From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f202.google.com (mail-pg1-f202.google.com [209.85.215.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD4BD385D9E for ; Fri, 10 Jul 2026 05:36:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.202 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783661808; cv=none; b=jzFclJSYm5pWdTUa5hcyu1PVzItbTg5YO+b4UEBiyyDwOJTHAxsLNUBjvhvKe9lssOdBWKiRgHUtDPztBjBwLIP18iRzjhxRbt17UYE6rRdOM1tPh14MdFswDWrwiPykrnatSO5Tov6rHFJzTy1E5xHu9Yuxro6mMu3wAk9ILkA= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1783661808; c=relaxed/simple; bh=us+ds7Q+P/t0eK3oG4tayVjN3xsX0juDghwKB9dP7EA=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=BJue/EvlCCGYlqG+117EoVqN+9j/UQdZhjB5idFIxD8DOaDei/s65U7+P41iJJsfxpkbfoVlI4/QhraDVzmQ/x143oURM4lrVIwpfdI6zzbvJ1Y8FpFj6h7jxP2T8VPHQgNLXaYL/ANOQ4B32+bzFcfagYHpFYgUBEMs8TNW5cs= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=bQpzMoF5; arc=none smtp.client-ip=209.85.215.202 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="bQpzMoF5" Received: by mail-pg1-f202.google.com with SMTP id 41be03b00d2f7-c891ed872ddso832611a12.2 for ; Thu, 09 Jul 2026 22:36:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1783661804; x=1784266604; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Lvut/wGJaYaqaC8EOuzXLgdON3f16JOPTuJWAAgcRZg=; b=bQpzMoF5+0Ag262urkSPI0bLWhkOFdXMbP+ZLbS4ZkmFU1qDLZOJlLzZ2VRoi6I1oa XTJdoCRUCtaAVkasxFZfAOjaoO8aDwNiV3u3pTP0rhjVQkXVGZX4GhHmozVQKhYCIW/1 d6C9NJHgEtoNpCVdISbCJigAbpGs9PjOmrpmCvLruKOazGCFFNwQIkVnHShGwR2YdQQK ltspPoD6c14HygYutF//pqdHalyuGidDIzjXdYReIDB++aRvIYEV9gZJwsvsXI3fuWML y5d0fdG3QRRsJYbSYVu0LyWo0RGE+jeDnZ/aYGIAQ5svEKFUSrqRLdr1CdGpnuW8k17+ HaTw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1783661804; x=1784266604; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=Lvut/wGJaYaqaC8EOuzXLgdON3f16JOPTuJWAAgcRZg=; b=besHlEN4EWjjKfD+c9EWkwu6p7Om/Ey4DhlZdkwfIQGb0ISlf0VbImI5nDcL9wGTEU OtKhWeWrpAyXlZbnKkyYvS0O+K1Pmk5dc9DKKCljeryr37vyh3dgRI/HL+rTvRAiCIJq k9MH6n5aJELupLGvxcTsyvyJP2wOEkZaP6pE1t2V6jstmYig9vRFeMeZpreX/FaWAigs 5/cQWYfkgjPdWBG7LrAYDgh96RR5RI9KGc8AdbBGevdSaXBJBqkARyQNU/NS3OLFPGS4 rAAX4n3hEi/ry+JyVDg6fooNdHow6miUEFiAFrukJbqITi7gIMYd7nBoWlvvGO4t7GoP hPEw== X-Forwarded-Encrypted: i=1; AHgh+RqbCFhWsHCVR3waeNo/YkoQr81x1dlyrsjLASlVe9ycSNfemL0ipfZZ0l0SxLgD3ccFrCxXuCIZ5nEPOIA=@vger.kernel.org X-Gm-Message-State: AOJu0YwsIgQTSYkalDr1T00wPhyuBq7rACSVI+PTLfPvZY5Pbp0TrP49 AMctSkfGP7mI3nNALmmTrZQrJw3+tg2K1fp8UoPiPLc7Cg0Ije8IBsbbFM4OWn7r+pSGNJG2qPl FbKqShEcVMw== X-Received: from dlbsn10.prod.google.com ([2002:a05:7022:b90a:b0:138:301a:6f80]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:258d:b0:3c0:9c1a:893f with SMTP id adf61e73a8af0-3c0bcd143cdmr11375443637.71.1783661803898; Thu, 09 Jul 2026 22:36:43 -0700 (PDT) Date: Thu, 9 Jul 2026 22:36:24 -0700 In-Reply-To: <20260710053628.1861645-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260710024952.1668911-1-irogers@google.com> <20260710053628.1861645-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.795.g602f6c329a-goog Message-ID: <20260710053628.1861645-6-irogers@google.com> Subject: [PATCH v5 06/10] perf ui hists: Fix NULL pointer array gap in add_script_opt() From: Ian Rogers To: irogers@google.com, acme@kernel.org, jistone@redhat.com, namhyung@kernel.org Cc: adrian.hunter@intel.com, dapeng1.mi@linux.intel.com, james.clark@linaro.org, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, tianyou.li@intel.com Content-Type: text/plain; charset="UTF-8" In add_script_opt(), the function unconditionally increments the optstr and act pointers for a second optional 'time' popup action before attempting to invoke add_script_opt_2(). If the first add_script_opt_2() call failed (for example, due to an asprintf allocation failure), this leaves a NULL pointer gap in the options array at the prior index. When ui__popup_menu() is later displayed, it dereferences this gap and crashes. Fix it by avoiding unconditional pointer increments. Only advance the optstr and act pointers if the first script addition actually succeeded, and safely attach the time parameter to the correct assigned action. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/ui/browsers/hists.c | 17 ++++++++++++----- 1 file changed, 12 insertions(+), 5 deletions(-) diff --git a/tools/perf/ui/browsers/hists.c b/tools/perf/ui/browsers/hists.c index 675910893644..07a2e18f8aaf 100644 --- a/tools/perf/ui/browsers/hists.c +++ b/tools/perf/ui/browsers/hists.c @@ -2811,7 +2811,7 @@ add_script_opt(struct hist_browser *browser, struct popup_action *act, char **optstr, struct thread *thread, struct symbol *sym) { - int n, j; + int n, j, ret; struct hist_entry *he; n = add_script_opt_2(act, optstr, thread, sym, ""); @@ -2819,17 +2819,24 @@ add_script_opt(struct hist_browser *browser, he = hist_browser__selected_entry(browser); if (sort_order && strstr(sort_order, "time")) { char tstr[128]; + struct popup_action *time_act = act; + char **time_optstr = optstr; - optstr++; - act++; + if (n > 0) { + time_optstr++; + time_act++; + } j = sprintf(tstr, " in "); j += timestamp__scnprintf_usec(he->time, tstr + j, sizeof tstr - j); j += sprintf(tstr + j, "-"); timestamp__scnprintf_usec(he->time + symbol_conf.time_quantum, tstr + j, sizeof tstr - j); - n += add_script_opt_2(act, optstr, thread, sym, tstr); - act->time = he->time; + ret = add_script_opt_2(time_act, time_optstr, thread, sym, tstr); + if (ret > 0) { + time_act->time = he->time; + n += ret; + } } return n; } -- 2.55.0.795.g602f6c329a-goog