[PATCH] perf iostat: Reject incomplete and out-of-range port strings

[PATCH] perf iostat: Reject incomplete and out-of-range port strings

[lirongqing]

From: Li RongQing <lirongqing@baidu.com>

The root port regular expression accepts trailing characters and an
unbounded domain field. A nine-digit domain matches it but makes the
subsequent width-limited sscanf() stop before the bus. The parser still
returns success, allowing the filter to use an uninitialized or stale
bus value. A three-digit bus is silently truncated as well.

Match the complete notation within the documented domain and bus widths.
Check regular expression compilation and propagate conversion failures
instead of treating a warning as successful parsing.

Fixes: f9ed693e8bc0 ("perf stat: Enable iostat mode for x86 platforms")
Signed-off-by: Li RongQing <lirongqing@baidu.com>
---
 tools/perf/arch/x86/util/iostat.c | 9 +++++++--
 1 file changed, 7 insertions(+), 2 deletions(-)

diff --git a/tools/perf/arch/x86/util/iostat.c b/tools/perf/arch/x86/util/iostat.c
index f8b4939..7dc31f5 100644
--- a/tools/perf/arch/x86/util/iostat.c
+++ b/tools/perf/arch/x86/util/iostat.c
@@ -251,9 +251,14 @@ static int iio_root_port_parse_str(u32 *domain, u8 *bus, char *str)
 	 * Valid bus range [0:ff]
 	 * Example: 0000:af, 0:3d, 01:7
 	 */
-	regcomp(&regex, "^([a-f0-9A-F]{1,}):([a-f0-9A-F]{1,2})", REG_EXTENDED);
+	ret = regcomp(&regex, "^([a-f0-9A-F]{1,4}):([a-f0-9A-F]{1,2})$",
+		      REG_EXTENDED);
+	if (ret)
+		return ret;
 	ret = regexec(&regex, str, 0, NULL, 0);
-	if (ret || sscanf(str, "%08x:%02hhx", domain, bus) != 2)
+	if (!ret && sscanf(str, "%04x:%02hhx", domain, bus) != 2)
+		ret = -EINVAL;
+	if (ret)
 		pr_warning("Unrecognized root port format: %s\n"
 			   "Please use the following format:\n"
 			   "\t [domain]:[bus]\n"
-- 
2.9.4

Re: [PATCH] perf iostat: Reject incomplete and out-of-range port strings

[Namhyung Kim]

On Fri, 06 Nov 2026 10:20:27 +0800, lirongqing wrote:

> The root port regular expression accepts trailing characters and an
> unbounded domain field. A nine-digit domain matches it but makes the
> subsequent width-limited sscanf() stop before the bus. The parser still
> returns success, allowing the filter to use an uninitialized or stale
> bus value. A three-digit bus is silently truncated as well.
> 
> Match the complete notation within the documented domain and bus widths.
> Check regular expression compilation and propagate conversion failures
> instead of treating a warning as successful parsing.
> 
> [...]

Applied to perf-tools-next, thanks!

Best regards,
Namhyung