From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f50.google.com (mail-wm1-f50.google.com [209.85.128.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4572233C52E for ; Tue, 26 May 2026 11:09:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779793743; cv=none; b=m+hyGzUK5s9PkTfyx+Tur17oz8tWMyK7IURBugLAbb48/hjgcNYp/yc+gWzTkVRTFpT97VMtLEftAFIB/it94xx50Qocyw4GhaO4NsLWkLWoKw5Tc1KFkNkamOfPMj4tJgpkj76r9JXXuVBB4oSV1ZSpbxLezEBMAu/toCz5bNY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1779793743; c=relaxed/simple; bh=G+SaZtsPGICMMRXKLkXkaXrOj8OjEwMS59vMa1iZH5k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=YYuxgF/BBWVhh1rKyB2VDnBh/Ze+FgK1MMMPZFLZ1UXIMHbMnBvp94pEkklHt8+Apmyk0FJBuk4yI2u8x34gqkFocWeCoNSJaPuD5QOv4dC61EDWy2buxTYVRzKmoNoNUGP2fXtDs/aykkgp7UrebimjFn+aoCX+xgHfk0O3dhM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=sMgHPqG6; arc=none smtp.client-ip=209.85.128.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="sMgHPqG6" Received: by mail-wm1-f50.google.com with SMTP id 5b1f17b1804b1-4904fd4f6aeso28441755e9.2 for ; Tue, 26 May 2026 04:09:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1779793741; x=1780398541; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=+MAzFpkY1EBbeS/4IQl63G444h7xlLlXRk2dpumz+FI=; b=sMgHPqG6ZIGFWbGT+Wz8v10pmxv53foTp6awAQH4OyMna6nvuYM/gWwE2GoXnQzio4 S1hPEUsEF24NW54MtvHTco1bC7e66Jr9Te1eCQY4Rc5tmGLsTfYO4LSobh/iICj7P+4b v6TKKEsS/pZoX2YyOiOzvqkg87PA0eXzaExeyoFvtmAHdtC+3+z5kW3YaCB5J3+yynOr u2wieZCqqeo3oJw1NlAvyL8MtUajVHKOBpvUa1VNz/X3vxSzcIvl59TOPJiJ8V2WkWLq /CsOww73Uq1xNb1/ZnKu1+WKGM1qkWV+O3OTpEyOZuI3rue6Lw+/Pt5Y03AwvRUIeEZJ PsQg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1779793741; x=1780398541; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=+MAzFpkY1EBbeS/4IQl63G444h7xlLlXRk2dpumz+FI=; b=M1eaxVLXPpRQ1w7oKZDrq//R+9+Fd2ex2d1y/e2xVysvFft+Lk6ntNoMeMdDJLr7If XOcsNUG4x58+5oUVP8Z7n2cwp/DvmOgdZYJtUDL/AHhRtGCX+8wJvr8ZX4MIIRqXAaHm izhysN+ahWlsH+BGSql1mFB22Yw2bJv48nYs8PGreMcLnb7bgZE0QdYwj4eqrcY4O4QH VZHkg82IT7boF4DWbTIvpa0eagVVQqqtOez69W3rr2RLedGZUdn3mXJkLIc3sjtXw5VQ ABLTjGwwYsGkINPWYyaV+6tPCPlNKwubKh7NUYn6wcBY5xeytVOcAlX1APoqIgaHIcW/ CC/A== X-Gm-Message-State: AOJu0YxONjEzXy6zW8In0CBLewPBmjpCX+6qPkkJQVt5gVjBP+XTAn6H hYGVITgQAvE5cDeQ2+IusC4QLj5NM3a219W5N02+QMDRS0sEgWBNi1pe X-Gm-Gg: Acq92OFZdsjJvLH4IbwWQcw7RKApdTex+MxIKyV4HY6z/lCtns1cQ5xOagEuZlvdnrv PBYGE8eY3WoDdp2qe4lwDjvJhazPqkuMDZRUMjNEvhbsxW8fboEKUfAXUOwvttvoXYBlNo0pMdY caav7/xdZxsSM+OQ+cXUKlxJoqcjb+GIAJLrwJGbxlLrlWSFxG/RscXlPvAAh6wgejqwq7wEL7j iIIg0c20P/529qTquxAtef1YxC7Yr3RQ4e6nxOXEvFjjJXDJbGR6Q8i3EgnPCG6xRp4oa+4BxTd gkw+aPoevOxNWl0Ret60z4G3opHP46l0gOulPSsU/7g+08kr3bjxZPW5TS8x5TVL9knMCOTcwjx Sh/a0QZspKw7O9wbqQwHrSeTe/l1LoX670j1jBsvsX2rFIjqc2CcjqW1H1ibalGFnGt37l0Neva NhJf48Phms/D8uxQAYePD3iMmFoXlIy+ng/wTwnW1co099o1NBPO9qxsEyuBg2HYKRmsti3sKim Z/G7ocaDUN2Hl/Ucr7z0EpCnz0755HAAU1QAgDb X-Received: by 2002:a05:600c:c8d:b0:490:6869:46d2 with SMTP id 5b1f17b1804b1-490686947f8mr105465335e9.0.1779793740399; Tue, 26 May 2026 04:09:00 -0700 (PDT) Received: from MiguelMartnGil.uab.cat (wifixm-si-gw.uab.cat. [158.109.94.91]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-49045282201sm354162835e9.8.2026.05.26.04.08.59 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 26 May 2026 04:09:00 -0700 (PDT) From: =?UTF-8?q?Miguel=20Mart=C3=ADn=20Gil?= To: linux-perf-users@vger.kernel.org Cc: linux-kernel@vger.kernel.org, peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org, =?UTF-8?q?Miguel=20Mart=C3=ADn=20Gil?= Subject: [PATCH 0/1] perf util: fix out-of-bounds write in perf_exe() Date: Tue, 26 May 2026 13:08:51 +0200 Message-ID: <20260526110852.7259-1-miguel.martin.gil.uni@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit perf_exe() currently passes the full buffer length to readlink() and then unconditionally appends a trailing NUL at buf[n]. When readlink() returns exactly len bytes, the NUL store lands one byte past the end of the caller buffer. This series fixes it by reading at most len - 1 bytes and keeping explicit NUL termination only within bounds. It also hardens the fallback path for tiny buffers so copying "perf" cannot overflow. Miguel Martín Gil (1): perf util: fix perf_exe() buffer write past end tools/perf/util/util.c | 12 +++++++++++- 1 file changed, 11 insertions(+), 1 deletion(-) -- 2.43.0