[PATCH v3 perf-tools-next 3/7] perf trace: Align pointer advance in augmented string beautifier

[Aaron Tomlin <atomlin@atomlin.com>]

When pretty-printing augmented string arguments via
syscall_arg__scnprintf_augmented_string(), the offset to advance to the
next augmented argument is computed as:

    consumed = sizeof(*augmented_arg) + augmented_arg->size;

Because sizeof(*augmented_arg) is 8 bytes, if augmented_arg->size is not
a multiple of 8 (e.g. from an unpadded capture or a malformed perf.data
file), arg->augmented.args is advanced to an unaligned memory address.

Round up the consumed payload bytes to a 64-bit boundary using
PERF_ALIGN(), matching the alignment produced by the BPF tracepoint
programs sys_enter_rename() and sys_enter_renameat2() (attached to
tp/syscalls/sys_enter_rename and tp/syscalls/sys_enter_renameat2).
If the aligned consumed offset exceeds the remaining buffer, reset
arg->augmented to prevent reading out of bounds on subsequent arguments.

Reported-by: sashiko-bot <sashiko-bot@kernel.org>
Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
---
 tools/perf/builtin-trace.c | 11 ++++++++---
 1 file changed, 8 insertions(+), 3 deletions(-)

diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
index 91461ab927b6..21c16e4c163a 100644
--- a/tools/perf/builtin-trace.c
+++ b/tools/perf/builtin-trace.c
@@ -1912,10 +1912,15 @@ static size_t syscall_arg__scnprintf_augmented_string(struct syscall_arg *arg, c
 	 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls
 	 * we would have two strings, each prefixed by its size.
 	 */
-	consumed = sizeof(*augmented_arg) + augmented_arg->size;
+	consumed = sizeof(*augmented_arg) + PERF_ALIGN(augmented_arg->size, sizeof(u64));
 
-	arg->augmented.args = ((void *)arg->augmented.args) + consumed;
-	arg->augmented.size -= consumed;
+	if (consumed > arg->augmented.size) {
+		arg->augmented.args = NULL;
+		arg->augmented.size = 0;
+	} else {
+		arg->augmented.args = ((void *)arg->augmented.args) + consumed;
+		arg->augmented.size -= consumed;
+	}
 
 	return printed;
 }
-- 
2.55.0