From: Liu Jing <liujing@cmss.chinamobile.com>

In enable_sched_schedstats(), the FILE pointer fp is only closed when
ch == '0'. If ch is not '0' (i.e., sched_schedstats is already enabled),
the function returns 0 without calling fclose(fp), causing a resource
leak.

Fix it by adding fclose(fp) before the return statement.

Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
---
--- a/tools/perf/builtin-sched.c
+++ b/tools/perf/builtin-sched.c
@@ -4114,8 +4114,8 @@
 		*reset = 1;
 		rewind(fp);
 		putc('1', fp);
-		fclose(fp);
-	}
+	}
+	fclose(fp);
 	return 0;
 }

From: Liu Jing <liujing@cmss.chinamobile.com>

In intel_pt_bip(), the expression `1 << id` performs a signed integer
shift where id is a uint32_t. If id >= 32, this is undefined behavior.
The bounds check `id >= INTEL_PT_BLK_ITEM_ID_CNT` occurs after the shift,
so the UB has already happened.

Fix it by moving the bounds check before the shift and using `1U << id`
to perform an unsigned shift.

Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
---
--- a/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
+++ b/tools/perf/util/intel-pt-decoder/intel-pt-decoder.c
@@ -2060,7 +2060,6 @@
 static void intel_pt_bip(struct intel_pt_decoder *decoder)
 {
 	uint32_t id = decoder->packet.count;
-	uint32_t bit = 1 << id;
 	int pos = decoder->blk_type_pos;
 
 	if (pos < 0 || id >= INTEL_PT_BLK_ITEM_ID_CNT) {
@@ -2068,6 +2067,7 @@
 			     id, decoder->blk_type);
 		return;
 	}
+	uint32_t bit = 1U << id;
 
 	if (decoder->state.items.mask[pos] & bit) {
 		intel_pt_log("WARNING: Duplicate block item %u type %d\n",

From: Liu Jing <liujing@cmss.chinamobile.com>

In print_bstack_flags(), the variable `pos` is declared as `size_t`
(unsigned), making the check `pos < 0` always false. This means the
error return from snprintf() is never detected.

Fix it by changing the return type of bstack_event_str() to int and
the type of pos to int, so that negative return values from snprintf()
are properly checked.

Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
---
--- a/tools/perf/builtin-script.c
+++ b/tools/perf/builtin-script.c
@@ -952,7 +952,7 @@
 	return printed;
 }
 
-static inline size_t
+static inline int
 bstack_event_str(struct branch_entry *br, char *buf, size_t sz)
 {
 	if (!(br->flags.mispred || br->flags.predicted || br->flags.not_taken))
@@ -966,7 +966,7 @@
 static int print_bstack_flags(FILE *fp, struct branch_entry *br)
 {
 	char events[16] = { 0 };
-	size_t pos;
+	int pos;
 
 	pos = bstack_event_str(br, events, sizeof(events));
 	return fprintf(fp, "/%s/%c/%c/%d/%s/%s ",

From: Liu Jing <liujing@cmss.chinamobile.com>

In find_all_arm_spe_pmus(), if sprintf() fails, the function returns NULL
without freeing the previously allocated arm_spe_pmus array, causing a
memory leak.

Fix it by adding free(arm_spe_pmus) before the return NULL statement.

Signed-off-by: Liu Jing <liujing@cmss.chinamobile.com>
---
--- a/tools/perf/arch/arm/util/auxtrace.c
+++ b/tools/perf/arch/arm/util/auxtrace.c
@@ -39,6 +39,7 @@
 		if (ret < 0) {
 			pr_err("sprintf failed\n");
 			*err = -ENOMEM;
+			free(arm_spe_pmus);
 			return NULL;
 		}