The fileloc is a copy of a pointer to a string but in places like
symbol_disassemble__llvm this string appears to be freed setting up
potential use-after-frees:

llvm.c:
```
		dl = disasm_line__new(args);
		if (dl == NULL)
			goto err;

		annotation_line__add(&dl->al, &notes->src->source);

		free(args->fileloc);
```
disasm.c:
```
static void annotation_line__init(struct annotation_line *al,
				  struct annotate_args *args,
				  int nr)
{
	al->offset = args->offset;
	al->line = strdup(args->line);
	al->line_nr = args->line_nr;
	al->fileloc = args->fileloc;
	al->data_nr = nr;
}

struct disasm_line *disasm_line__new(struct annotate_args *args)
{
	struct disasm_line *dl = NULL;
	struct annotation *notes = symbol__annotation(args->ms->sym);
	int nr = notes->src->nr_events;

	dl = zalloc(disasm_line_size(nr));
	if (!dl)
		return NULL;

	annotation_line__init(&dl->al, args, nr);
```

Fix this by making the fileloc a copy of the underlying string in its
init/exit.

Signed-off-by: Ian Rogers <irogers@google.com>
---
 tools/perf/util/disasm.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
index ddcc488f2e5f..b83bc14f82e1 100644
--- a/tools/perf/util/disasm.c
+++ b/tools/perf/util/disasm.c
@@ -908,13 +908,14 @@ static void annotation_line__init(struct annotation_line *al,
 	al->offset = args->offset;
 	al->line = strdup(args->line);
 	al->line_nr = args->line_nr;
-	al->fileloc = args->fileloc;
+	al->fileloc = args->fileloc ? strdup(args->fileloc) : NULL;
 	al->data_nr = nr;
 }
 
 static void annotation_line__exit(struct annotation_line *al)
 {
 	zfree_srcline(&al->path);
+	zfree(&al->fileloc);
 	zfree(&al->line);
 	zfree(&al->cycles);
 	zfree(&al->br_cntr);
-- 
2.53.0.473.g4a7958ca14-goog

> On 7 Mar 2026, at 12:46 AM, Ian Rogers <irogers@google.com> wrote:
> 
> The fileloc is a copy of a pointer to a string but in places like
> symbol_disassemble__llvm this string appears to be freed setting up
> potential use-after-frees:
> 
> llvm.c:
> ```
> dl = disasm_line__new(args);
> if (dl == NULL)
> goto err;
> 
> annotation_line__add(&dl->al, &notes->src->source);
> 
> free(args->fileloc);
> ```
> disasm.c:
> ```
> static void annotation_line__init(struct annotation_line *al,
>  struct annotate_args *args,
>  int nr)
> {
> al->offset = args->offset;
> al->line = strdup(args->line);
> al->line_nr = args->line_nr;
> al->fileloc = args->fileloc;
> al->data_nr = nr;
> }
> 
> struct disasm_line *disasm_line__new(struct annotate_args *args)
> {
> struct disasm_line *dl = NULL;
> struct annotation *notes = symbol__annotation(args->ms->sym);
> int nr = notes->src->nr_events;
> 
> dl = zalloc(disasm_line_size(nr));
> if (!dl)
> return NULL;
> 
> annotation_line__init(&dl->al, args, nr);
> ```
> 
> Fix this by making the fileloc a copy of the underlying string in its
> init/exit.
> 
> Signed-off-by: Ian Rogers <irogers@google.com>
> ---
> tools/perf/util/disasm.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
> 
> diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
> index ddcc488f2e5f..b83bc14f82e1 100644
> --- a/tools/perf/util/disasm.c
> +++ b/tools/perf/util/disasm.c
> @@ -908,13 +908,14 @@ static void annotation_line__init(struct annotation_line *al,
> al->offset = args->offset;
> al->line = strdup(args->line);
> al->line_nr = args->line_nr;
> - al->fileloc = args->fileloc;
> + al->fileloc = args->fileloc ? strdup(args->fileloc) : NULL;
> al->data_nr = nr;
> }
> 
> static void annotation_line__exit(struct annotation_line *al)
> {
> zfree_srcline(&al->path);
> + zfree(&al->fileloc);
Looks good to me.

Reviewed-by: Athira Rajeev <atrajeev@linux.ibm.com <mailto:atrajeev@linux.ibm.com>>

Thanks
Athira

> zfree(&al->line);
> zfree(&al->cycles);
> zfree(&al->br_cntr);
> -- 
> 2.53.0.473.g4a7958ca14-goog
> 

On Fri, Mar 6, 2026 at 11:16 AM Ian Rogers <irogers@google.com> wrote:
>
> The fileloc is a copy of a pointer to a string but in places like
> symbol_disassemble__llvm this string appears to be freed setting up
> potential use-after-frees:
>
> llvm.c:
> ```
>                 dl = disasm_line__new(args);
>                 if (dl == NULL)
>                         goto err;
>
>                 annotation_line__add(&dl->al, &notes->src->source);
>
>                 free(args->fileloc);
> ```
> disasm.c:
> ```
> static void annotation_line__init(struct annotation_line *al,
>                                   struct annotate_args *args,
>                                   int nr)
> {
>         al->offset = args->offset;
>         al->line = strdup(args->line);
>         al->line_nr = args->line_nr;
>         al->fileloc = args->fileloc;
>         al->data_nr = nr;
> }
>
> struct disasm_line *disasm_line__new(struct annotate_args *args)
> {
>         struct disasm_line *dl = NULL;
>         struct annotation *notes = symbol__annotation(args->ms->sym);
>         int nr = notes->src->nr_events;
>
>         dl = zalloc(disasm_line_size(nr));
>         if (!dl)
>                 return NULL;
>
>         annotation_line__init(&dl->al, args, nr);
> ```
>
> Fix this by making the fileloc a copy of the underlying string in its
> init/exit.
>
> Signed-off-by: Ian Rogers <irogers@google.com>

Ping.

Thanks,
Ian

> ---
>  tools/perf/util/disasm.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/perf/util/disasm.c b/tools/perf/util/disasm.c
> index ddcc488f2e5f..b83bc14f82e1 100644
> --- a/tools/perf/util/disasm.c
> +++ b/tools/perf/util/disasm.c
> @@ -908,13 +908,14 @@ static void annotation_line__init(struct annotation_line *al,
>         al->offset = args->offset;
>         al->line = strdup(args->line);
>         al->line_nr = args->line_nr;
> -       al->fileloc = args->fileloc;
> +       al->fileloc = args->fileloc ? strdup(args->fileloc) : NULL;
>         al->data_nr = nr;
>  }
>
>  static void annotation_line__exit(struct annotation_line *al)
>  {
>         zfree_srcline(&al->path);
> +       zfree(&al->fileloc);
>         zfree(&al->line);
>         zfree(&al->cycles);
>         zfree(&al->br_cntr);
> --
> 2.53.0.473.g4a7958ca14-goog
>