Re: [PATCH] perf annotate: Use jump__delete when freeing LoongArch jumps

[sashiko-bot@kernel.org]

Sashiko AI review found 1 potential issue(s):
- [High] Missing NULL check in `loongarch_call__parse()` causes a segmentation fault on malformed or stripped objdump output.
--

commit 031fe3089ac82ebce8ac1cc8c2f144a5b6abd009
Author: Rong Bao <rong.bao@csmantle.top>

perf annotate: Use jump__delete when freeing LoongArch jumps

This commit fixes an invalid free crash in perf annotate for LoongArch by
assigning jump__delete to the .free field in loongarch_jump_ops. This prevents
fields that share the same buffer from being erroneously freed during cleanup.

> diff --git a/tools/perf/util/annotate-arch/annotate-loongarch.c b/tools/perf/util/annotate-arch/annotate-loongarch.c
> index 950f34e59e5cd..c2addca77320b 100644
> --- a/tools/perf/util/annotate-arch/annotate-loongarch.c
> +++ b/tools/perf/util/annotate-arch/annotate-loongarch.c
> @@ -110,6 +110,7 @@ static int loongarch_jump__parse(const struct arch *arch, struct ins_operands *o
>  }
>  
>  static const struct ins_ops loongarch_jump_ops = {
> +	.free	   = jump__delete,
>  	.parse	   = loongarch_jump__parse,
>  	.scnprintf = jump__scnprintf,
>  	.is_jump   = true,

[ ... ]

While reviewing these changes, I noticed a pre-existing issue in the nearby
loongarch_call__parse() function in the same file:

tools/perf/util/annotate-arch/annotate-loongarch.c:loongarch_call__parse() {
        ...
        ops->target.addr = strtoull(c, &endptr, 16);

        name = strchr(endptr, '<');
        name++;

        if (arch->objdump.skip_functions_char &&
            strchr(name, arch->objdump.skip_functions_char))
                return -1;
        ...
}

Could this cause a segmentation fault if the tool processes a stripped
binary?

If the objdump output for a call instruction lacks the <symbol> suffix
(for example, bl #0x12345), strchr(endptr, '<') would return NULL.

The subsequent name++ would then produce an invalid pointer, leading to a crash
when it is used in the following strchr() and strdup() calls.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260412062828.1734637-1-rong.bao@csmantle.top?part=1