Re: [PATCH perf-tools-next 1/3] perf trace: Introduce kernel symbol beautifier for virtual addresses

On Sat, Aug 15, 2026 at 11:44:46PM +0000, [email protected] wrote:
> Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
> - [High] Memory leak of reference-counted `struct map` handle in `syscall_arg__scnprintf_ksym`.
> --
> 
> --- Patch [1]: [PATCH perf-tools-next 1/3] perf trace: Introduce kernel symbol beautifier for virtual addresses ---
> commit 0ff39d14d9508d5e3c586057a78b07cbcda7f7fb
> Author: Aaron Tomlin <[email protected]>
> 
> perf trace: Introduce kernel symbol beautifier for virtual addresses
> 
> This commit adds a kernel symbol beautifier for perf trace to translate
> raw kernel virtual addresses into human-readable symbol names and offsets.
> It uses machine__find_kernel_symbol() to look up the symbols dynamically.
> 
> > diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> > index c3c7f1f85c530..102221b301a54 100644
> > --- a/tools/perf/builtin-trace.c
> > +++ b/tools/perf/builtin-trace.c
> 
> [ ... ]
> 
> > @@ -750,6 +750,30 @@ size_t syscall_arg__scnprintf_ptr(char *bf, size_t size, struct syscall_arg *arg
> >  	return syscall_arg__scnprintf_hex(bf, size, arg);
> >  }
> >  
> > +size_t syscall_arg__scnprintf_ksym(char *bf, size_t size, struct syscall_arg *arg)
> > +{
> > +	if (arg->val == 0)
> > +		return scnprintf(bf, size, "NULL");
> > +
> > +	if (arg->trace && arg->trace->host) {
> > +		struct map *map;
> > +		struct symbol *sym = machine__find_kernel_symbol(arg->trace->host,
> > +								 arg->val, &map);
> > +
> > +		if (sym) {
> > +			u64 start = map__unmap_ip(map, sym->start);
> > +			u64 offset = arg->val - start;
> > +
> > +			if (offset == 0)
> > +				return scnprintf(bf, size, "%s", sym->name);
> > +			return scnprintf(bf, size, "%s+0x%" PRIx64,
> > +					 sym->name, offset);
> 
> [Severity: High]
> Does this code leak the struct map reference?
> 
> When machine__find_kernel_symbol() populates the map pointer, it acquires a
> reference that the caller takes ownership of.
> 
> However, this function returns directly on both success paths and the fallback
> path without calling map__put(map). This will cause a memory leak for every
> formatted event that resolves to a valid map, which can quickly lead to memory
> exhaustion or LSAN crashes when running perf trace.

Yes, the code feedback is completely accurate. The implementation leaks a
reference to struct map.

-- 
Aaron Tomlin