Re: [PATCH v2] perf disasm: Fix potential use-after-free on fileloc

[Namhyung Kim <namhyung@kernel.org>]

On Fri, Mar 06, 2026 at 04:22:22PM -0800, Ian Rogers wrote:
> The fileloc is a copy of a pointer to a string but in places like
> symbol_disassemble__llvm this string appears to be freed setting up
> potential use-after-frees:
> 
> llvm.c:
> ```
> 		dl = disasm_line__new(args);
> 		if (dl == NULL)
> 			goto err;
> 
> 		annotation_line__add(&dl->al, &notes->src->source);
> 
> 		free(args->fileloc);
> ```
> disasm.c:
> ```
> static void annotation_line__init(struct annotation_line *al,
> 				  struct annotate_args *args,
> 				  int nr)
> {
> 	al->offset = args->offset;
> 	al->line = strdup(args->line);
> 	al->line_nr = args->line_nr;
> 	al->fileloc = args->fileloc;
> 	al->data_nr = nr;
> }
> 
> struct disasm_line *disasm_line__new(struct annotate_args *args)
> {
> 	struct disasm_line *dl = NULL;
> 	struct annotation *notes = symbol__annotation(args->ms->sym);
> 	int nr = notes->src->nr_events;
> 
> 	dl = zalloc(disasm_line_size(nr));
> 	if (!dl)
> 		return NULL;
> 
> 	annotation_line__init(&dl->al, args, nr);
> ```
> 
> Fix this by making the fileloc a copy of the underlying string in its
> init/exit.
> 
> Signed-off-by: Ian Rogers <irogers@google.com>

Applied to perf-tools-next, thanks!

Best regards,
Namhyung