linux-kernel - Re: [PATCH v1 02/11] perf annotate: Fix args leak of map

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CAP-5=fUg=Gna1=HyugczBijYE07SnFHOO9OPutYQa+s8QcXBmw@mail.gmail.com>
Date: Thu, 22 Jan 2026 08:05:58 -0800
From: Ian Rogers <irogers@...gle.com>
To: Suchit Karunakaran <suchitkarunakaran@...il.com>
Cc: Peter Zijlstra <peterz@...radead.org>, Ingo Molnar <mingo@...hat.com>, 
	Arnaldo Carvalho de Melo <acme@...nel.org>, Namhyung Kim <namhyung@...nel.org>, 
	Alexander Shishkin <alexander.shishkin@...ux.intel.com>, Jiri Olsa <jolsa@...nel.org>, 
	Adrian Hunter <adrian.hunter@...el.com>, James Clark <james.clark@...aro.org>, 
	John Garry <john.g.garry@...cle.com>, Will Deacon <will@...nel.org>, Leo Yan <leo.yan@...ux.dev>, 
	Guo Ren <guoren@...nel.org>, Paul Walmsley <pjw@...nel.org>, Palmer Dabbelt <palmer@...belt.com>, 
	Albert Ou <aou@...s.berkeley.edu>, Alexandre Ghiti <alex@...ti.fr>, 
	Nathan Chancellor <nathan@...nel.org>, Nick Desaulniers <nick.desaulniers+lkml@...il.com>, 
	Bill Wendling <morbo@...gle.com>, Justin Stitt <justinstitt@...gle.com>, 
	Zecheng Li <zecheng@...gle.com>, Tianyou Li <tianyou.li@...el.com>, 
	Thomas Falcon <thomas.falcon@...el.com>, Julia Lawall <Julia.Lawall@...ia.fr>, 
	Athira Rajeev <atrajeev@...ux.ibm.com>, Aditya Bodkhe <aditya.b1@...ux.ibm.com>, 
	Howard Chu <howardchu95@...il.com>, 
	Krzysztof Łopatowski <krzysztof.m.lopatowski@...il.com>, 
	"Dr. David Alan Gilbert" <linux@...blig.org>, Shimin Guo <shimin.guo@...dio.com>, 
	Sergei Trofimovich <slyich@...il.com>, linux-kernel@...r.kernel.org, 
	linux-perf-users@...r.kernel.org, linux-arm-kernel@...ts.infradead.org, 
	linux-csky@...r.kernel.org, linux-riscv@...ts.infradead.org
Subject: Re: [PATCH v1 02/11] perf annotate: Fix args leak of map_symbol

On Thu, Jan 22, 2026 at 3:47 AM Suchit Karunakaran
<suchitkarunakaran@...il.com> wrote:
>
> > @@ -1119,7 +1121,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
> >                                       struct annotate_args *args,
> >                                       char *parsed_line, int *line_nr, char **fileloc)
> >  {
> > -       struct map *map = args->ms.map;
> > +       struct map *map = args->ms->map;
> >         struct annotation *notes = symbol__annotation(sym);
> >         struct disasm_line *dl;
> >         char *tmp;
> > @@ -1151,7 +1153,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
> >         args->line    = parsed_line;
> >         args->line_nr = *line_nr;
> >         args->fileloc = *fileloc;
> > -       args->ms.sym  = sym;
> > +       args->ms->sym  = sym;
> >
> >         dl = disasm_line__new(args);
> >         (*line_nr)++;
> > @@ -1172,7 +1174,7 @@ static int symbol__parse_objdump_line(struct symbol *sym,
> >                         .ms = { .map = map, },
> >                 };
> >
> > -               if (!maps__find_ams(args->ms.maps, &target) &&
> > +               if (!maps__find_ams(args->ms->maps, &target) &&
> >                     target.ms.sym->start == target.al_addr)
> >                         dl->ops.target.sym = target.ms.sym;
> >         }
>
> Hi, a noob here so please correct me if I'm wrong.
> Looking at symbol__parse_objdump_line(), shouldn't we be calling
> map__get() when initializing the target struct? Since maps__find_ams()
> now calls map__put() (after patch 1).
> struct addr_map_symbol target = {
>     .addr = dl->ops.target.addr,
>     .ms = { .map = map__get(map), },
> };
> This would match the pattern used in call__parse() and jump__parse()
> that were fixed in patch 2.

Agreed this is another problem. I'll add the missing put and
addr_map_symbol__exit missing here.

Thanks,
Ian