mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 11:41:29 -04:00
Code Issues Packages Projects Releases Wiki Activity

perf ui hists: Fix stack use-after-return in symbol_filter_str

Browse Source 
In evsel__hists_browse(), the local stack array 'buf' is assigned
directly to the persistent 'hists->symbol_filter_str' pointer. When the
browser returns or is exited, this dangling pointer remains active in
the 'hists' struct and is read asynchronously by the perf top background
timer, triggering a stack use-after-return.

Fix it by properly duplicating the input string using strdup(), safely
invoking zfree() to prevent memory leaks when overwriting, and cleanly
resetting and freeing the symbol filter string upon exiting the browser.

Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
This commit is contained in:
Ian Rogers
2026-07-22 21:59:44 -07:00
committed by Namhyung Kim
parent b2d4225695
commit ad7620a2b9
3 changed files with 10 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
tools/perf/builtin-report.c
View File

@@ -726,8 +726,11 @@ static int report__collapse_hists(struct report *rep)
evlist__for_each_entry(rep->session->evlist, pos) {
struct hists *hists = evsel__hists(pos);
if (pos->core.idx == 0)
hists->symbol_filter_str = rep->symbol_filter_str;
if (pos->core.idx == 0) {
hists->symbol_filter_str =
rep->symbol_filter_str ?
strdup(rep->symbol_filter_str) : NULL;
}
hists->socket_filter = rep->socket_filter;

5
tools/perf/ui/browsers/hists.c
View File

@@ -3220,7 +3220,10 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h
"To remove the filter later, press / + ENTER.",
buf, "ENTER: OK, ESC: Cancel",
delay_secs * 2) == K_ENTER) {
hists->symbol_filter_str = *buf ? buf : NULL;
char *new_filter = *buf ? strdup(buf) : NULL;
zfree(&hists->symbol_filter_str);
hists->symbol_filter_str = new_filter;
hists__filter_by_symbol(hists);
hist_browser__reset(browser);
}

1
tools/perf/util/hist.c
View File

@@ -3056,6 +3056,7 @@ static void hists_evsel__exit(struct evsel *evsel)
struct perf_hpp_list_node *node, *tmp;
hists__delete_all_entries(hists);
zfree(&hists->symbol_filter_str);
zfree(&hists->mem_stat_types);
zfree(&hists->mem_stat_total);