Re: [PATCH v6 09/10] perf ui hists: Fix dso_filter reference leak and exit zoom cleanup

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Calling `zfree(&hists->symbol_filter_str)` on a pointer that originated from an unallocated command-line argument causes a fatal crash.
- [Medium] The newly added exit cleanup blindly clears global command-line configurations like `socket_filter`, permanently destroying their effects across browser tabs.
--

--- Patch [9]: [PATCH v6 09/10] perf ui hists: Fix dso_filter reference leak and exit zoom cleanup ---
commit 8368ef0112285b0a616e2a03e40dea893c6d1d5b
Author: Ian Rogers <irogers@google.com>

perf ui hists: Fix dso_filter reference leak and exit zoom cleanup

This commit fixes a potential use-after-free by acquiring and releasing a
reference to dso_filter in hists_browser__zoom_map(). It also fully resets
the persistent hists structure upon exiting the browser stack to prevent
state corruption across tab switches.

Closes: https://lore.kernel.org/linux-perf-users/20260709170834.52F1A1F000E9@smtp.kernel.org/

> diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c
> index 89c3d3dc69a27..e0ef756d95367 100644
> --- a/tools/perf/ui/browsers/hists.c
> +++ b/tools/perf/ui/browsers/hists.c
[ ... ]
> @@ -3491,6 +3492,16 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h
>  out_free_stack:
>  	pstack__delete(browser->pstack);
>  	free_popup_actions(actions, MAX_OPTIONS);
> +	thread__zput(hists->thread_filter);
> +	dso__put((struct dso *)hists->dso_filter);
> +	hists->dso_filter = NULL;
> +	hists->socket_filter = -1;

[Severity: Medium]
Will this unconditionally clear the global command-line configuration?

If a user invokes perf report with --socket-filter <N>, the configuration
is stored in hists->socket_filter. When the user exits the TUI view (e.g.,
by pressing ESC), this cleanup resets the filter to -1.

Could this result in subsequent views of the same event incorrectly
displaying unfiltered data across browser tabs?

> +	perf_hpp__set_elide(HISTC_DSO, false);
> +	perf_hpp__set_elide(HISTC_THREAD, false);
> +	perf_hpp__set_elide(HISTC_SOCKET, false);
> +	hists__filter_by_dso(hists);
> +	hists__filter_by_thread(hists);
> +	hists__filter_by_socket(hists);
>  	zfree(&hists->symbol_filter_str);

[Severity: High]
Does this zfree() call attempt to free a non-heap pointer?

If a user invokes perf report --symbol-filter <sym>, the command-line
argument is assigned without dynamic allocation:

tools/perf/builtin-report.c:cmd_report() {
    ...
    report.symbol_filter_str = argv[0];
    ...
}

This pointer is then passed to hists->symbol_filter_str. When the TUI exits
evsel__hists_browse(), calling zfree() on this non-heap pointer will
trigger a fatal glibc abort. Can we avoid calling zfree() on pointers
originating from unallocated command-line arguments?

>  	hists__filter_by_symbol(hists);
>  out:

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260716072351.560311-1-irogers@google.com?part=9