On Thu, Oct 02, 2025 at 01:49:38PM -0400, Steven Rostedt wrote: > On Mon, 08 Sep 2025 13:53:23 -0400 > Steven Rostedt <[email protected]> wrote: > > > +static int evlist__deliver_deferred_samples(struct evlist *evlist, > > + const struct perf_tool *tool, > > + union perf_event *event, > > + struct perf_sample *sample, > > + struct machine *machine) > > +{ > > + struct deferred_event *de, *tmp; > > + struct evsel *evsel; > > + int ret = 0; > > + > > + if (!tool->merge_deferred_callchains) { > > + evsel = evlist__id2evsel(evlist, sample->id); > > + return tool->callchain_deferred(tool, event, sample, > > + evsel, machine); > > + } > > + > > + list_for_each_entry_safe(de, tmp, &evlist->deferred_samples, list) { > > + struct perf_sample orig_sample; > > orig_sample is not initialized and can then contain junk. > > > + > > + ret = evlist__parse_sample(evlist, de->event, &orig_sample); > > + if (ret < 0) { > > + pr_err("failed to parse original sample\n"); > > + break; > > + } > > + > > + if (sample->tid != orig_sample.tid) > > + continue; > > + > > + if (event->callchain_deferred.cookie == > > orig_sample.deferred_cookie) > > + sample__merge_deferred_callchain(&orig_sample, sample); > > The sample__merge_deferred_callchain() initializes both > orig_sample.deferred_callchain and the callchain. But now that it's not > being called, it can cause the below free to happen with junk as the > callchain. This needs: > > else > orig_sample.deferred_callchain = false;
Ah, so I saw crashes from here and just deleted both free()s and got on with things ;-) > > + > > + evsel = evlist__id2evsel(evlist, orig_sample.id); > > + ret = evlist__deliver_sample(evlist, tool, de->event, > > + &orig_sample, evsel,> machine); + > > + if (orig_sample.deferred_callchain) > > + free(orig_sample.callchain); > > + > > + list_del(&de->list); > > + free(de); > > + > > + if (ret) > > + break; > > + } > > + return ret; > > +} > > -- Steve
