From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f201.google.com (mail-pf1-f201.google.com [209.85.210.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2B864402420 for ; Wed, 20 May 2026 19:06:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779303999; cv=none; b=HhDD2yXzAfzay0KsN+Q9ZZAc5fIAOxKBtyQ//dL7t50o6kxd2ia/t/0RMx/wDJmMZvNh2TOsUU80lz5tl4FHj03Qufs49d3tOU1DBp+nDE/fzCfe6wzfOO9xTxkDvCELdRHOuAjkdKyIKQOeHEY+MG8E0DubP0DzHuZwxbS7Nyw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779303999; c=relaxed/simple; bh=2M5rXmJ3rg66ZyLEjBuMA3CMdMUC9+DRzQaj4akJ76Y=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=usGAOOmymvY2+R44k608FvfaIVD6/8xH2nvByB/M5+YcW8fpGVh2TslpcxQUDvlFFkmN7fb9I8IEBh64Uehzgti7lGykrZAPyS5tpp0EJzWj3l8N9RH8aIVNTp7LykhwIqw3S8vDDkzP7U6SzEc4U3sI0kjlBDzeiqdI2weyvSw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=lTLZX/DX; arc=none smtp.client-ip=209.85.210.201 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="lTLZX/DX" Received: by mail-pf1-f201.google.com with SMTP id d2e1a72fcca58-82f9f49e4beso2607175b3a.0 for ; Wed, 20 May 2026 12:06:38 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1779303997; x=1779908797; darn=vger.kernel.org; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:from:to:cc:subject:date:message-id:reply-to; bh=x3pEwg+RW1FBx+3GhdoF3AbL/Tg6ZDZTjvlbAIQHLO4=; b=lTLZX/DXicbRjDCr2b+IBkmLCpBPhAcB6D1zDk9t9f5I5d3o5nTTfeaVemoAT7dxDs XAVd/R8VaSadhShNbStL0lKEp9HIWRk76zAqUo92ozYGLwere3KnM5m8cWo6pypAtLAr wbIN1u0h179B3ILbkh821YGH1i2ZsCCms+rTVDSnDThM1DA0EC4SxmkcBkwzCvRcCwJu Uh/B+93zR7YMfQnSKLqVaQ488rxSB9vadyNU2MJWU6S1rMw1pgkO89+grVAu9v8DUFoy aRNBBU4GHLZruJXVP0EGyeAvLEfGp82ruuniHR8yH21AZnHJIUCoaO5Kec8mwauspYug YeyQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779303997; x=1779908797; h=cc:to:from:subject:message-id:references:mime-version:in-reply-to :date:x-gm-message-state:from:to:cc:subject:date:message-id:reply-to; bh=x3pEwg+RW1FBx+3GhdoF3AbL/Tg6ZDZTjvlbAIQHLO4=; b=lP+NC+PytYF1TY+wvNrkC4uKBd4CvvHx16k8CFKTr5LN3FgVZCF8nB687k0SPNuuIQ 79BBSJPQXWbJXFE1Jp3Xfd2piMaw4tpxXgVMmPMc4nJ17FXhjrjMhwSDcutlWThkP8Ho UxzomVFWLp9jWRoZO+niaGv3TwTyIPpNJoA/4pf2LmKB6Wn8CXXUDlVH9lwsvuj9Pd0m 0vmf/ouFvT4HJXI/C9tNLsDxxohN5s9Ncc6IODvtTtuLSU1c/qSO3/CntpF0ITG66cwf /ICq8+wP7sMv0jFnmZglylBUxa1g/mcgWDbu3jdlv2HVaOiM8yHxODrHZxVTziopXkam +l0w== X-Forwarded-Encrypted: i=1; AFNElJ91dEEDT2B9dejEtn2g/Hob8zqboLGnItB9HsDF5Ooj1z+LswpIlYl9ezoPynQUlWG2iMXgdt1Gx70hJIg=@vger.kernel.org X-Gm-Message-State: AOJu0YzYn+bK43JvVN1/PMFXcpuP3cuZnQtxz7OnAq3bq71x9AiJ4syu IdKQYAIzuOO5QgC5ttmlLRLcB82891MmqPxLZ+HCbx3k5I+FPnHFZQEfVQBWF2y+sYfpTOf2bWp Alv8UXImILg== X-Received: from pfbem13.prod.google.com ([2002:a05:6a00:374d:b0:837:8d8a:cd3e]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:4094:b0:837:8b75:a5ac with SMTP id d2e1a72fcca58-83f33d8860emr25854742b3a.34.1779303997265; Wed, 20 May 2026 12:06:37 -0700 (PDT) Date: Wed, 20 May 2026 12:05:32 -0700 In-Reply-To: <20260520190538.142018-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260512223001.2952848-1-irogers@google.com> <20260520190538.142018-1-irogers@google.com> X-Mailer: git-send-email 2.54.0.746.g67dd491aae-goog Message-ID: <20260520190538.142018-27-irogers@google.com> Subject: [PATCH v14 26/32] perf synthetic-events: Bound check when synthesizing mmap2 and build_id events From: Ian Rogers To: irogers@google.com, acme@kernel.org, namhyung@kernel.org Cc: adrian.hunter@intel.com, ajones@ventanamicro.com, ak@linux.intel.com, alex@ghiti.fr, alexander.shishkin@linux.intel.com, anup@brainfault.org, aou@eecs.berkeley.edu, atrajeev@linux.ibm.com, blakejones@google.com, ctshao@google.com, dapeng1.mi@linux.intel.com, derek.foreman@collabora.com, dvyukov@google.com, howardchu95@gmail.com, hrishikesh123s@gmail.com, james.clark@linaro.org, jolsa@kernel.org, krzysztof.m.lopatowski@gmail.com, leo.yan@arm.com, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, linux@treblig.org, mingo@redhat.com, nichen@iscas.ac.cn, palmer@dabbelt.com, peterz@infradead.org, pjw@kernel.org, ravi.bangoria@amd.com, swapnil.sapkal@amd.com, tanze@kylinos.cn, thomas.falcon@intel.com, tianyou.li@intel.com, yujie.liu@intel.com, zhouquan@iscas.ac.cn Content-Type: text/plain; charset="UTF-8" Add robust boundary checks when synthesizing mmap2 and build_id events to ensure that filename fields do not overflow the fixed-size stack allocations or the synthesized event structures. Verify that the filename fits safely within the allocated boundaries of the mmap2 event structure, and prevent potential heap/stack overflow corruptions from excessively long or corrupted kernel filenames. Signed-off-by: Ian Rogers Acked-by: Namhyung Kim --- tools/perf/util/synthetic-events.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c index de812a2befbc..0816f893b916 100644 --- a/tools/perf/util/synthetic-events.c +++ b/tools/perf/util/synthetic-events.c @@ -2257,14 +2257,20 @@ int perf_event__synthesize_build_id(const struct perf_tool *tool, const char *filename) { union perf_event ev; - size_t len; + size_t len, filename_len = strlen(filename); u64 sample_type = sample->evsel ? sample->evsel->core.attr.sample_type : 0; void *array = &ev; int ret; - len = sizeof(ev.build_id) + strlen(filename) + 1; + if (filename_len >= PATH_MAX) + return -EINVAL; + + len = sizeof(ev.build_id) + filename_len + 1; len = PERF_ALIGN(len, sizeof(u64)); + if (len + MAX_ID_HDR_ENTRIES * sizeof(__u64) > sizeof(ev)) + return -E2BIG; + memset(&ev, 0, len); ev.build_id.size = bid->size; @@ -2303,14 +2309,21 @@ int perf_event__synthesize_mmap2_build_id(const struct perf_tool *tool, const char *filename) { union perf_event ev; + size_t filename_len = strlen(filename); size_t ev_len; u64 sample_type = sample->evsel ? sample->evsel->core.attr.sample_type : 0; void *array; int ret; - ev_len = sizeof(ev.mmap2) - sizeof(ev.mmap2.filename) + strlen(filename) + 1; + if (filename_len >= sizeof(ev.mmap2.filename)) + return -EINVAL; + + ev_len = sizeof(ev.mmap2) - sizeof(ev.mmap2.filename) + filename_len + 1; ev_len = PERF_ALIGN(ev_len, sizeof(u64)); + if (ev_len + MAX_ID_HDR_ENTRIES * sizeof(__u64) > sizeof(ev)) + return -E2BIG; + memset(&ev, 0, ev_len); ev.mmap2.header.type = PERF_RECORD_MMAP2; -- 2.54.0.746.g67dd491aae-goog