Re: [PATCH v2] perf annotate: Fix NULL pointer dereference in loongarch_call__parse

[Ian Rogers]

On Mon, Apr 27, 2026 at 8:53 PM WANG Rui <wangrui@xxxxxxxxxxx> wrote:
>
> On Thu, Apr 23, 2026 at 6:35 PM Jianping Liu <frankljpliu@xxxxxxxxx> wrote:
> >
> > From: Jianping Liu <frankjpliu@xxxxxxxxxxx>
> >
> > loongarch_call__parse() dereferences the return value of strchr()
> > without NULL check:
> >
> >   name = strchr(endptr, '<');
> >   name++;
> >
> > When objdump output for a 'bl' (branch-and-link) instruction does not
> > contain a symbol name delimited by '<' and '>' (e.g., when the call
> > target has no associated symbol), strchr() returns NULL, and the
> > subsequent name++ produces a wild pointer (0x1). This leads to a
> > segmentation fault when strchr() is later called with this invalid
> > pointer:
> >
> >   #0  __strchr_lasx () from /lib64/libc.so.6
> >   #1  loongarch_call__parse () at arch/loongarch/annotate/instructions.c:29
> >   #2  disasm_line__init_ins () at util/annotate.c:1205
> >   ...
> >
> > The objdump line triggering the crash looks like:
> >
> >   bl              98824   # 0x9000000000641ea0
> >
> > Note the absence of "<function_name>" after the address.
> >
> > Rather than aborting parse with -1 (which would clear dl->ins.ops and
> > lose the is_call attribute, preventing the TUI from drawing branch
> > arrows and navigating the call), follow the same pattern as the generic
> > call__parse() in util/disasm.c: when the symbol name is absent, jump to
> > the address-based symbol lookup so that ops->target.sym can still be
> > resolved via maps__find_ams() using the already-parsed target address.
> > This preserves is_call semantics and keeps TUI navigation working.
> >
> > ---
> > Changes from v1:
> > - Instead of returning -1 when the '<sym>' token is absent jump to the
> >   address-based symbol lookup so that maps__find_ams() can still resolve
> >   ops->target.sym from the already parsed target address.
> >
> > - Link to v1: https://lore.kernel.org/all/20260423053102.3717015-1-frankljpliu@xxxxxxxxx/
> > ---
> >
> > Fixes: 4ca0d340ce20 ("perf annotate: Fix instruction association and parsing for LoongArch")
> > Signed-off-by: Jianping Liu <frankjpliu@xxxxxxxxxxx>
> > Reviewed-by: Ming Wang <wangming01@xxxxxxxxxxx>
>
> Tested-by: WANG Rui <wangrui@xxxxxxxxxxx>

Acked-by: Ian Rogers <irogers@xxxxxxxxxx>

Thanks,
Ian

> Thanks,
> Rui
>
> > ---
> >  tools/perf/util/annotate-arch/annotate-loongarch.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> >
> > diff --git a/tools/perf/util/annotate-arch/annotate-loongarch.c b/tools/perf/util/annotate-arch/annotate-loongarch.c
> > index c2addca77320..a949b4392dd4 100644
> > --- a/tools/perf/util/annotate-arch/annotate-loongarch.c
> > +++ b/tools/perf/util/annotate-arch/annotate-loongarch.c
> > @@ -29,6 +29,9 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
> >         ops->target.addr = strtoull(c, &endptr, 16);
> >
> >         name = strchr(endptr, '<');
> > +       if (name == NULL)
> > +               goto find_target;
> > +
> >         name++;
> >
> >         if (arch->objdump.skip_functions_char &&
> > @@ -46,6 +49,7 @@ static int loongarch_call__parse(const struct arch *arch, struct ins_operands *o
> >         if (ops->target.name == NULL)
> >                 return -1;
> >
> > +find_target:
> >         target = (struct addr_map_symbol) {
> >                 .ms = { .map = map__get(map), },
> >                 .addr = map__objdump_2mem(map, ops->target.addr),
> > --
> > 2.43.7
>
>