]> git.ipfire.org Git - thirdparty/kernel/stable.git/commitdiff
perf libdw: Fix libdw API contract violations and memory leaks
authorIan Rogers <irogers@google.com>
Mon, 4 May 2026 08:12:24 +0000 (01:12 -0700)
committerArnaldo Carvalho de Melo <acme@redhat.com>
Wed, 6 May 2026 00:49:59 +0000 (21:49 -0300)
Check return values of `dwfl_report_end` and `dwfl_module_addrdie`
to prevent using uninitialized stack variables or reporting success on
failure.

Additionally:
 - Ensure `*file` is freed and inline frames are cleared on error in
   `libdw__addr2line()` to prevent memory leaks and duplicated
   callchains when falling back to other unwinders.
 - Use `die_name()` safe wrapper inside the inline function unwinding
   callback (`libdw_a2l_cb`).
 - Refactor `libdw_a2l_cb`'s repeated memory error handling/cleanup
   paths using a cleaner goto control flow.

Fixes: b7a2b011e9627ff3 ("perf powerpc: Unify the skip-callchain-idx libdw with that for addr2line")
Fixes: 88c51002d06f9a68 ("perf addr2line: Add a libdw implementation")
Assisted-by: Gemini-CLI:Google Gemini 3
Signed-off-by: Ian Rogers <irogers@google.com>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: Ian Rogers <irogers@google.com>
Cc: Ingo Molnar <mingo@redhat.com>
Cc: James Clark <james.clark@linaro.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Masami Hiramatsu <mhiramat@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Zecheng Li <zli94@ncsu.edu>
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
tools/perf/util/libdw.c

index 196b9cdf51b26123c43652bc1fbbfaad4d514a3c..84713b2a7ad5da3932b13ddcb474150179ca54e0 100644 (file)
@@ -61,7 +61,10 @@ struct Dwfl *dso__libdw_dwfl(struct dso *dso)
                return NULL;
        }
 
-       dwfl_report_end(dwfl, /*removed=*/NULL, /*arg=*/NULL);
+       if (dwfl_report_end(dwfl, /*removed=*/NULL, /*arg=*/NULL) != 0) {
+               dwfl_end(dwfl);
+               return NULL;
+       }
        dso__set_libdw(dso, dwfl);
 
        return dwfl;
@@ -73,18 +76,19 @@ struct libdw_a2l_cb_args {
        struct inline_node *node;
        char *leaf_srcline;
        bool leaf_srcline_used;
+       int err;
 };
 
 static int libdw_a2l_cb(Dwarf_Die *die, void *_args)
 {
        struct libdw_a2l_cb_args *args  = _args;
-       struct symbol *inline_sym = new_inline_sym(args->dso, args->sym, dwarf_diename(die));
+       struct symbol *inline_sym = new_inline_sym(args->dso, args->sym, die_name(die));
        const char *call_fname = die_get_call_file(die);
        int call_lineno = die_get_call_lineno(die);
        char *call_srcline = srcline__unknown;
 
        if (!inline_sym)
-               return -ENOMEM;
+               goto abort_enomem;
 
        /* Assign caller information to the parent. */
        if (call_fname)
@@ -110,12 +114,27 @@ static int libdw_a2l_cb(Dwarf_Die *die, void *_args)
 
        /* Add this symbol to the chain as the leaf. */
        if (!args->leaf_srcline_used) {
-               inline_list__append_tail(inline_sym, args->leaf_srcline, args->node);
+               if (inline_list__append_tail(inline_sym, args->leaf_srcline, args->node) != 0)
+                       goto abort_delete_sym;
                args->leaf_srcline_used = true;
        } else {
-               inline_list__append_tail(inline_sym, strdup(args->leaf_srcline), args->node);
+               char *srcline = strdup(args->leaf_srcline);
+
+               if (!srcline)
+                       goto abort_delete_sym;
+               if (inline_list__append_tail(inline_sym, srcline, args->node) != 0) {
+                       free(srcline);
+                       goto abort_delete_sym;
+               }
        }
        return 0;
+
+abort_delete_sym:
+       if (inline_sym->inlined)
+               symbol__delete(inline_sym);
+abort_enomem:
+       args->err = -ENOMEM;
+       return DWARF_CB_ABORT;
 }
 
 int libdw__addr2line(u64 addr, char **file, unsigned int *line_nr,
@@ -169,11 +188,29 @@ int libdw__addr2line(u64 addr, char **file, unsigned int *line_nr,
                        .leaf_srcline = srcline_from_fileline(src ?: "<unknown>", lineno),
                };
 
+               if (!args.leaf_srcline) {
+                       if (file && *file) {
+                               free(*file);
+                               *file = NULL;
+                       }
+                       return 0;
+               }
+
                /* Walk from the parent down to the leaf. */
-               cu_walk_functions_at(cudie, addr, libdw_a2l_cb, &args);
+               if (cudie)
+                       cu_walk_functions_at(cudie, addr, libdw_a2l_cb, &args);
 
                if (!args.leaf_srcline_used)
                        free(args.leaf_srcline);
+
+               if (args.err) {
+                       if (file && *file) {
+                               free(*file);
+                               *file = NULL;
+                       }
+                       inline_node__clear_frames(node);
+                       return 0;
+               }
        }
        return 1;
 }