[PATCH v2 2/3] perf dso: Separate libbfd and cmd addr2line caches to fix confusion
From: Ian Rogers
Date: Wed Sep 16 2026 - 02:36:48 EST
When a dso executes addr2line via libbfd it instantiates an a2l_data
pointer. If the DSO later executes via the command-line fallback due
to an inlined bug, the a2l pointer is unconditionally populated with a
child_process process wrapper. If libbfd is queried again, the offline
reader attempts to cast struct a2l_data into child_process, coercing
random arbitrary instruction addresses and causing silent aborts. This
cleanly splits the caches.
Fixes: 257046a36750 ("perf srcline: Fallback between addr2line implementations")
Signed-off-by: Ian Rogers <irogers@xxxxxxxxxx>
Assisted-by: Antigravity:gemini-3.1-pro
---
tools/perf/util/dso.c | 49 +++++++++++++++++++++++----------------
tools/perf/util/dso.h | 21 +++++++++++++++--
tools/perf/util/libbfd.c | 10 ++++----
tools/perf/util/srcline.c | 2 ++
4 files changed, 55 insertions(+), 27 deletions(-)
diff --git a/tools/perf/util/dso.c b/tools/perf/util/dso.c
index df39e6ca88e6..6510767177be 100644
--- a/tools/perf/util/dso.c
+++ b/tools/perf/util/dso.c
@@ -1,38 +1,45 @@
// SPDX-License-Identifier: GPL-2.0
+#include "dso.h"
+
+#include <errno.h>
+#include <stdlib.h>
+
#include <asm/bug.h>
+#include <fcntl.h>
#include <linux/kernel.h>
#include <linux/string.h>
#include <linux/zalloc.h>
-#include <sys/time.h>
#include <sys/resource.h>
-#include <sys/types.h>
#include <sys/stat.h>
+#include <sys/time.h>
+#include <sys/types.h>
#include <unistd.h>
-#include <errno.h>
-#include <fcntl.h>
-#include <stdlib.h>
-#ifdef HAVE_LIBBPF_SUPPORT
-#include <bpf/libbpf.h>
-#include "bpf-event.h"
-#include "bpf-utils.h"
-#endif
+
+#include "annotate-data.h"
+#include "auxtrace.h"
#include "compress.h"
+#include "debug.h"
+#include "dso.h"
+#include "dsos.h"
#include "env.h"
+#include "libbfd.h"
+#include "libdw.h"
+#include "machine.h"
+#include "map.h"
#include "namespaces.h"
#include "path.h"
-#include "map.h"
-#include "symbol.h"
#include "srcline.h"
-#include "dso.h"
-#include "dsos.h"
-#include "machine.h"
-#include "auxtrace.h"
-#include "util.h" /* O_CLOEXEC for older systems */
-#include "debug.h"
#include "string2.h"
+#include "symbol.h"
+#include "util.h" /* O_CLOEXEC for older systems */
#include "vdso.h"
-#include "annotate-data.h"
-#include "libdw.h"
+
+#ifdef HAVE_LIBBPF_SUPPORT
+#include <bpf/libbpf.h>
+
+#include "bpf-event.h"
+#include "bpf-utils.h"
+#endif
static const char * const debuglink_paths[] = {
"%.0s%s",
@@ -1757,6 +1764,7 @@ void dso__delete(struct dso *dso)
auxtrace_cache__free(RC_CHK_ACCESS(dso)->auxtrace_cache);
dso_cache__free(dso);
dso__free_a2l(dso);
+ dso__free_a2l_libbfd(dso);
dso__free_libdw(dso);
dso__free_symsrc_filename(dso);
nsinfo__zput(RC_CHK_ACCESS(dso)->nsinfo);
@@ -2081,6 +2089,7 @@ void dso__set_symsrc_filename(struct dso *dso, char *val)
RC_CHK_ACCESS(dso)->symsrc_filename = val;
dso__free_libdw(dso);
dso__free_a2l(dso);
+ dso__free_a2l_libbfd(dso);
dso__set_has_srcline(dso, true);
dso__set_a2l_fails(dso, 0);
}
diff --git a/tools/perf/util/dso.h b/tools/perf/util/dso.h
index 7966c7048c85..e7d5f4bbf894 100644
--- a/tools/perf/util/dso.h
+++ b/tools/perf/util/dso.h
@@ -304,7 +304,12 @@ DECLARE_RC_STRUCT(dso) {
const char *short_name;
const char *long_name;
void *a2l;
+#ifdef HAVE_LIBBFD_SUPPORT
+ void *a2l_libbfd;
+#endif
+#ifdef HAVE_LIBDW_SUPPORT
void *libdw;
+#endif
char *symsrc_filename;
struct nsinfo *nsinfo;
struct auxtrace_cache *auxtrace_cache;
@@ -368,6 +373,20 @@ static inline void dso__set_a2l(struct dso *dso, void *val)
RC_CHK_ACCESS(dso)->a2l = val;
}
+#ifdef HAVE_LIBBFD_SUPPORT
+static inline void *dso__a2l_libbfd(const struct dso *dso)
+{
+ return RC_CHK_ACCESS(dso)->a2l_libbfd;
+}
+
+static inline void dso__set_a2l_libbfd(struct dso *dso, void *val)
+{
+ RC_CHK_ACCESS(dso)->a2l_libbfd = val;
+}
+#endif
+
+struct Dwfl;
+#ifdef HAVE_LIBDW_SUPPORT
static inline void *dso__libdw(const struct dso *dso)
{
return RC_CHK_ACCESS(dso)->libdw;
@@ -378,8 +397,6 @@ static inline void dso__set_libdw(struct dso *dso, void *val)
RC_CHK_ACCESS(dso)->libdw = val;
}
-struct Dwfl;
-#ifdef HAVE_LIBDW_SUPPORT
struct Dwfl *dso__libdw_dwfl(struct dso *dso);
#else
static inline struct Dwfl *dso__libdw_dwfl(struct dso *dso __maybe_unused)
diff --git a/tools/perf/util/libbfd.c b/tools/perf/util/libbfd.c
index efc78d788ce7..7a462c9d11b6 100644
--- a/tools/perf/util/libbfd.c
+++ b/tools/perf/util/libbfd.c
@@ -239,7 +239,7 @@ static int inline_list__append_dso_a2l(struct dso *dso,
struct inline_node *node,
struct symbol *sym)
{
- struct a2l_data *a2l = dso__a2l(dso);
+ struct a2l_data *a2l = dso__a2l_libbfd(dso);
struct symbol *inline_sym = new_inline_sym(dso, sym, a2l->funcname);
char *srcline = NULL;
@@ -258,11 +258,11 @@ int libbfd__addr2line(const char *dso_name, u64 addr,
struct a2l_data *a2l;
mutex_lock(dso__lock(dso));
- a2l = dso__a2l(dso);
+ a2l = dso__a2l_libbfd(dso);
if (!a2l) {
a2l = addr2line_init(dso_name);
- dso__set_a2l(dso, a2l);
+ dso__set_a2l_libbfd(dso, a2l);
}
if (a2l == NULL) {
@@ -323,14 +323,14 @@ int libbfd__addr2line(const char *dso_name, u64 addr,
void dso__free_a2l_libbfd(struct dso *dso)
{
- struct a2l_data *a2l = dso__a2l(dso);
+ struct a2l_data *a2l = dso__a2l_libbfd(dso);
if (!a2l)
return;
addr2line_cleanup(a2l);
- dso__set_a2l(dso, NULL);
+ dso__set_a2l_libbfd(dso, NULL);
}
static int bfd_symbols__cmpvalue(const void *a, const void *b)
diff --git a/tools/perf/util/srcline.c b/tools/perf/util/srcline.c
index e60dea472507..68798a4de887 100644
--- a/tools/perf/util/srcline.c
+++ b/tools/perf/util/srcline.c
@@ -300,6 +300,7 @@ char *__get_srcline(struct dso *dso, u64 addr, struct symbol *sym,
if (dso__a2l_fails(dso) > A2L_FAIL_LIMIT) {
dso__set_has_srcline(dso, false);
dso__free_a2l(dso);
+ dso__free_a2l_libbfd(dso);
}
mutex_unlock(dso__lock(dso));
out:
@@ -347,6 +348,7 @@ char *get_srcline_split(struct dso *dso, u64 addr, unsigned *line)
if (dso__a2l_fails(dso) > A2L_FAIL_LIMIT) {
dso__set_has_srcline(dso, false);
dso__free_a2l(dso);
+ dso__free_a2l_libbfd(dso);
}
mutex_unlock(dso__lock(dso));
--
2.55.0.1032.g73a4cd73de-goog