

		return DIE_FIND_CB_SIBLING;
	}
	...
}

If a binary has malformed DWARF with cyclic DW_TAG_inheritance (for example,
at offset 0), won't __die_find_member_offset_cb() recurse until stack
exhaustion on the first iteration before returning to the outer MAX_TYPE_CHASE
loop in die_get_vptr_class() or die_find_virtual_func()?

[1] https://lore.kernel.org/r/asA1u7LBRp2gqbWI@google.com

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103155650.269973-1-yzhao62@ncsu.edu?part=2