kernel/git/next/linux-next.git/tools/perf/util/dwarf-aux.c, branch master

perf dwarf-aux: Fix libdw API contract violations

2026-05-06T00:48:45+00:00

Check return values of `dwarf_decl_line` (where non-optional), `dwarf_getfuncs`, and `dwarf_lineaddr` to prevent using uninitialized stack variables or incorrectly reporting success on failure. For the root DIE in `die_walk_lines()`, `dwarf_decl_line` and `die_get_decl_file` are optional and their failures are handled gracefully to avoid breaking line walking on valid functions. Specifically, remove the strict `!decf` (declared file) check that would prematurely abort line walking on generated or artificial functions lacking this optional attribute. Additionally: - Add NULL pointer protection for `strcmp()` in `die_walk_lines()` when `inf` or `decf` are NULL to prevent crashes on generated code. - Use `dwarf_attr_integrate` in `die_get_data_member_location` to correctly resolve inherited member locations (e.g. via abstract origin or specification). Fixes: 57f95bf5f882 ("perf probe: Show correct statement line number by perf probe -l") Fixes: 3f4460a28fb2 ("perf probe: Filter out redundant inline-instances") Fixes: 75186a9b09e4 ("perf probe: Fix to show lines of sys_ functions correctly") Fixes: e0d153c69040 ("perf-probe: Move dwarf library routines to dwarf-aux.{c, h}") Fixes: 6243b9dc4c99 ("perf probe: Move dwarf specific functions to dwarf-aux.c") Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Ian Rogers Cc: Adrian Hunter Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Namhyung Kim Cc: Peter Zijlstra Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo

perf dwarf-aux: Fix libdw segmentation fault in cu_walk_functions_at

2026-05-06T00:47:32+00:00

A segmentation fault was observed in `libdw` when running `perf kmem` with `--page stat` on some workloads. The crash occurred deep inside `libdw` (specifically in `dwarf_child` and `dwarf_diename`) when processing DWARF information. The root cause was improper error handling of `dwarf_getfuncs` in `die_find_realfunc` and `die_find_tailfunc`. `dwarf_getfuncs` returns: - `0` on success (when all functions have been processed). - A positive offset if the callback aborts early (e.g., via `DWARF_CB_ABORT` when a match is found). - `-1` on error. The original code used `if (!dwarf_getfuncs(...)) return NULL;`. On error (`-1`), `!-1` evaluates to `0` (false), bypassing the error check. Execution then proceeded as if a match was found, returning uninitialized stack memory (`die_mem`) to the caller (`cu_walk_functions_at`). When `cu_walk_functions_at` passed this uninitialized memory to `libdw` via `dwarf_diename`, it caused a segmentation fault. Fix this by correcting the error check to `if (dwarf_getfuncs(...) <= 0)`. Fixes: e0d153c69040 ("perf-probe: Move dwarf library routines to dwarf-aux.{c, h}") Fixes: d4c537e6bf86 ("perf probe: Ignore tail calls to probed functions") Assisted-by: Gemini-CLI:Google Gemini 3 Signed-off-by: Ian Rogers Acked-by: Namhyung Kim Cc: Adrian Hunter Cc: Ingo Molnar Cc: James Clark Cc: Jiri Olsa Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Zecheng Li Signed-off-by: Arnaldo Carvalho de Melo

perf dwarf-aux: Collect all variable locations for insn tracking

2026-03-19T21:42:30+00:00

Previously, only the first DWARF location entry was collected for each variable. This was based on the assumption that instruction tracking could reconstruct the remaining state. However, variables may have different locations across different address ranges, and relying solely on instruction tracking can miss valid type information. Change __die_collect_vars_cb() to iterate over all location entries using dwarf_getlocations() in a loop. This ensures that variables with multiple location ranges are properly tracked, improving type coverage. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim

perf annotate-data: Use DWARF location ranges to preserve reg state

2026-03-19T21:42:29+00:00

When a function call occurs, caller-saved registers are typically invalidated since the callee may clobber them. However, DWARF debug info provides location ranges that indicate exactly where a variable is valid in a register. Track the DWARF location range end address in type_state_reg and use it to determine if a caller-saved register should be preserved across a call. If the current call address is within the DWARF-specified lifetime of the variable, keep the register state valid instead of invalidating it. This improves type annotation for code where the compiler knows a register value survives across calls (e.g., when the callee is known not to clobber certain registers or when the value is reloaded after the call at the same logical location). Changes: - Add `end` and `has_range` fields to die_var_type to capture DWARF location range information - Add `lifetime_active` and `lifetime_end` fields to type_state_reg - Check location lifetime before invalidating caller-saved registers Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim

perf dwarf-aux: Handle array types in die_get_member_type

2026-03-19T21:42:29+00:00

When a struct member is an array type, die_get_member_type() would stop iterating since array types weren't handled in the loop. This caused accesses to array elements within structs to not resolve properly. Add array type handling by resolving the array to its element type and calculating the offset within an element using modulo arithmetic This improves type annotation coverage for struct members that are arrays. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim

perf dwarf-aux: Skip check_variable for variable lookup

2026-03-19T21:42:29+00:00

Both die_find_variable_by_reg and die_find_variable_by_addr call match_var_offset which already performs sufficient checking and type matching. The additional check_variable call is redundant, and its need_pointer logic is only a heuristic. Since DWARF encodes accurate type information, which match_var_offset verifies, skipping check_variable improves both coverage and accuracy. Return the matched type from die_find_variable_by_reg and die_find_variable_by_addr via the existing `type` field in find_var_data, removing the need for check_variable in find_data_type_die. Signed-off-by: Zecheng Li Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim

perf dwarf-aux: Preserve typedefs in match_var_offset

2026-03-19T21:42:29+00:00

Preserve typedefs in match_var_offset to match the results by __die_get_real_type. Also move the (offset == 0) branch after the is_pointer check to ensure the correct type is used, fixing cases where an incorrect pointer type was chosen when the access offset was 0. Signed-off-by: Zecheng Li Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim

perf dwarf-aux: Add die_get_pointer_type to get pointer types

2026-03-19T21:42:29+00:00

When a variable type is wrapped in typedef/qualifiers, callers may need to first resolve it to the underlying DW_TAG_pointer_type or DW_TAG_array_type. A simple tag check is not enough and directly calling __die_get_real_type() can stop at the pointer type (e.g. typedef -> pointer) instead of the pointee type. Add die_get_pointer_type() helper that follows typedef/qualifier chains and returns the underlying pointer DIE. Use it in annotate-data.c so pointer checks and dereference work correctly for typedef'd pointers. Signed-off-by: Zecheng Li Signed-off-by: Namhyung Kim

perf dwarf-aux: Fix __die_find_scope_cb() for namespaces

2025-09-19T15:14:30+00:00

Currently __die_find_scope_cb() goes to check siblings when the DIE doesn't include the given PC. However namespaces don't have a PC and could contain children that have that PC. When we encounter a namespace, we should check both its children and siblings. Reviewed-by: Namhyung Kim Signed-off-by: Zecheng Li Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Xu Liu Link: https://lore.kernel.org/r/20250825195817.226560-1-zecheng@google.com Signed-off-by: Arnaldo Carvalho de Melo

perf dwarf-aux: Better variable collection for insn tracking

2025-09-19T15:14:30+00:00

Utilizes the previous is_breg_access_indirect function to determine if the register + offset stores the variable itself or the struct it points to, save the information in die_var_type.is_reg_var_addr. Since we are storing the real types in the stack state, we need to do a type dereference when is_reg_var_addr is set to false for stack/frame registers. For other gp registers, skip the variable when the register is a pointer to the type. If we want to accept these variables, we might also utilize is_reg_var_addr in a different way, we need to mark that register as a pointer to the type. Reviewed-by: Namhyung Kim Signed-off-by: Zecheng Li Cc: Adrian Hunter Cc: Alexander Shishkin Cc: Ian Rogers Cc: Ingo Molnar Cc: Jiri Olsa Cc: Kan Liang Cc: Mark Rutland Cc: Masami Hiramatsu Cc: Peter Zijlstra Cc: Xu Liu Signed-off-by: Arnaldo Carvalho de Melo