[PATCH] perf machine: Fix NULL deref in thread__resolve_callchain_sample()

[PATCH] perf machine: Fix NULL deref in thread__resolve_callchain_sample()

[lv.yating]

From: lvyating <lv.yating@zte.com.cn>

When recording with -j stack, resolve_lbr_callchain_sample() can
dereference a NULL 'chain' pointer while resolving the branch
stack.

$ perf record -j stack -e branches:u uname
perf: Segmentation fault

Fix it by checking 'chain' for NULL before dereferencing it.

Fixes: 29be60c93d2d ("perf build-id: Mark DSO in sample callchains")
Signed-off-by: lvyating <lv.yating@zte.com.cn>
Cc: stable@vger.kernel.org
---
 tools/perf/util/machine.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
index f86b3b7df742..10a88c070814 100644
--- a/tools/perf/util/machine.c
+++ b/tools/perf/util/machine.c
@@ -2858,7 +2858,7 @@ static int thread__resolve_callchain_sample(struct thread *thread,
 	if (chain)
 		chain_nr = chain->nr;

-	if (evsel__has_branch_callstack(evsel)) {
+	if (chain && evsel__has_branch_callstack(evsel)) {
 		struct perf_env *env = evsel__env(evsel);

 		err = resolve_lbr_callchain_sample(thread, cursor, sample, parent,
-- 
2.27.0

Re: [PATCH] perf machine: Fix NULL deref in thread__resolve_callchain_sample()

[Ian Rogers]

On Tue, Oct 27, 2026 at 4:54 AM <lv.yating@zte.com.cn> wrote:
>
> From: lvyating <lv.yating@zte.com.cn>
>
> When recording with -j stack, resolve_lbr_callchain_sample() can
> dereference a NULL 'chain' pointer while resolving the branch
> stack.
>
> $ perf record -j stack -e branches:u uname
> perf: Segmentation fault
>
> Fix it by checking 'chain' for NULL before dereferencing it.
>
> Fixes: 29be60c93d2d ("perf build-id: Mark DSO in sample callchains")
> Signed-off-by: lvyating <lv.yating@zte.com.cn>
> Cc: stable@vger.kernel.org

Tested-by: Ian Rogers <irogers@google.com>
Reviewed-by: Ian Rogers <irogers@google.com>

I wonder - this failure points to a lack of test coverage. For LBR the
main coverage comes from:
https://web.git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/tree/tools/perf/tests/shell/record_lbr.sh?h=perf-tools-next
Could you help expand the tests to avoid regressions?

Thanks,
Ian

> ---
>  tools/perf/util/machine.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
> index f86b3b7df742..10a88c070814 100644
> --- a/tools/perf/util/machine.c
> +++ b/tools/perf/util/machine.c
> @@ -2858,7 +2858,7 @@ static int thread__resolve_callchain_sample(struct thread *thread,
>         if (chain)
>                 chain_nr = chain->nr;
>
> -       if (evsel__has_branch_callstack(evsel)) {
> +       if (chain && evsel__has_branch_callstack(evsel)) {
>                 struct perf_env *env = evsel__env(evsel);
>
>                 err = resolve_lbr_callchain_sample(thread, cursor, sample, parent,
> --
> 2.27.0

Re: [PATCH] perf machine: Fix NULL deref in thread__resolve_callchain_sample()

[Arnaldo Carvalho de Melo]

On Tue, Oct 27, 2026 at 08:21:16AM -0700, Ian Rogers wrote:
> On Tue, Oct 27, 2026 at 4:54 AM <lv.yating@zte.com.cn> wrote:
> > When recording with -j stack, resolve_lbr_callchain_sample() can
> > dereference a NULL 'chain' pointer while resolving the branch
> > stack.

> > $ perf record -j stack -e branches:u uname
> > perf: Segmentation fault

> > Fix it by checking 'chain' for NULL before dereferencing it.

> > Fixes: 29be60c93d2d ("perf build-id: Mark DSO in sample callchains")
> > Signed-off-by: lvyating <lv.yating@zte.com.cn>
> > Cc: stable@vger.kernel.org
 
> Tested-by: Ian Rogers <irogers@google.com>
> Reviewed-by: Ian Rogers <irogers@google.com>

Thanks, applied for v7.4.
 
> I wonder - this failure points to a lack of test coverage. For LBR the
> main coverage comes from:
> https://web.git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools-next.git/tree/tools/perf/tests/shell/record_lbr.sh?h=perf-tools-next
> Could you help expand the tests to avoid regressions?

That would be great indeed,

- Arnaldo

Re: [PATCH] perf machine: Fix NULL deref in thread__resolve_callchain_sample()

[hu.shengming]

lv.yating@zte.com.cn wrote:

> From: lvyating <lv.yating@zte.com.cn>
> 
> When recording with -j stack, resolve_lbr_callchain_sample() can
> dereference a NULL 'chain' pointer while resolving the branch
> stack.
> 
> $ perf record -j stack -e branches:u uname
> perf: Segmentation fault
> 
> Fix it by checking 'chain' for NULL before dereferencing it.
> 
> Fixes: 29be60c93d2d ("perf build-id: Mark DSO in sample callchains")
> Signed-off-by: lvyating <lv.yating@zte.com.cn>
> Cc: stable@vger.kernel.org

LGTM!
Reviewed-by: Shengming Hu <hu.shengming@zte.com.cn>

--
With Best Regards,
Shengming

> ---
> tools/perf/util/machine.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/machine.c b/tools/perf/util/machine.c
> index f86b3b7df742..10a88c070814 100644
> --- a/tools/perf/util/machine.c
> +++ b/tools/perf/util/machine.c
> @@ -2858,7 +2858,7 @@ static int thread__resolve_callchain_sample(struct thread *thread,
> if (chain)
> chain_nr = chain->nr;
> 
> - if (evsel__has_branch_callstack(evsel)) {
> + if (chain && evsel__has_branch_callstack(evsel)) {
> struct perf_env *env = evsel__env(evsel);
> 
> err = resolve_lbr_callchain_sample(thread, cursor, sample, parent,
> --
> 2.27.0