mirrors/linux
2
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-08-31 03:35:32 -04:00
Code Issues Packages Projects Releases Wiki Activity

perf ui hists: Fix dso_filter reference leak and exit zoom cleanup

Browse Source 
In hists_browser__zoom_map(), the active dso is assigned as a raw
pointer to hists->dso_filter without acquiring a reference using
dso__get(). This creates a potential use-after-free defect if the
underlying dso is released while the filter remains active.

Fix it by properly acquiring a reference via dso__get() when assigning
the filter, and releasing it with dso__put() when clearing it.
Additionally, since the browser stack relies on pstack__new() and deletes
it completely upon exiting, we must fully reset the persistent hists
structure by un-eliding columns and recalculating histogram filter
states for dso, thread, and symbols upon exit to guarantee immaculate,
uncorrupted state across browser tab switching.

Closes: https://lore.kernel.org/linux-perf-users/20260709170834.52F1A1F000E9@smtp.kernel.org/
Assisted-by: Antigravity:gemini-3.5-flash
Signed-off-by: Ian Rogers <irogers@google.com>
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
This commit is contained in:
Ian Rogers
2026-07-22 21:59:47 -07:00
committed by Namhyung Kim
parent ae89153d5e
commit bd86119c3e
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
tools/perf/ui/browsers/hists.c
View File

@@ -2651,13 +2651,14 @@ static int hists_browser__zoom_map(struct hist_browser *browser, struct map *map
if (browser->hists->dso_filter) {
pstack__remove(browser->pstack, &browser->hists->dso_filter);
perf_hpp__set_elide(HISTC_DSO, false);
dso__put((struct dso *)browser->hists->dso_filter);
browser->hists->dso_filter = NULL;
ui_helpline__pop();
} else {
struct dso *dso = map__dso(map);
ui_helpline__fpush("To zoom out press ESC or ENTER + \"Zoom out of %s DSO\"",
__map__is_kernel(map) ? "the Kernel" : dso__short_name(dso));
browser->hists->dso_filter = dso;
browser->hists->dso_filter = dso__get(dso);
perf_hpp__set_elide(HISTC_DSO, true);
pstack__push(browser->pstack, &browser->hists->dso_filter);
}
@@ -3025,7 +3026,7 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h
struct branch_info *bi = NULL;
#define MAX_OPTIONS 32
char *options[MAX_OPTIONS];
struct popup_action actions[MAX_OPTIONS];
struct popup_action actions[MAX_OPTIONS], hotkey_act;
int nr_options = 0;
int key = -1;
char buf[128];
@@ -3498,6 +3499,13 @@ static int evsel__hists_browse(struct evsel *evsel, int nr_events, const char *h
out_free_stack:
pstack__delete(browser->pstack);
free_popup_actions(actions, MAX_OPTIONS);
thread__zput(hists->thread_filter);
dso__put((struct dso *)hists->dso_filter);
hists->dso_filter = NULL;
perf_hpp__set_elide(HISTC_DSO, false);
perf_hpp__set_elide(HISTC_THREAD, false);
hists__filter_by_dso(hists);
hists__filter_by_thread(hists);
out:
hist_browser__delete(browser);
free_popup_options(options, MAX_OPTIONS);