[PATCH v2] perf annotate: Fix NULL pointer dereference in loongarch_call__parse

[PATCH v2] perf annotate: Fix NULL pointer dereference in loongarch_call__parse

[Jianping Liu]

From: Jianping Liu <frankjpliu@tencent.com>

loongarch_call__parse() dereferences the return value of strchr()
without NULL check:

  name = strchr(endptr, '<');
  name++;

When objdump output for a 'bl' (branch-and-link) instruction does not
contain a symbol name delimited by '<' and '>' (e.g., when the call
target has no associated symbol), strchr() returns NULL, and the
subsequent name++ produces a wild pointer (0x1). This leads to a
segmentation fault when strchr() is later called with this invalid
pointer:

  #0  __strchr_lasx () from /lib64/libc.so.6
  #1  loongarch_call__parse () at arch/loongarch/annotate/instructions.c:29
  #2  disasm_line__init_ins () at util/annotate.c:1205
  ...

The objdump line triggering the crash looks like:

  bl              98824   # 0x9000000000641ea0

Note the absence of "<function_name>" after the address.

Rather than aborting parse with -1 (which would clear dl->ins.ops and
lose the is_call attribute, preventing the TUI from drawing branch
arrows and navigating the call), follow the same pattern as the generic
call__parse() in util/disasm.c: when the symbol name is absent, jump to
the address-based symbol lookup so that ops->target.sym can still be
resolved via maps__find_ams() using the already-parsed target address.
This preserves is_call semantics and keeps TUI navigation working.

---
Changes from v1:
- Instead of returning -1 when the '<sym>' token is absent jump to the
  address-based symbol lookup so that maps__find_ams() can still resolve
  ops->target.sym from the already parsed target address.

- Link to v1: https://lore.kernel.org/all/20260423053102.3717015-1-frankljpliu@gmail.com/
---

Fixes: 4ca0d340ce20 ("perf annotate: Fix instruction association and parsing for LoongArch")
Signed-off-by: Jianping Liu <frankjpliu@tencent.com>
Reviewed-by: Ming Wang <wangming01@loongson.cn>
---
 tools/perf/util/annotate-arch/annotate-loongarch.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/perf/util/annotate-arch/annotate-loongarch.c b/tools/perf/util/annotate-arch/annotate-loongarch.c
index c2addca77320..a949b4392dd4 100644
--- a/tools/perf/util/annotate-arch/annotate-loongarch.c
+++ b/tools/perf/util/annotate-arch/annotate-loongarch.c
@@ -29,6 +29,9 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
 	ops->target.addr = strtoull(c, &endptr, 16);
 
 	name = strchr(endptr, '<');
+	if (name == NULL)
+		goto find_target;
+
 	name++;
 
 	if (arch->objdump.skip_functions_char &&
@@ -46,6 +49,7 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
 	if (ops->target.name == NULL)
 		return -1;
 
+find_target:
 	target = (struct addr_map_symbol) {
 		.ms = { .map = map__get(map), },
 		.addr = map__objdump_2mem(map, ops->target.addr),
-- 
2.43.7

Re: [PATCH v2] perf annotate: Fix NULL pointer dereference in loongarch_call__parse

[WANG Rui]

On Thu, Apr 23, 2026 at 6:35 PM Jianping Liu <frankljpliu@gmail.com> wrote:
>
> From: Jianping Liu <frankjpliu@tencent.com>
>
> loongarch_call__parse() dereferences the return value of strchr()
> without NULL check:
>
>   name = strchr(endptr, '<');
>   name++;
>
> When objdump output for a 'bl' (branch-and-link) instruction does not
> contain a symbol name delimited by '<' and '>' (e.g., when the call
> target has no associated symbol), strchr() returns NULL, and the
> subsequent name++ produces a wild pointer (0x1). This leads to a
> segmentation fault when strchr() is later called with this invalid
> pointer:
>
>   #0  __strchr_lasx () from /lib64/libc.so.6
>   #1  loongarch_call__parse () at arch/loongarch/annotate/instructions.c:29
>   #2  disasm_line__init_ins () at util/annotate.c:1205
>   ...
>
> The objdump line triggering the crash looks like:
>
>   bl              98824   # 0x9000000000641ea0
>
> Note the absence of "<function_name>" after the address.
>
> Rather than aborting parse with -1 (which would clear dl->ins.ops and
> lose the is_call attribute, preventing the TUI from drawing branch
> arrows and navigating the call), follow the same pattern as the generic
> call__parse() in util/disasm.c: when the symbol name is absent, jump to
> the address-based symbol lookup so that ops->target.sym can still be
> resolved via maps__find_ams() using the already-parsed target address.
> This preserves is_call semantics and keeps TUI navigation working.
>
> ---
> Changes from v1:
> - Instead of returning -1 when the '<sym>' token is absent jump to the
>   address-based symbol lookup so that maps__find_ams() can still resolve
>   ops->target.sym from the already parsed target address.
>
> - Link to v1: https://lore.kernel.org/all/20260423053102.3717015-1-frankljpliu@gmail.com/
> ---
>
> Fixes: 4ca0d340ce20 ("perf annotate: Fix instruction association and parsing for LoongArch")
> Signed-off-by: Jianping Liu <frankjpliu@tencent.com>
> Reviewed-by: Ming Wang <wangming01@loongson.cn>

Tested-by: WANG Rui <wangrui@loongson.cn>

Thanks,
Rui

> ---
>  tools/perf/util/annotate-arch/annotate-loongarch.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/tools/perf/util/annotate-arch/annotate-loongarch.c b/tools/perf/util/annotate-arch/annotate-loongarch.c
> index c2addca77320..a949b4392dd4 100644
> --- a/tools/perf/util/annotate-arch/annotate-loongarch.c
> +++ b/tools/perf/util/annotate-arch/annotate-loongarch.c
> @@ -29,6 +29,9 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
>         ops->target.addr = strtoull(c, &endptr, 16);
>
>         name = strchr(endptr, '<');
> +       if (name == NULL)
> +               goto find_target;
> +
>         name++;
>
>         if (arch->objdump.skip_functions_char &&
> @@ -46,6 +49,7 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
>         if (ops->target.name == NULL)
>                 return -1;
>
> +find_target:
>         target = (struct addr_map_symbol) {
>                 .ms = { .map = map__get(map), },
>                 .addr = map__objdump_2mem(map, ops->target.addr),
> --
> 2.43.7