[PATCH] perf synthetic-events: Check schedstat domain allocation failure

[PATCH] perf synthetic-events: Check schedstat domain allocation failure

[Hui Su]

__synthesize_schedstat_domain() uses event after zalloc() without
checking for allocation failure, unlike __synthesize_schedstat_cpu().

If zalloc() fails and returns NULL, dereferencing ds->header.type
immediately crashes with a segmentation fault:

  Program received signal SIGSEGV, Segmentation fault.
  0x00005555558aed8a in __synthesize_schedstat_domain ()
  #0  0x00005555558aed8a in __synthesize_schedstat_domain ()
  #1  0x00005555558b889a in perf_event__synthesize_schedstat ()
  #2  0x000055555563c397 in cmd_sched ()
  #3  0x00005555556583a1 in handle_internal_command ()
  #4  0x00005555555bf739 in main ()

perf_event__synthesize_schedstat() already treats a NULL event as an
error and cleans up, so return NULL when the allocation fails.

After this fix, an allocation failure returns NULL safely, allowing
the caller to exit gracefully without crashing:

  [ perf sched stats: Failed !! ]

Fixes: c3030995f23b ("perf sched stats: Add record and rawdump support")
Signed-off-by: Hui Su <sh_def@163.com>
---
 tools/perf/util/synthetic-events.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
index 0c150193cca8..24559691b88e 100644
--- a/tools/perf/util/synthetic-events.c
+++ b/tools/perf/util/synthetic-events.c
@@ -2776,6 +2776,8 @@ static union perf_event *__synthesize_schedstat_domain(struct io *io, __u16 vers
 	size = sizeof(*ds);
 	size = PERF_ALIGN(size, sizeof(u64));
 	event = zalloc(size);
+	if (!event)
+		return NULL;
 
 	ds = &event->schedstat_domain;
 	ds->header.type = PERF_RECORD_SCHEDSTAT_DOMAIN;
-- 
2.55.0

Re: [PATCH] perf synthetic-events: Check schedstat domain allocation failure

[Hui Su]

On Sat, Sep 12, 2026 at 03:21:14AM +0000, sashiko-bot@kernel.org wrote:
> [Severity: High]
> This isn't a bug introduced by this patch, but there is a pre-existing issue
> in the caller perf_event__synthesize_schedstat().
> 
> If the loop in perf_event__synthesize_schedstat() encounters a line starting
> with a character other than 'c' or 'd' (such as an unhandled trailing
> newline or a new record type from a newer kernel):
[...]
> Does this check incorrectly assume the event pointer is NULL if an unrecognized
> line is parsed?
> 
> Because the event pointer is freed at the end of the previous iteration but not
> reset to NULL, it retains a dangling pointer. The check if (!event) will pass,
> leading the code to actively pass the stale pointer to the process() callback:
[...]
> Could this trigger a use-after-free and a subsequent double-free?
> 
> Would it be safer to initialize the event pointer to NULL at the start of
> each loop iteration?

Good catch. I confirmed that this is a valid pre-existing bug.

After a successful iteration, `event` is freed but not reset to NULL. If a
subsequent iteration starts with an unrecognized schedstat record type, no new
event is assigned. The stale pointer therefore passes the `if (!event)` check,
may be passed to `process()`, and may then be freed again on that iteration.

While checking the event lifetime in this loop, I also noticed another
pre-existing issue: when `user_requested_cpus` filters out the synthesized
event, the `continue` path skips `free(event)`, leaking the event.

These issues were introduced in the same schedstat synthesis code, but they
are independent of the missing allocation check fixed by this patch. I will
keep this patch focused on the allocation failure and send a separate patch
fixing the event lifetime in `perf_event__synthesize_schedstat()`.

Thanks for catching this.

Hui

Re: [PATCH] perf synthetic-events: Check schedstat domain allocation failure

[Hui Su]

Hi Arnaldo,

A gentle ping on this patch.

The separate schedstat event lifetime issue found during review has since
been fixed and applied to perf-tools-next for v7.4. This allocation
failure fix is independent and is still outstanding.

Thanks,
Hui

Re: [PATCH] perf synthetic-events: Check schedstat domain allocation failure

[Arnaldo Carvalho de Melo]

On Sat, Sep 26, 2026 at 07:31:08PM +0900, Hui Su wrote:
> Hi Arnaldo,
> 
> A gentle ping on this patch.
> 
> The separate schedstat event lifetime issue found during review has since
> been fixed and applied to perf-tools-next for v7.4. This allocation
> failure fix is independent and is still outstanding.

Thanks, applied to perf-tools-next, for v7.4.

- Arnaldo