[PATCH v2] perf annotate: Fix NULL pointer dereference in loongarch_call__parse

[Jianping Liu]

From: Jianping Liu <frankjpliu@xxxxxxxxxxx>

loongarch_call__parse() dereferences the return value of strchr()
without NULL check:

  name = strchr(endptr, '<');
  name++;

When objdump output for a 'bl' (branch-and-link) instruction does not
contain a symbol name delimited by '<' and '>' (e.g., when the call
target has no associated symbol), strchr() returns NULL, and the
subsequent name++ produces a wild pointer (0x1). This leads to a
segmentation fault when strchr() is later called with this invalid
pointer:

  #0  __strchr_lasx () from /lib64/libc.so.6
  #1  loongarch_call__parse () at arch/loongarch/annotate/instructions.c:29
  #2  disasm_line__init_ins () at util/annotate.c:1205
  ...

The objdump line triggering the crash looks like:

  bl              98824   # 0x9000000000641ea0

Note the absence of "<function_name>" after the address.

Rather than aborting parse with -1 (which would clear dl->ins.ops and
lose the is_call attribute, preventing the TUI from drawing branch
arrows and navigating the call), follow the same pattern as the generic
call__parse() in util/disasm.c: when the symbol name is absent, jump to
the address-based symbol lookup so that ops->target.sym can still be
resolved via maps__find_ams() using the already-parsed target address.
This preserves is_call semantics and keeps TUI navigation working.

---
Changes from v1:
- Instead of returning -1 when the '<sym>' token is absent jump to the
  address-based symbol lookup so that maps__find_ams() can still resolve
  ops->target.sym from the already parsed target address.

- Link to v1: https://lore.kernel.org/all/20260423053102.3717015-1-frankljpliu@xxxxxxxxx/
---

Fixes: 4ca0d340ce20 ("perf annotate: Fix instruction association and parsing for LoongArch")
Signed-off-by: Jianping Liu <frankjpliu@xxxxxxxxxxx>
Reviewed-by: Ming Wang <wangming01@xxxxxxxxxxx>
---
 tools/perf/util/annotate-arch/annotate-loongarch.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/tools/perf/util/annotate-arch/annotate-loongarch.c b/tools/perf/util/annotate-arch/annotate-loongarch.c
index c2addca77320..a949b4392dd4 100644
--- a/tools/perf/util/annotate-arch/annotate-loongarch.c
+++ b/tools/perf/util/annotate-arch/annotate-loongarch.c
@@ -29,6 +29,9 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
 	ops->target.addr = strtoull(c, &endptr, 16);
 
 	name = strchr(endptr, '<');
+	if (name == NULL)
+		goto find_target;
+
 	name++;
 
 	if (arch->objdump.skip_functions_char &&
@@ -46,6 +49,7 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
 	if (ops->target.name == NULL)
 		return -1;
 
+find_target:
 	target = (struct addr_map_symbol) {
 		.ms = { .map = map__get(map), },
 		.addr = map__objdump_2mem(map, ops->target.addr),
-- 
2.43.7