From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f201.google.com (mail-pg1-f201.google.com [209.85.215.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5F99A3A59A3 for ; Thu, 16 Jul 2026 07:24:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784186649; cv=none; b=jXY9lgjYvDO5/DSzphUtgbQKjZn90jNt/9f6sEa+633G/2VlP7InYxvnCQDQicWURt748L+/YIjkUL1IxzskdLKh1rR7FnfnGCPsPXLRNRdlgUdD8Wf2xRvSTlUrCHLoSi4rh7uakX4PMunkGVBJqagm08p7TjSiwkHxZs/CWag= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784186649; c=relaxed/simple; bh=V3CKY655jvssuX5wbgLMKNRXpIhsZ/RQAR7Ea+aV3dc=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=C94iFEtlbkwG7BtYCsmHjtnes+EqZp/3BL9R1OLXUm+TLrY/Vy0FHc/ots8p1oWOa1lTWGn+GDZwa8fi6qtkDAq1eCiarnaiZE6So6PfYuup/RLSUkwif2GHEK5QHCzv+bEYPUmetQjgCZkG5O9Ox+4Tm8hTCQndT4/SG//yf9U= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=dluSy+Qj; arc=none smtp.client-ip=209.85.215.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="dluSy+Qj" Received: by mail-pg1-f201.google.com with SMTP id 41be03b00d2f7-c88da04b719so2801341a12.2 for ; Thu, 16 Jul 2026 00:24:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784186641; x=1784791441; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Dpkr39l7sOTtT3gomIyyA2FswdcfqqwWFusHQlL4atk=; b=dluSy+Qjk9+CI0oar3CN6VKSZnXh0OzKo4sTiQJEoBpd1IIgARAkEnQDDWm8UYKDah RjL1ZS0aDZMPKqTQvd/QUB84AWo+PwJkYZJiKEhnjLTrK5hu9n9/g1X3RJ/BjC4kanWS c1XGlGpdwEU3Fm36X9C93ACbTBei8cdXB7B+GfjQwRfeKTHQHngLVgdiVgMkFwIoq7nb Zw1X55k9XGhUct6Webe9oPDMnNB1/zWXLApgTtbK/WwAgaEPOegXNudM/P8T869Lk6FE oiBC0aUXFhk96A6b1RYbYHOekDpZeRs6QyEZWf/YSGya8nVPju30gPx4Y2JP1KDKLfcG athQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784186641; x=1784791441; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Dpkr39l7sOTtT3gomIyyA2FswdcfqqwWFusHQlL4atk=; b=APABJ/2wyz7QzxI5tjmrQJiuIHkKUeIezdP93+yrxNclDkrUk8M038HlJmPrxUGs2f v0GnFQcgbfVXbKDamhjqsRiu4qyGmUW2KsWyj810HYqd02XrNBFCj6EYg5U23ooQJPRz MFtEX1MsSOS9Hzz8a7IAFLcU4HNGOCzHQV5T24+/hv5koAhHRzjwCA6hBETE+GMW+KC9 FGWn8gf5Q6pOHsaiqAf52UIV3Gxwy761hXBTIiwXCstSMu7NKi/omU2fSXuJFptx/RQ8 zXuL8+2nItt4U6qGewpEFfbsq6/EYEoErDvOSZsQg3+e6vr+9wHUCGGmbU2lJdiQDJ3z 4Alw== X-Forwarded-Encrypted: i=1; AHgh+RrJ9n41e6IrpZvXn8g4gQfDbKQrw69/ef/tHtKSGtlutFIKqrrzo52xf/GGX4xCQqUpVuBQmr3KXkj3pM0=@vger.kernel.org X-Gm-Message-State: AOJu0YyFkEuRPU/b222pBls7Ozlb6A59IQYIKGv7ynRXyON7rFqm9Lwl 9+0LK0wczaDr+KWGwuoohqOCYaW3g7LZV3T3RkOkPldgF364odOdZ3KPb0aWGoXffy0yWTBUE0j zp6QCGFqj4g== X-Received: from dlbsw11.prod.google.com ([2002:a05:7022:3a8b:b0:13b:9f1a:204]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6300:6bdc:b0:3c3:731d:546a with SMTP id adf61e73a8af0-3c3733bda0cmr4978220637.43.1784186640883; Thu, 16 Jul 2026 00:24:00 -0700 (PDT) Date: Thu, 16 Jul 2026 00:23:45 -0700 In-Reply-To: <20260716072351.560311-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260710053628.1861645-1-irogers@google.com> <20260716072351.560311-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.141.g00534a21ce-goog Message-ID: <20260716072351.560311-4-irogers@google.com> Subject: [PATCH v6 04/10] perf ui hists: Fix stack use-after-return in symbol_filter_str From: Ian Rogers To: irogers@google.com, acme@kernel.org, namhyung@kernel.org Cc: adrian.hunter@intel.com, dapeng1.mi@linux.intel.com, james.clark@linaro.org, jistone@redhat.com, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, tianyou.li@intel.com Content-Type: text/plain; charset="UTF-8" In evsel__hists_browse(), the local stack array 'buf' is assigned directly to the persistent 'hists->symbol_filter_str' pointer. When the browser returns or is exited, this dangling pointer remains active in the 'hists' struct and is read asynchronously by the perf top background timer, triggering a stack use-after-return. Fix it by properly duplicating the input string using strdup(), safely invoking zfree() to prevent memory leaks when overwriting, and cleanly resetting and freeing the symbol filter string upon exiting the browser. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/ui/browsers/hists.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c index 9a3844dc3246..675910893644 100644 --- a/tools/perf/ui/browsers/hists.c +++ b/tools/perf/ui/browsers/hists.c @@ -3213,7 +3213,10 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h "To remove the filter later, press / + ENTER.", buf, "ENTER: OK, ESC: Cancel", delay_secs * 2) == K_ENTER) { - hists->symbol_filter_str = *buf ? buf : NULL; + char *new_filter = *buf ? strdup(buf) : NULL; + + zfree(&hists->symbol_filter_str); + hists->symbol_filter_str = new_filter; hists__filter_by_symbol(hists); hist_browser__reset(browser); } @@ -3447,6 +3450,8 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h } out_free_stack: pstack__delete(browser->pstack); + zfree(&hists->symbol_filter_str); + hists__filter_by_symbol(hists); out: hist_browser__delete(browser); free_popup_options(options, MAX_OPTIONS); -- 2.55.0.141.g00534a21ce-goog