[PATCH v3 perf-tools-next 0/7] perf trace: Validate payload bounds across augmented argument beautifiers

[Aaron Tomlin <atomlin@atomlin.com>]

When pretty-printing augmented syscall arguments in perf trace, raw payload
data captured from BPF programs is passed to various argument formatters
via struct syscall_arg.

However, when processing malformed, truncated, or untrusted perf.data
records (e.g. truncated reads in BPF ringbuffers, cross-architecture
replays, or crafted sample records), the payload can be shorter than
expected or contain invalid size fields:
    1.  Dereferencing augmented_arg fields before validating that
        arg->augmented.size is at least sizeof(struct augmented_arg) can read
        past the available buffer.

    2.  Passing augmented_arg->size to formatters or loop counters without
        bounding it against the remaining buffer can cause out-of-bounds memory
        reads.

    3.  In multi-argument syscalls (e.g. rename*), calculating consumed bytes
        without 64-bit alignment advances arg->augmented.args to unaligned
        addresses. Furthermore, calculating consumed offsets without bounds
        checking can overflow signed integer bounds or cause arg->augmented.size
        to underflow, advancing arg->augmented.args out of bounds and
        corrupting the parsing state for all subsequent arguments.

    4.  Type/family-specific beautifiers (i.e. BTF struct dump, sockaddr,
        timespec, perf_event_attr) can dereference structure fields without
        verifying that the payload contains sufficient bytes for the target
        type, or trust embedded size fields (such as attr->size) that exceed
        the actual captured buffer.

This series adds comprehensive upper-bound and payload-size checks across
all augmented argument beautifiers in perf trace, enforces 64-bit pointer
alignment when consuming multi-argument payloads, and ensures extensible
dispatching for address family formatters. If validation fails in any
beautifier, it cleanly falls back to printing the raw pointer/hex value.

To facilitate clean, conflict-free backports across active LTS kernels,
each fix is isolated to its own commit.

Changes since v2:

 - Expanded the series from 6 to 7 patches by splitting the string
   beautifier pointer advancement and 64-bit alignment logic into a
   dedicated patch

 - Added a new patch to round up consumed payload bytes to 64-bit
   boundaries using PERF_ALIGN(), matching the alignment produced by the
   BPF tracepoint probes (sys_enter_rename*) in
   augmented_raw_syscalls.bpf.c

 - Reset arg->augmented on buffer overrun to prevent corrupted parsing
   state from reading out of bounds on subsequent arguments

 - Validated payload size directly against arg->augmented.size instead of
   reading augmented_arg->size, which is unpopulated by the BPF tracer
   (sys_enter_{clock_,}nanosleep) and contains stale per-CPU map data

 - Refactored af_scnprintfs into a dispatch table associating each
   formatter with its minimum required payload size (.min_size), preserving
   extensibility for future address families without hardcoded conditionals

 - Used offsetof(struct sockaddr_un, sun_path) + 1 for AF_LOCAL rather than
   sizeof(struct sockaddr_un) to correctly accommodate variable-length
   domain socket paths

 - Validated payload size against arg->augmented.size and payload_size
   rather than reading uninitialized augmented_arg->size

 - Validated payload size directly against arg->augmented.size instead of
   reading uninitialized augmented_arg->size, which is unpopulated by
   sys_enter_perf_event_open()

 - Verified that when attr->size is specified, it is at least
   PERF_ATTR_SIZE_VER0 and does not exceed payload_size, preventing
   out-of-bounds reads in perf_event_attr__fprintf() caused by malformed
   records or TOCTOU mutations during trace capture

 - Link to v2: https://lore.kernel.org/lkml/20260907015140.363076-1-atomlin@atomlin.com/

Changes since v1:

 - Expanded the original single patch into a 6-patch series in response to
   reviewer feedback from sashiko-bot regarding similar bounds check
   omissions across other augmented formatters in perf trace

 - Added new patch validating payload bounds and consumed offset
   calculations in syscall_arg__scnprintf_augmented_string()

 - Added new patch validating payload bounds before byte traversal in
   syscall_arg__scnprintf_buf(), isolated to ensure an independent Fixes:
   tag for stable backports

 - Added new patch validating payload size against sizeof(struct timespec)
   in syscall_arg__scnprintf_augmented_timespec()

 - Added new patch validating payload bounds and family-specific lengths in
   syscall_arg__scnprintf_augmented_sockaddr()

 - Added new patch validating payload size against at least
   PERF_ATTR_SIZE_VER0 in
   syscall_arg__scnprintf_augmented_perf_event_attr()

 - Link to v1: https://lore.kernel.org/all/20260906011132.279321-1-atomlin@atomlin.com/

Aaron Tomlin (7):
  perf trace: Add upper bound checks for augmented BTF struct printing
  perf trace: Validate payload bounds in augmented string beautifier
  perf trace: Align pointer advance in augmented string beautifier
  perf trace: Validate payload bounds in augmented buffer beautifier
  perf trace beauty: Validate payload size in augmented timespec
    beautifier
  perf trace beauty: Validate payload size in augmented sockaddr
    beautifier
  perf trace beauty: Validate payload size in augmented perf_event_open
    beautifier

 tools/perf/builtin-trace.c                | 45 +++++++++++++++++------
 tools/perf/trace/beauty/perf_event_open.c | 23 ++++++++++--
 tools/perf/trace/beauty/sockaddr.c        | 35 +++++++++++++-----
 tools/perf/trace/beauty/timespec.c        | 15 ++++++--
 4 files changed, 91 insertions(+), 27 deletions(-)


base-commit: 02f6847e1822714a4201b87e42f92b0d43e8549d
-- 
2.55.0