From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f201.google.com (mail-pg1-f201.google.com [209.85.215.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9C95A79DA for ; Fri, 10 Jul 2026 02:50:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783651810; cv=none; b=OxfgoW7uNCGDdumPdoj1+8Ze3V8oRaatvLIE+eJX2OZ3nwXiuIA0Mh9TkCuMl+HLbW5pqTTx2OmHqf0CTfz5lePK9I9rBmwSLvuQbvkXAW87Q8dfE9N2r67QadLonUwN8pKImOgLQYLD4w7989jmLtQb1QiNLgGWw6z8xTOLqtk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783651810; c=relaxed/simple; bh=J/WAjM4T7uHEs6XPshQ9cey2jVcGpBYqBPb3ET1dZao=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=RweNec9z95URVoQXS+djK2q+uDsHZ65lAnwjMmQ4vKw+46WCTehOku5dMPHzOyasNBSIxJZKTshhdzYRED+qyan58jMqZBkBAfsWPu7oM7T34ft/ZYBGO+4bi6Dhl+4sid/hZyATXJa3FrVGeBZwcl+0KqihP/XHXFbw4GT7H8s= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=RSJCyCxa; arc=none smtp.client-ip=209.85.215.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="RSJCyCxa" Received: by mail-pg1-f201.google.com with SMTP id 41be03b00d2f7-c9d5a5b63c5so665904a12.1 for ; Thu, 09 Jul 2026 19:50:07 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1783651806; x=1784256606; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Msvps8u4Exs31W4moeqD2kBAj5mse78bpQTpQrgt/LM=; b=RSJCyCxaXPgywX1hpBUkTjEq8lf4jvoEu7koLqZxZi18mTmYsEWwV1SEYGXpMFJCSY rHDI7SlCsHbMWTHDxTeDux1zl1rZ36uy85mkdl2sh7xyCooyjPAq+ubckAnmL+QZz+Xq 4kZjsV0oZWerJfVq533YHTj2Ia61yBlb+03WuCKvH5jbamI3CX40EmaPVKEIGaYB9Rb7 r4+DGJHUdFFQsWnHV0oYnycoSQdr58mbI92NmkarJ/DOgXUOO+ua7KV+TkAaisrKHbXw d+hfx4ZXgz2pBxFMjmg/P+zbIzGMXJ++G0/W5UnyVgf61iknPryExSU3NSXh+fT1AEQc 41YA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783651806; x=1784256606; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Msvps8u4Exs31W4moeqD2kBAj5mse78bpQTpQrgt/LM=; b=rwkf34bELciSjOXxsQkX3Ov9GadceNCU1UbFDd904h4UTX9NFV9Sotu0E89sHNx+4a mVU7cYF9TWGyuZKqWrp5OhQE/yjreFhEKX8dIFQSOUbDQQyfaOhsMGYf5nealyjDSE3Y eWDT2tGA/xv3WndsZ61C1N9cRDQkhUpfRFPQIfhHYRaIxPTwm8m5ZgNA+wC0uw4reBQj 24w9JDTbYjB/gCSYLs1yA61T+dYQItAMQcGieOiq2WudxKDfGPPN1Yq10gsTnmMZ8lKj M+i10WOaxEIj/u7avEK5FUMve8QGnm9HTPs0RveYVxNXdzRUaSXoDPnInRx5gU6AX85W cLAw== X-Forwarded-Encrypted: i=1; AHgh+Rqb39OyubUwv5JbelR1asLGGuaEx+9+S6qSPelB3n24oxEH0mR50eZCje5QXlpydZMzftpoi2/Dmc1S0kg=@vger.kernel.org X-Gm-Message-State: AOJu0Ywp3ctAKK0ZcPOWYKHwPAXwKO94TXSWo4wQttG6sWGA9lIDfcYq Am64Aj2tgtKq4LdOFZW+qPnvIYrict6s44rSemcYBN9sov+Hei0gJruyoZNOeXEGRjTczdZLatr CtLMutG7xuA== X-Received: from dlf19.prod.google.com ([2002:a05:7022:413:b0:13b:2d46:494d]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:7343:b0:3bf:76d5:cc2b with SMTP id adf61e73a8af0-3c0bcec1928mr10932457637.22.1783651806280; Thu, 09 Jul 2026 19:50:06 -0700 (PDT) Date: Thu, 9 Jul 2026 19:49:47 -0700 In-Reply-To: <20260710024952.1668911-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260709165220.1411149-1-irogers@google.com> <20260710024952.1668911-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.795.g602f6c329a-goog Message-ID: <20260710024952.1668911-4-irogers@google.com> Subject: [PATCH v4 4/9] perf ui hists: Fix uninitialized stack memory free on pstack allocation failure From: Ian Rogers To: irogers@google.com, acme@kernel.org, jistone@redhat.com, namhyung@kernel.org Cc: adrian.hunter@intel.com, dapeng1.mi@linux.intel.com, james.clark@linaro.org, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, tianyou.li@intel.com, sashiko-bot Content-Type: text/plain; charset="UTF-8" In evsel__hists_browse(), if browser->pstack allocation fails, the function jumps to the 'out:' cleanup label which invokes free_popup_options(options, MAX_OPTIONS). Because the options array is allocated on the stack and wasn't initialized until after the pstack check, this passes uninitialized stack pointers to free(), causing heap corruption. Fix it by moving the memset() of options and actions to the beginning of the setup sequence, before the first potential error bailout. Reported-by: sashiko-bot Closes: https://lore.kernel.org/linux-perf-users/20260709035230.6DBEE1F000E9@smtp.kernel.org/ Fixes: f2b487db45f2 ("perf hists browser: Fix possible memory leak") Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/ui/browsers/hists.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c index 6edea27f4f30..7842f228435d 100644 --- a/tools/perf/ui/browsers/hists.c +++ b/tools/perf/ui/browsers/hists.c @@ -3064,15 +3064,15 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h browser->min_pcnt = min_pcnt; hist_browser__update_nr_entries(browser); + memset(options, 0, sizeof(options)); + memset(actions, 0, sizeof(actions)); + browser->pstack = pstack__new(3); if (browser->pstack == NULL) goto out; ui_helpline__push(helpline); - memset(options, 0, sizeof(options)); - memset(actions, 0, sizeof(actions)); - if (symbol_conf.col_width_list_str) perf_hpp__set_user_width(symbol_conf.col_width_list_str); -- 2.55.0.795.g602f6c329a-goog