linux-kernel - [PATCH] perf annotate: fix 's' on source line when disasm is empty

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Mon,  5 Jul 2021 18:15:25 +0200
From:   Riccardo Mancini <rickyman7@...il.com>
To:     Arnaldo Carvalho de Melo <acme@...nel.org>
Cc:     Namhyung Kim <namhyung@...nel.org>,
        Ian Rogers <irogers@...gle.com>,
        Riccardo Mancini <rickyman7@...il.com>,
        Peter Zijlstra <peterz@...radead.org>,
        Ingo Molnar <mingo@...hat.com>,
        Mark Rutland <mark.rutland@....com>,
        Alexander Shishkin <alexander.shishkin@...ux.intel.com>,
        Jiri Olsa <jolsa@...hat.com>, Martin Liska <mliska@...e.cz>,
        linux-perf-users@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH] perf annotate: fix 's' on source line when disasm is empty

If the disasm is empty, 's' should fail. Instead it seemingly works,
hiding the empty lines and causing an assertion error on the next
time annotate is called (from within perf report).
The problem is caused by a buffer overflow, caused by a wrong
exit condition in annotate_browser__find_next_asm_line, which checks
browser->b.top instead of browser->b.entries.

This patch fixes the issue, making annotate_browser__toggle_source
fail if the disasm is empty (nothing happens to the user).

Fixes: 6de249d66d2e
Signed-off-by: Riccardo Mancini <rickyman7@...il.com>
---
 tools/perf/ui/browsers/annotate.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/tools/perf/ui/browsers/annotate.c b/tools/perf/ui/browsers/annotate.c
index f5509a958e38..5812a2214cc1 100644
--- a/tools/perf/ui/browsers/annotate.c
+++ b/tools/perf/ui/browsers/annotate.c
@@ -350,14 +350,14 @@ static struct annotation_line *annotate_browser__find_next_asm_line(
 	struct annotation_line *it = al;
 
 	/* find next asm line */
-	list_for_each_entry_continue(it, browser->b.top, node) {
+	list_for_each_entry_continue(it, browser->b.entries, node) {
 		if (it->idx_asm >= 0)
 			return it;
 	}
 
 	/* no asm line found forwards, try backwards */
 	it = al;
-	list_for_each_entry_continue_reverse(it, browser->b.top, node) {
+	list_for_each_entry_continue_reverse(it, browser->b.entries, node) {
 		if (it->idx_asm >= 0)
 			return it;
 	}
-- 
2.23.0