[PATCH perf] perf annotate: fix annotate crash for fused instructions

From: Yao

Date: Mon Nov 09 2026 - 18:04:00 EST


From: yao <dragonlinux@xxxxxxxxx>

Function is_fused tries to find the previous fused instruction with
the current conditional jump instruction in the annotate_line list.
disasm_line is the container of annotate_line.
The annotate_line list uses list_head and the head is in
annotated_source: notes->src->source which is not an annotate_line,
so it couldn't walk without checking the list_head.
If so it will read annoted_source neighbour memory mistakenly and most
likely cause crash.

Fix the case where current instruction is a conditional jump and it is
the first instruction in the disassembled list, the original code will
walk to the head and treats it as disasm_line which is not.

Signed-off-by: yao <dragonlinux@xxxxxxxxx>
---
tools/perf/ui/browsers/annotate.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)

diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index cf36b5347f72..07449944fa2e 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -155,17 +155,26 @@ static void annotate_browser__write(struct ui_browser *browser, void *entry, int

static int is_fused(struct annotate_browser *ab, struct disasm_line *cursor)
{
- struct disasm_line *pos = list_prev_entry(cursor, al.node);
+ struct annotation *notes = browser__annotation(&ab->b);
+ struct list_head *node = cursor->al.node.prev;
+ struct disasm_line *pos;
const char *name;
int diff = 1;

- while (pos && pos->al.offset == -1) {
- pos = list_prev_entry(pos, al.node);
+ /*
+ * backwalk to the nearest neighbour instruction till the list head
+ * instructions/non-insn are ordered from head to tail
+ * head is not a annotate_line/disasm_line
+ */
+ for (; node != &notes->src->source; node = node->prev) {
+ pos = list_entry(node, struct disasm_line, al.node);
+ if (pos->al.offset != -1)
+ break;
if (!annotate_opts.hide_src_code)
diff++;
}

- if (!pos)
+ if (node == &notes->src->source)
return 0;

if (ins__is_lock(&pos->ins))
--
2.56.0