Linked list not compounding during execution - c

Question

I am trying to create a linked list that stores return instructions while parsing an assembly code file. As an explanation for the code, when encountering a call instruction the address of the next instruction is to be saved. When encountering a return instruction, the linked list is supposed to be traversed until it reaches a point when the next node is NULL. For some reason the code is not saving the return addresses. Might it have something to do with the recursion?
//function to create a node in linked list
struct ret_addr *return_address(cs_insn *insn, struct ret_addr *r) {
struct ret_addr *ret = malloc(sizeof(*ret));
ret->address = insn->address + insn->size;
ret->nxt_ret_addr = r;
return ret;
}
//retrieve the data from the last node of the linked list
int return_val(struct ret_addr *r) {
if(r == NULL)
return 0;
while(r->nxt_ret_addr != NULL) {
r = r->nxt_ret_addr;
return r->address;
}
}
//parse assembly code
struct bb_data *disassemble_function_cfg(int startAddr, unsigned char *bytes, int end_section) {
csh handle;
cs_insn *insn;
cs_detail *detail;
size_t count;
int stop_disasm = 0;
struct ret_addr *r_data = malloc(sizeof(*r_data));
count = cs_disasm(handle, bytes, end_section, startAddr, 1, &insn);
detail = insn->detail;
for(int n = 0; n < detail->groups_count; n++) {
if(detail->groups[n] == X86_GRP_CALL) {
stop_disasm = 1;
r_data = return_address(insn, r_data);
}
else if(detail->groups[n] == X86_GRP_RET) {
stop_disasm = 1;
start_edge = return_val(r_data);
}
if(!stop_disasm)
disassemble_function_cfg(insn->address + insn->size, bytes + insn->size, end_section);
else
return edges;
}
During an inital call instruction the return value is saved (checked by printing it out), but when reaching a return instruction the linked list is suddenly empty. My idea is that this is caused by the constant calls to malloc, but am unsure if that is a correct assumption.

Answer 1

The problem is in the return_val function : it does not modify the r_datavalue from the caller function disassemble_function_cfg.
There's also one little thing I assumed : since it is a call/return implementation, the linked list should behave as LIFO (last in first out). The return_address function fills the linked list by inserting in the head, so the return_val function should remove address from the head first : there's no need to read the list until reaching NULL.
Try this code :
//retrieve the data from the last node of the linked list
int return_val(struct ret_addr **r) {
int ret_val;
if (*r == NULL)
return 0;
ret_val = (*r)->address;
*r = (*r)->nxt_ret_addr;
return ret_val;
}
In the caller function :
else if(detail->groups[n] == X86_GRP_RET) {
stop_disasm = 1;
start_edge = return_val(&r_data); // address of r_data, so it can be modified
}