Re: [PATCH v2] perf annotate: Fix NULL pointer dereference in loongarch_call__parse

[WANG Rui]

On Thu, Apr 23, 2026 at 6:35 PM Jianping Liu <frankljpliu@xxxxxxxxx> wrote:
>
> From: Jianping Liu <frankjpliu@xxxxxxxxxxx>
>
> loongarch_call__parse() dereferences the return value of strchr()
> without NULL check:
>
>   name = strchr(endptr, '<');
>   name++;
>
> When objdump output for a 'bl' (branch-and-link) instruction does not
> contain a symbol name delimited by '<' and '>' (e.g., when the call
> target has no associated symbol), strchr() returns NULL, and the
> subsequent name++ produces a wild pointer (0x1). This leads to a
> segmentation fault when strchr() is later called with this invalid
> pointer:
>
>   #0  __strchr_lasx () from /lib64/libc.so.6
>   #1  loongarch_call__parse () at arch/loongarch/annotate/instructions.c:29
>   #2  disasm_line__init_ins () at util/annotate.c:1205
>   ...
>
> The objdump line triggering the crash looks like:
>
>   bl              98824   # 0x9000000000641ea0
>
> Note the absence of "<function_name>" after the address.
>
> Rather than aborting parse with -1 (which would clear dl->ins.ops and
> lose the is_call attribute, preventing the TUI from drawing branch
> arrows and navigating the call), follow the same pattern as the generic
> call__parse() in util/disasm.c: when the symbol name is absent, jump to
> the address-based symbol lookup so that ops->target.sym can still be
> resolved via maps__find_ams() using the already-parsed target address.
> This preserves is_call semantics and keeps TUI navigation working.
>
> ---
> Changes from v1:
> - Instead of returning -1 when the '<sym>' token is absent jump to the
>   address-based symbol lookup so that maps__find_ams() can still resolve
>   ops->target.sym from the already parsed target address.
>
> - Link to v1: https://lore.kernel.org/all/20260423053102.3717015-1-frankljpliu@xxxxxxxxx/
> ---
>
> Fixes: 4ca0d340ce20 ("perf annotate: Fix instruction association and parsing for LoongArch")
> Signed-off-by: Jianping Liu <frankjpliu@xxxxxxxxxxx>
> Reviewed-by: Ming Wang <wangming01@xxxxxxxxxxx>

Tested-by: WANG Rui <wangrui@xxxxxxxxxxx>

Thanks,
Rui

> ---
>  tools/perf/util/annotate-arch/annotate-loongarch.c | 4 ++++
>  1 file changed, 4 insertions(+)
>
> diff --git a/tools/perf/util/annotate-arch/annotate-loongarch.c b/tools/perf/util/annotate-arch/annotate-loongarch.c
> index c2addca77320..a949b4392dd4 100644
> --- a/tools/perf/util/annotate-arch/annotate-loongarch.c
> +++ b/tools/perf/util/annotate-arch/annotate-loongarch.c
> @@ -29,6 +29,9 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
>         ops->target.addr = strtoull(c, &endptr, 16);
>
>         name = strchr(endptr, '<');
> +       if (name == NULL)
> +               goto find_target;
> +
>         name++;
>
>         if (arch->objdump.skip_functions_char &&
> @@ -46,6 +49,7 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
>         if (ops->target.name == NULL)
>                 return -1;
>
> +find_target:
>         target = (struct addr_map_symbol) {
>                 .ms = { .map = map__get(map), },
>                 .addr = map__objdump_2mem(map, ops->target.addr),
> --
> 2.43.7