From nobody Sat Jul 25 00:10:54 2026 Received: from mail-pg1-f198.google.com (mail-pg1-f198.google.com [209.85.215.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E249442FD4 for ; Tue, 21 Jul 2026 23:09:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675399; cv=none; b=I5m2YbtWtlsvm7d6j9MfrC7ZZGpGWzQbVDu9BsS5BlMnvsRZOherXGTyFNTLWRUytKKVZ0ytKzf9nP1TfHy+ELQEjJ/FWA0I8rk1oidzxgUQOe2WS4n4fuhlEJoGYxsvn33MUM1/F2E9TRvJ3t/j6CqimxJxldc/oPukwJViNr4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675399; c=relaxed/simple; bh=pj0KjjICAGQcYFvJa34O/R6iaQNWxgcdqHf3gBWUcgM=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=UGuNV0Z8yK+wwSQLqXncbbpZV7GJEmwVNvdMWBQjTJ0iI8LUVfo2/bP7DiJ9fUCeIEMADqMlaW13P2k/ssYtEMhXe5I1hf/DzmPQYPRoGxO6Dwu/ee3uO0CPrc8H6Rxoj9Yt1UFDaz8dkhkLs5cw/kjkzQVb7zK5xjg8XcdQwDE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=rRTG96et; arc=none smtp.client-ip=209.85.215.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="rRTG96et" Received: by mail-pg1-f198.google.com with SMTP id 41be03b00d2f7-cb835525b10so2792454a12.2 for ; Tue, 21 Jul 2026 16:09:58 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784675398; x=1785280198; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=d5jG9NVpjcGT0OyijdNnlD4kEtCaHdlCbuAaGu1kfKk=; b=rRTG96etRwL5OP+7eMF/P4/HdhL1PAus1G9lfvuADKRcwXjo3xWd0sTxDk5yQMZBLH LCzSxQyx4oWhDP+VSChoXQWZ4PwMN1Ly0vV1+C8ldeaxazaUdn2vBgbpXcrHBzBH05Gm FcxO4oOKwvu5KmGkVoRo/MBfw9wJs3VDpZoZDSZSGln3jUktIyB7Cta1Pq9Mnnr+6Qvj /JKPt+Tf7nc0ib06NnRCOkJbnnRjqWbBJ4SsR9GgyWe823oXOQV8CAPUPlq5SP3s+yTh 5flUlB2tRifcH83Y5opgjct6bhif6k7YsCcKXZUydZRODbpm1Ngrn/Yu80XdPSzS8YJh bJwA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784675398; x=1785280198; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=d5jG9NVpjcGT0OyijdNnlD4kEtCaHdlCbuAaGu1kfKk=; b=hW335XEY6GbwhKeDAaceImJPQSaACS7zs/+rINyjf7PArwZtMSZtbnL6SsVBiBZNfJ A7tbkpBYAzMU45C0sehus2//uWuDXg7nQvxUkuq4TM2zdJ3kw73YxSOTerq5wW30HfFJ 4sGhamfGqWigH1FG47dH0JV+nqBPKKZUdGkCVw5SUVfGeh6fBRp4QeGqxkxE7Uz5k7i2 OBa1pK6QKe2p2fmDxgUDqZHiQoXwfsKWLiaGvWZzoXvS9idYNAudow78UdAb+ZLVUK2c MpOrWJx8dn8iIBSIdpJF4T3+L2m2rVFKjwGH1Ul30AdMGKNgRGpRZRFTkH10TPGZFZ3t uYhg== X-Forwarded-Encrypted: i=1; AHgh+Rqd6Bcpg57oCeKJXzP2f8pvvkPEBdeXX8d8K9YlkFMZVKMMXTEi5onfgD+h8D8wGVdJgd3jlCyqaDN4IG8=@vger.kernel.org X-Gm-Message-State: AOJu0YzzI5wm4yKFcIBHpFF9xF2V+V70Ey/gtJRsFA12d1/4HKJ+f66r zmLtfiNWonybn0bqDSr+q8fS4ZtHSWGgtUjQN94eHkdZYLberlwEgXxnc21NX52NjuLz8kqfVhP rGeHiaHEZ2Q== X-Received: from dly2-n2.prod.google.com ([2002:a05:701b:2042:20b0:13c:bfe9:dc09]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:2583:b0:3b2:a809:1000 with SMTP id adf61e73a8af0-3c3ad6042d1mr22052434637.3.1784675397536; Tue, 21 Jul 2026 16:09:57 -0700 (PDT) Date: Tue, 21 Jul 2026 16:09:49 -0700 In-Reply-To: <20260721230952.267754-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260721205746.183206-1-irogers@google.com> <20260721230952.267754-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.229.g6434b31f56-goog Message-ID: <20260721230952.267754-2-irogers@google.com> Subject: [PATCH v6 1/4] perf find-map: Remove PATH_MAX 128-byte stack array restriction From: Ian Rogers To: irogers@google.com, acme@kernel.org, namhyung@kernel.org Cc: adrian.hunter@intel.com, james.clark@linaro.org, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, ravi.bangoria@amd.com, swapnil.sapkal@amd.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Use getline() to dynamically allocate the required line buffer for maps parsing, guaranteeing bounds safety and avoiding compiler warnings by evaluating the return value in the loop condition directly. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/util/find-map.c | 10 ++++++++-- 1 file changed, 8 insertions(+), 2 deletions(-) diff --git a/tools/perf/util/find-map.c b/tools/perf/util/find-map.c index 7b2300588ece..bba511795a69 100644 --- a/tools/perf/util/find-map.c +++ b/tools/perf/util/find-map.c @@ -1,8 +1,13 @@ // SPDX-License-Identifier: GPL-2.0 +#include +#include +#include + static int find_map(void **start, void **end, const char *name) { FILE *maps; - char line[128]; + char *line =3D NULL; + size_t len =3D 0; int found =3D 0; =20 maps =3D fopen("/proc/self/maps", "r"); @@ -11,7 +16,7 @@ static int find_map(void **start, void **end, const char = *name) return -1; } =20 - while (!found && fgets(line, sizeof(line), maps)) { + while (!found && getline(&line, &len, maps) !=3D -1) { int m =3D -1; =20 /* We care only about private r-x mappings. */ @@ -25,6 +30,7 @@ static int find_map(void **start, void **end, const char = *name) found =3D 1; } =20 + free(line); fclose(maps); return !found; } --=20 2.55.0.229.g6434b31f56-goog From nobody Sat Jul 25 00:10:54 2026 Received: from mail-pf1-f198.google.com (mail-pf1-f198.google.com [209.85.210.198]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9DA64443E2F for ; Tue, 21 Jul 2026 23:10:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.198 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675402; cv=none; b=pJQCYYm5koizwoDOcPTyTcNWCHPnuFMDeqalKU8W7mvMNphaG0SiwB1y+0ds2fUGsp4o2eFlHpVVSp64Xu/FmTMrRc7T9hicbYC8peRBoaJuPqzfh6tWZqMAdPH0kTamKEMup4fMdq4nki88F7kq6rAg2Gio0s9yBv2unSi1lrw= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675402; c=relaxed/simple; bh=vMihCiw/8AO+eHNdXnnpwYltDYk9DeshmVHLy+zLYPQ=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=FNxP2c6J+w32226c5ahVTGjyYDkofDIQKzZKrg7GFz0CXZ9d9mEDaxpgfVw7tEs69UbI189nTeJRicS4uic+pO7bVlZLO00javQ68lvOtG7IyePkqUU1usp/AP/T/0bkKtyGLp9i7gqXsvW8vKp/+3k2ZPaD8dg6C+rQtjV5yuk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=q7zs7c8U; arc=none smtp.client-ip=209.85.210.198 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="q7zs7c8U" Received: by mail-pf1-f198.google.com with SMTP id d2e1a72fcca58-8488ac68185so21805320b3a.2 for ; Tue, 21 Jul 2026 16:10:00 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784675400; x=1785280200; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=4XzRy9P2Zj1BiZg4KwUnMx60z08NkGZxv94q78xdiew=; b=q7zs7c8UAH1yXb+DwqWDN0kqUMrUly9RGjiS0D7pCkOqHl8Tbcd2x61OBvKjxBhex4 4p8XMTzsuA4ld8bnYa6XrF0b+lpttcCQGTtjEgykygUwtzSXpohx86kQvL0+vOc5NoCW NhOg2nGiXAmO9hqZvvdYXlZCEDC/fsN8IyBqINF9EOznBO/YpPL50Ldmqf0AAzDPQGft jWCDH5ifokDAFTEXZKUlGqlae2TIapTcQTSN9g2L7xTTUaCm7wjaiWKQ0yJkWwOS59y/ rWrv7a5gOMDWTCUDMswql8Qk0VLuuA217AURMl4CmsuLFOiJdHAB1ueAgEeb7ZjX/hq0 aQ6A== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784675400; x=1785280200; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=4XzRy9P2Zj1BiZg4KwUnMx60z08NkGZxv94q78xdiew=; b=WRh6+QBvVw/FSxiVDmWKBUL7K+8SMb5YFv2a5AnZkbAiQSVAIOZmySZszkj+kDhBLP mCGHGdcBhTOlRgP/Nn0o5591zouaTCZXP0ie0Zae5/FieKhhPlBa+dP/5nnLib/7kF/y a6Y3P800xxgg+r4n6BMzqaQMj2iABfmd9cZWXVkU/H54vqwf/Sbi/bRyPfqBhxWhgHTy zMHjxVKB0rFFDK+ENPRViaQ+hYC2xK/vaGGe9e0TVGUEk0SP3V25SvTxR2e7Wlf2qoNw Pe0bxe3hcKFEiuXfocyARsyHDVZdsRJdIqzEbv1bC1hGpk2TDihQhYWq49fMD37OKvqt 1g+Q== X-Forwarded-Encrypted: i=1; AHgh+RqnR8yUwv2wmPl4Dt+wbSH6byfKhP0sdN+gk5vsTAPnDFLyGD25cnLBQRCvlrDZOmoeGdUyVu8h0mtQPDw=@vger.kernel.org X-Gm-Message-State: AOJu0YwDhg88O71QhT/S/3wOgAXAgeo5NAHdRVJYL99v3Shx3k4coyx9 BdnSp6/HRzm4Q0LY/++4FuNxurgny0S2WpAW07miUwAZDDto7Z7RHDGvpst6+Xi/NlNdrbcCzP2 uG3MGXkKZNA== X-Received: from pfbbn6.prod.google.com ([2002:a05:6a00:3246:b0:84e:46f:f15e]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a00:27a6:b0:848:6b43:35dc with SMTP id d2e1a72fcca58-84c2946f76fmr20435995b3a.35.1784675399730; Tue, 21 Jul 2026 16:09:59 -0700 (PDT) Date: Tue, 21 Jul 2026 16:09:50 -0700 In-Reply-To: <20260721230952.267754-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260721205746.183206-1-irogers@google.com> <20260721230952.267754-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.229.g6434b31f56-goog Message-ID: <20260721230952.267754-3-irogers@google.com> Subject: [PATCH v6 2/4] perf synthetic-events: Fix line synchronization, bounds, and truncation bugs in proc maps reader From: Ian Rogers To: irogers@google.com, acme@kernel.org, namhyung@kernel.org Cc: adrian.hunter@intel.com, james.clark@linaro.org, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, ravi.bangoria@amd.com, swapnil.sapkal@amd.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Fix critical logic and boundary bugs in read_proc_maps_line() and caller. Ensure any mid-line hex/dec/char parsing failure invokes io__drain_line() safely, using a do-while loop to read and discard remaining characters until a newline or EOF is reached. Clamp pathname extraction size to account for trailing sample ID headers, use standard '//toolong' fallback literal for over-length pathnames, emit timeout flags for truncated entries securely via goto out;, and cast event buffer pointers to avoid _FORTIFY_SOURCE array bounds aborts across synthesis handlers. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/util/synthetic-events.c | 204 ++++++++++++++++++++--------- 1 file changed, 142 insertions(+), 62 deletions(-) diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic= -events.c index b75f9dcf4dbf..832b74ffb4db 100644 --- a/tools/perf/util/synthetic-events.c +++ b/tools/perf/util/synthetic-events.c @@ -179,7 +179,8 @@ static int perf_event__prepare_comm(union perf_event *e= vent, pid_t pid, pid_t ti =20 size =3D strlen(event->comm.comm) + 1; size =3D PERF_ALIGN(size, sizeof(u64)); - memset(event->comm.comm + size, 0, machine->id_hdr_size); + memset((char *)event + offsetof(struct perf_record_comm, comm) + size, + 0, machine->id_hdr_size); event->comm.header.size =3D (sizeof(event->comm) - (sizeof(event->comm.comm) - size) + machine->id_hdr_size); @@ -291,6 +292,18 @@ static int perf_event__synthesize_fork(const struct pe= rf_tool *tool, return 0; } =20 +static void io__drain_line(struct io *io, int ch) +{ + if (ch =3D=3D '\n') + return; + if (ch =3D=3D -2 && io->data > io->buf && io->data[-1] =3D=3D '\n') + return; + + do { + ch =3D io__get_char(io); + } while (ch >=3D 0 && ch !=3D '\n'); +} + static bool read_proc_maps_line(struct io *io, __u64 *start, __u64 *end, u32 *prot, u32 *flags, __u64 *offset, u32 *maj, u32 *min, @@ -299,69 +312,127 @@ static bool read_proc_maps_line(struct io *io, __u64= *start, __u64 *end, { __u64 temp; int ch; - char *start_pathname =3D pathname; + size_t written =3D 0; + bool overflowed =3D false; =20 - if (io__get_hex(io, start) !=3D '-') + ch =3D io__get_hex(io, start); + if (ch !=3D '-') { + if (!io->eof) + io__drain_line(io, ch); return false; - if (io__get_hex(io, end) !=3D ' ') + } + ch =3D io__get_hex(io, end); + if (ch !=3D ' ') { + if (!io->eof) + io__drain_line(io, ch); return false; + } =20 /* map protection and flags bits */ *prot =3D 0; ch =3D io__get_char(io); if (ch =3D=3D 'r') *prot |=3D PROT_READ; - else if (ch !=3D '-') + else if (ch !=3D '-') { + if (!io->eof) + io__drain_line(io, ch); return false; + } ch =3D io__get_char(io); if (ch =3D=3D 'w') *prot |=3D PROT_WRITE; - else if (ch !=3D '-') + else if (ch !=3D '-') { + if (!io->eof) + io__drain_line(io, ch); return false; + } ch =3D io__get_char(io); if (ch =3D=3D 'x') *prot |=3D PROT_EXEC; - else if (ch !=3D '-') + else if (ch !=3D '-') { + if (!io->eof) + io__drain_line(io, ch); return false; + } ch =3D io__get_char(io); if (ch =3D=3D 's') *flags =3D MAP_SHARED; else if (ch =3D=3D 'p') *flags =3D MAP_PRIVATE; - else + else { + if (!io->eof) + io__drain_line(io, ch); return false; - if (io__get_char(io) !=3D ' ') + } + ch =3D io__get_char(io); + if (ch !=3D ' ') { + if (!io->eof) + io__drain_line(io, ch); return false; + } =20 - if (io__get_hex(io, offset) !=3D ' ') + ch =3D io__get_hex(io, offset); + if (ch !=3D ' ') { + if (!io->eof) + io__drain_line(io, ch); return false; + } =20 - if (io__get_hex(io, &temp) !=3D ':') + ch =3D io__get_hex(io, &temp); + if (ch !=3D ':') { + if (!io->eof) + io__drain_line(io, ch); return false; + } *maj =3D temp; - if (io__get_hex(io, &temp) !=3D ' ') + ch =3D io__get_hex(io, &temp); + if (ch !=3D ' ') { + if (!io->eof) + io__drain_line(io, ch); return false; + } *min =3D temp; =20 ch =3D io__get_dec(io, inode); if (ch !=3D ' ') { - *pathname =3D '\0'; - return ch =3D=3D '\n'; + if (ch =3D=3D '\n') { + pathname[0] =3D '\0'; + return true; + } + if (!io->eof) + io__drain_line(io, ch); + return false; } + do { ch =3D io__get_char(io); } while (ch =3D=3D ' '); + while (true) { - if (ch < 0) - return false; - if (ch =3D=3D '\0' || ch =3D=3D '\n' || - (pathname + 1 - start_pathname) >=3D pathname_size) { - *pathname =3D '\0'; - return true; + if (ch < 0) { + if (overflowed) { + strlcpy(pathname, "//toolong", pathname_size); + return true; + } + pathname[written] =3D '\0'; + return written > 0; } - *pathname++ =3D ch; + if (ch =3D=3D '\0' || ch =3D=3D '\n') + break; + + if (written < (size_t)pathname_size - 1) + pathname[written++] =3D (char)ch; + else + overflowed =3D true; ch =3D io__get_char(io); } + + if (overflowed) + strlcpy(pathname, "//toolong", pathname_size); + else + pathname[written] =3D '\0'; + + return true; } =20 static void perf_record_mmap2__read_build_id(struct perf_record_mmap2 *eve= nt, @@ -463,45 +534,53 @@ int perf_event__synthesize_mmap_events(const struct p= erf_tool *tool, while (!io.eof) { static const char anonstr[] =3D "//anon"; size_t size, aligned_size; - - /* ensure null termination since stack will be reused. */ - event->mmap2.filename[0] =3D '\0'; + __u64 start, end, pgoff, ino; + u32 prot, flags, maj, min; =20 /* 00400000-0040c000 r-xp 00000000 fd:01 41038 /bin/cat */ - if (!read_proc_maps_line(&io, - &event->mmap2.start, - &event->mmap2.len, - &event->mmap2.prot, - &event->mmap2.flags, - &event->mmap2.pgoff, - &event->mmap2.maj, - &event->mmap2.min, - &event->mmap2.ino, - sizeof(event->mmap2.filename), - event->mmap2.filename)) + /* Read directly into event->mmap2.filename, clamping for id_hdr_size! */ + if (!read_proc_maps_line(&io, &start, &end, + &prot, &flags, &pgoff, + &maj, &min, &ino, + sizeof(event->mmap2.filename) - machine->id_hdr_size, + event->mmap2.filename)) { + if (io.eof) + break; continue; + } =20 - if ((rdclock() - t) > timeout) { - pr_warning("Reading %s/proc/%d/task/%d/maps time out. " - "You may want to increase " - "the time limit by --proc-map-timeout\n", - machine->root_dir, pid, pid); - truncation =3D true; - goto out; + if (!strcmp(event->mmap2.filename, "")) + strcpy(event->mmap2.filename, anonstr); + + if (hugetlbfs_mnt_len && + !strncmp(event->mmap2.filename, hugetlbfs_mnt, hugetlbfs_mnt_len)) { + strcpy(event->mmap2.filename, anonstr); + flags |=3D MAP_HUGETLB; } =20 - event->mmap2.ino_generation =3D 0; + size =3D strlen(event->mmap2.filename) + 1; + aligned_size =3D PERF_ALIGN(size, sizeof(u64)); + + event->mmap2.header.type =3D PERF_RECORD_MMAP2; =20 /* - * Just like the kernel, see __perf_event_mmap in kernel/perf_event.c + * Just like the kernel, see perf_misc_flags() in + * kernel/events/core.c */ if (machine__is_host(machine)) event->header.misc =3D PERF_RECORD_MISC_USER; else event->header.misc =3D PERF_RECORD_MISC_GUEST_USER; =20 - if ((event->mmap2.prot & PROT_EXEC) =3D=3D 0) { - if (!mmap_data || (event->mmap2.prot & PROT_READ) =3D=3D 0) + if ((rdclock() - t) > timeout) { + pr_warning("Reading %s/proc/%d/task/%d/maps time out. You may want to i= ncrease the time limit by --proc-map-timeout\n", + machine->root_dir, pid, pid); + truncation =3D true; + goto out; + } + + if ((prot & PROT_EXEC) =3D=3D 0) { + if (!mmap_data || (prot & PROT_READ) =3D=3D 0) continue; =20 event->header.misc |=3D PERF_RECORD_MISC_MMAP_DATA; @@ -511,26 +590,26 @@ int perf_event__synthesize_mmap_events(const struct p= erf_tool *tool, if (truncation) event->header.misc |=3D PERF_RECORD_MISC_PROC_MAP_PARSE_TIMEOUT; =20 - if (!strcmp(event->mmap2.filename, "")) - strcpy(event->mmap2.filename, anonstr); + event->mmap2.header.size =3D + offsetof(struct perf_record_mmap2, filename) + + aligned_size; =20 - if (hugetlbfs_mnt_len && - !strncmp(event->mmap2.filename, hugetlbfs_mnt, - hugetlbfs_mnt_len)) { - strcpy(event->mmap2.filename, anonstr); - event->mmap2.flags |=3D MAP_HUGETLB; - } + /* Zero the padding and ID header trailer safely! */ + memset((char *)event + offsetof(struct perf_record_mmap2, filename) + si= ze, 0, + (aligned_size - size) + machine->id_hdr_size); =20 - size =3D strlen(event->mmap2.filename) + 1; - aligned_size =3D PERF_ALIGN(size, sizeof(u64)); - event->mmap2.len -=3D event->mmap.start; - event->mmap2.header.size =3D (sizeof(event->mmap2) - - (sizeof(event->mmap2.filename) - aligned_size)); - memset(event->mmap2.filename + size, 0, machine->id_hdr_size + - (aligned_size - size)); event->mmap2.header.size +=3D machine->id_hdr_size; + event->mmap2.start =3D start; + event->mmap2.len =3D end - start; + event->mmap2.pgoff =3D pgoff; + event->mmap2.maj =3D maj; + event->mmap2.min =3D min; + event->mmap2.ino =3D ino; + event->mmap2.ino_generation =3D 0; event->mmap2.pid =3D tgid; event->mmap2.tid =3D pid; + event->mmap2.prot =3D prot; + event->mmap2.flags =3D flags; =20 if (!symbol_conf.no_buildid_mmap2) perf_record_mmap2__read_build_id(&event->mmap2, machine, false); @@ -579,7 +658,8 @@ static int perf_event__synthesize_cgroup(const struct p= erf_tool *tool, =20 event->cgroup.id =3D handle.cgroup_id; strncpy(event->cgroup.path, path + mount_len, path_len); - memset(event->cgroup.path + path_len, 0, machine->id_hdr_size); + memset((char *)event + offsetof(struct perf_record_cgroup, path) + path_l= en, + 0, machine->id_hdr_size); =20 if (perf_tool__process_synth_event(tool, event, machine, process) < 0) { pr_debug("process synth event failed\n"); --=20 2.55.0.229.g6434b31f56-goog From nobody Sat Jul 25 00:10:54 2026 Received: from mail-pl1-f199.google.com (mail-pl1-f199.google.com [209.85.214.199]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8FAB73AEF58 for ; Tue, 21 Jul 2026 23:10:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.199 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675404; cv=none; b=XjBxMUJFULvHSJn5CR6e54gmM63ge6OPEdDG13O1Gk0HFNt+OS2iClpF61Iz6JicbI8ccxK0JjFWXrN+m+VZP4x4yP2LePQRhoSIzsdM3T9X2xjLmpUZFPauiHb34zgjqVNNwMq5iwEbw+ylWBUpSX8vhv/FVu4hnOt0kBtcP1E= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675404; c=relaxed/simple; bh=tf8a7E3zLZPXOo8wdboL07PVGKzbNs86Kz6VLzQ5/MM=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=N68Z3Emc+ZvsIygivPkO7HpYdsBWtgMrA8Q03/uXIlfimIMpeDCxsbrlROJL9Tk9IB/H9Q9ndzLEn+/eULlqOcBBKXjOIy3xjMUNZiw8IhXai+HWJ1kECBVFGjv34cdmLZzW/L0wviMOZmIDudeT4pA+EnpxMHbTebZR7uZUOCg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=mD5c94lN; arc=none smtp.client-ip=209.85.214.199 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="mD5c94lN" Received: by mail-pl1-f199.google.com with SMTP id d9443c01a7336-2cce870a060so204889845ad.2 for ; Tue, 21 Jul 2026 16:10:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784675402; x=1785280202; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=nCcmiUW+ScGTENgJGOrWJXCdaGzQrQOCf0avkLvcTWM=; b=mD5c94lNj6VdqupV/SPPHPqtxF0Pk0DgLM0YZCzvT6bZhJbjo5zdF2nYkGpy0+lM76 uDTytnVnG0q0YThevAdzDLq26vzZ6/NFzPb7Guoce3eB3l4bQ1dQgyDrDXE4SuGdYqVV EAh3gjfDRtEzF/89n5Mi3f8uoLcOH/wC46OcJLWf3/+JpT2bCrcLA7+WthvHIqQwwztu s3wcsbqRGY+M3gmTEKvaaNiCJdyaRUsBx+bQyqFKmfHTIJUmGU1+AxBK72T2bk8ajABu W7vxXdkwccLL8a669KLtiXQL1WhvqqJiR8GAJpNhVZ8VcyuHlT1ojJJbTdg93VlIZaiA oyug== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784675402; x=1785280202; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=nCcmiUW+ScGTENgJGOrWJXCdaGzQrQOCf0avkLvcTWM=; b=k47Cg4Sn8+SFA+884+aJ62vJB629/HACOjU2sbKH5Dr+6GhlWFJrFtZMG2uU+2HtHC 911pmcLe9eRZ2yE1/yP/WW8Slqo1PGvMwOOSTlRWrzwXcBTxPYaoTngCAkXvlhPbFlU+ Urs7QB/wLmAuHtURCz6upqOPRqdwIpby8OrVW6SzrzE233JZoO1m+3Xqns20GxW3LInj IVPq66gug3cbQzDLJ5/B+REpRDqEyTMIeSq9xQksx2oE6kiUlc7LWlpjrir3l4amt1WQ 8GBk/Hc1Lpk2q7sXHiQyAbZ/uzGFgGO1csMFhdcUkh3q9nCjjrvNwwgqrK1O3mIWUh9C BDtg== X-Forwarded-Encrypted: i=1; AHgh+RowQ+ngLz722mXjw1w+46Fvl8d1qT9SIY318QB5WQfyECar9sAkJqG+aqrCSRTtkdC2qaTC5aJZMR0SBZE=@vger.kernel.org X-Gm-Message-State: AOJu0Yw+FBAXEMbIrx9BpDDDLtzy99uBayXZAOGiISahb6nJDLIqE63/ W6bQYop2pr+yyLuMWkpB9Bzf3mlEogoXged5qLFNOxyhjJcfecYVvjIcvzK6mykGoVYMZGqgSjC AmIX1YV3Dxg== X-Received: from dygg9.prod.google.com ([2002:a05:693c:80c9:b0:313:d984:da01]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a20:6a0a:b0:3b4:7d99:a23f with SMTP id adf61e73a8af0-3c3ad8b3abbmr24843081637.45.1784675401631; Tue, 21 Jul 2026 16:10:01 -0700 (PDT) Date: Tue, 21 Jul 2026 16:09:51 -0700 In-Reply-To: <20260721230952.267754-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260721205746.183206-1-irogers@google.com> <20260721230952.267754-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.229.g6434b31f56-goog Message-ID: <20260721230952.267754-4-irogers@google.com> Subject: [PATCH v6 3/4] perf synthetic-events: Fix bounds, stale state, and misc flags in kernel module synthesis From: Ian Rogers To: irogers@google.com, acme@kernel.org, namhyung@kernel.org Cc: adrian.hunter@intel.com, james.clark@linaro.org, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, ravi.bangoria@amd.com, swapnil.sapkal@amd.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Clamp long DSO names to mmap/mmap2 filename boundaries accounting for sample ID headers to prevent buffer overruns in perf_event__synthesize_modules_maps_cb(). Explicitly clear misc flags and union padding to prevent stale Build-ID state from leaking between module synthesis events, and cast event buffer pointers to avoid _FORTIFY_SOURCE array bounds aborts when zeroing padding trailers. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/util/synthetic-events.c | 70 +++++++++++++++++++++--------- 1 file changed, 50 insertions(+), 20 deletions(-) diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic= -events.c index 832b74ffb4db..4043d17a6140 100644 --- a/tools/perf/util/synthetic-events.c +++ b/tools/perf/util/synthetic-events.c @@ -757,6 +757,7 @@ struct perf_event__synthesize_modules_maps_cb_args { perf_event__handler_t process; struct machine *machine; union perf_event *event; + u16 misc; }; =20 static int perf_event__synthesize_modules_maps_cb(struct map *map, void *d= ata) @@ -764,49 +765,78 @@ static int perf_event__synthesize_modules_maps_cb(str= uct map *map, void *data) struct perf_event__synthesize_modules_maps_cb_args *args =3D data; union perf_event *event =3D args->event; struct dso *dso; - size_t size; + size_t size, aligned_size; + int rc =3D 0; =20 if (!__map__is_kmodule(map)) return 0; =20 dso =3D map__dso(map); if (!symbol_conf.no_buildid_mmap2) { - size =3D PERF_ALIGN(dso__long_name_len(dso) + 1, sizeof(u64)); + const char *long_name =3D dso__long_name(dso); + + size =3D strlen(long_name); + if (size >=3D sizeof(event->mmap2.filename) - args->machine->id_hdr_size) + size =3D sizeof(event->mmap2.filename) - args->machine->id_hdr_size - 1; + + strlcpy(event->mmap2.filename, long_name, + sizeof(event->mmap2.filename) - args->machine->id_hdr_size); + + aligned_size =3D PERF_ALIGN(size + 1, sizeof(u64)); event->mmap2.header.type =3D PERF_RECORD_MMAP2; - event->mmap2.header.size =3D (sizeof(event->mmap2) - - (sizeof(event->mmap2.filename) - size)); - memset(event->mmap2.filename + size, 0, args->machine->id_hdr_size); + event->mmap2.header.misc =3D args->misc; + event->mmap2.header.size =3D + offsetof(struct perf_record_mmap2, filename) + + aligned_size; + + /* Zero the padding and ID header trailer safely! */ + memset((char *)event + offsetof(struct perf_record_mmap2, filename) + si= ze, 0, + (aligned_size - size) + args->machine->id_hdr_size); + event->mmap2.header.size +=3D args->machine->id_hdr_size; event->mmap2.start =3D map__start(map); event->mmap2.len =3D map__size(map); event->mmap2.pid =3D args->machine->pid; =20 - memcpy(event->mmap2.filename, dso__long_name(dso), dso__long_name_len(ds= o) + 1); - - /* Clear stale build ID from previous module iteration */ + /* Clear stale build ID and entire union from previous module iteration = */ event->mmap2.header.misc &=3D ~PERF_RECORD_MISC_MMAP_BUILD_ID; memset(event->mmap2.build_id, 0, sizeof(event->mmap2.build_id)); event->mmap2.build_id_size =3D 0; + event->mmap2.__reserved_1 =3D 0; + event->mmap2.__reserved_2 =3D 0; =20 perf_record_mmap2__read_build_id(&event->mmap2, args->machine, false); } else { - size =3D PERF_ALIGN(dso__long_name_len(dso) + 1, sizeof(u64)); + const char *long_name =3D dso__long_name(dso); + + size =3D strlen(long_name); + if (size >=3D sizeof(event->mmap.filename) - args->machine->id_hdr_size) + size =3D sizeof(event->mmap.filename) - args->machine->id_hdr_size - 1; + + strlcpy(event->mmap.filename, long_name, + sizeof(event->mmap.filename) - args->machine->id_hdr_size); + + aligned_size =3D PERF_ALIGN(size + 1, sizeof(u64)); event->mmap.header.type =3D PERF_RECORD_MMAP; - event->mmap.header.size =3D (sizeof(event->mmap) - - (sizeof(event->mmap.filename) - size)); - memset(event->mmap.filename + size, 0, args->machine->id_hdr_size); + event->mmap.header.misc =3D args->misc; + event->mmap.header.size =3D + offsetof(struct perf_record_mmap, filename) + + aligned_size; + + /* Zero the padding and ID header trailer safely! */ + memset((char *)event + offsetof(struct perf_record_mmap, filename) + siz= e, 0, + (aligned_size - size) + args->machine->id_hdr_size); + event->mmap.header.size +=3D args->machine->id_hdr_size; event->mmap.start =3D map__start(map); event->mmap.len =3D map__size(map); event->mmap.pid =3D args->machine->pid; - - memcpy(event->mmap.filename, dso__long_name(dso), dso__long_name_len(dso= ) + 1); } =20 if (perf_tool__process_synth_event(args->tool, event, args->machine, args= ->process) !=3D 0) - return -1; + rc =3D -1; =20 - return 0; + return rc; } =20 int perf_event__synthesize_modules(const struct perf_tool *tool, perf_even= t__handler_t process, @@ -831,13 +861,13 @@ int perf_event__synthesize_modules(const struct perf_= tool *tool, perf_event__han } =20 /* - * kernel uses 0 for user space maps, see kernel/perf_event.c - * __perf_event_mmap + * Just like the kernel, see perf_misc_flags() in + * kernel/events/core.c */ if (machine__is_host(machine)) - args.event->header.misc =3D PERF_RECORD_MISC_KERNEL; + args.misc =3D PERF_RECORD_MISC_KERNEL; else - args.event->header.misc =3D PERF_RECORD_MISC_GUEST_KERNEL; + args.misc =3D PERF_RECORD_MISC_GUEST_KERNEL; =20 rc =3D maps__for_each_map(maps, perf_event__synthesize_modules_maps_cb, &= args); =20 --=20 2.55.0.229.g6434b31f56-goog From nobody Sat Jul 25 00:10:54 2026 Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 01C724499BC for ; Tue, 21 Jul 2026 23:10:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.197 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675407; cv=none; b=YHlPva1zbFrHj43irT9kLCeyhtH5ABHi4M2UJulr+Q/UJcx1GZad6/Yb4P6H1eyZxG+jMJhYFYJu9lsGBFhS1waouGue85uUcvVp9aMUwKRFuTdG8CFTUjoML9wccnvTBmth+4cjQxfO+JXTBsy3rD3gfzVI5Nt6KhnqkzdInn4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675407; c=relaxed/simple; bh=Rhr9/VWiAOU2ysPViZ6y1/ZtZdHQlWxwu4lXWxiMujo=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=VwICCiL30BNYRt9TCPJbT+dljmDDcyd6vpagJd3NHgK1x0+IaQW22YogrD4Jr3HslKpbVklXjy+Ie7ZGK6QEaSMYRfTG9XsI7oyhNHSxtAP7Z2Z3taMcGdX81KsE+LnxPp4dcceuHbIcEI/0ELio9ay/r73TxPEZ5KHHhx69kEE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=CxnRqwZ4; arc=none smtp.client-ip=209.85.215.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="CxnRqwZ4" Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cb5cc1e139bso2793358a12.3 for ; Tue, 21 Jul 2026 16:10:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784675404; x=1785280204; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=WPc/SptN9OuaHPCuk46SdIx0RLVLfa1pOthKWdfhXgQ=; b=CxnRqwZ4PirDimVTmQYtDk/aQQhhmhAwPB/CL/E0lDnVmGypfOJrlyX8Gq6QySsQh+ vNZGpVyxh1QEezi0308Ytc8hTRZXTZ0J6UJmEIiv1F8jmRAkC3xmfYMsnRt1IFvlaRnc yMhT3td1bOlYNQih9qCDjjquIEyIZxJ8P6oenhP5d/l7k5tQyXyFrslWgeE3Nm+FjpKc DmmmFLZRx8jAdtELvoppKvw/6OaO8WZ5Sy7LwbqjgnqD7CfFbe39UCOaGi4tQV9WJBrO TiBO57da9gs6RoGXSw7NBegAarJgzNop5j70WV5RZo3DV5Chq0a2oE8x+REt+36JnsQG Nkvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784675404; x=1785280204; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WPc/SptN9OuaHPCuk46SdIx0RLVLfa1pOthKWdfhXgQ=; b=CDnWCW/WrRMOJ43ZDzuLT5AbDeyZBKZTVLCwC9JKpV3JsXlYxwceuhBeWQKbhMaLi2 Hm/XTt2nlTWZAsDNPy5HoIxNzOlsk+vY5AuXuBf8LcB58PBzXgdF8Y6w6r8Aic5PUaTi iSZMypIzZOwmt2vjwFMH1nYCkFXvOHTqpgXXnNIaTRmVXxCDF8ynOV655EK3ev+2f33r LKcvqn9sLMQkZeXgR2NfusnHDRdRwcTGF773LUqeDjRApO1GXrPwuAMDSRy45eaa0/QL 45lKbqskrBTkguBwR8ycYlZFTnm7qsgSGWD6JooffumoHvg7uqcucPNfz7H8dz4VQ5cV lN3A== X-Forwarded-Encrypted: i=1; AHgh+RoHmNlb2B9oIdRAr0IjpUqrgaZFIoWCU4CFl1oVBjrJsbQsA0HVEO668X5Eia3rZH+IHYYKJQ2M/t269Qc=@vger.kernel.org X-Gm-Message-State: AOJu0YxFGUMWmxETEI3f4VVBEtNswTDG/7aH/EXmy+qaCWvm+BvqYi2B zhm4+sYbafp8xoep5LPzh7gfi7XuC6DXfSb6WSOVQQXnrcGaK5MrV7NvRjC5Wkkphlqj7WipSqg V3lLHeH8QNQ== X-Received: from dldyq18-n1.prod.google.com ([2002:a05:701b:4552:10b0:13b:a0a0:3b98]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:7a96:b0:3c3:7cfe:b337 with SMTP id adf61e73a8af0-3c3ad7ad9e3mr18429814637.30.1784675403821; Tue, 21 Jul 2026 16:10:03 -0700 (PDT) Date: Tue, 21 Jul 2026 16:09:52 -0700 In-Reply-To: <20260721230952.267754-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260721205746.183206-1-irogers@google.com> <20260721230952.267754-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.229.g6434b31f56-goog Message-ID: <20260721230952.267754-5-irogers@google.com> Subject: [PATCH v6 4/4] perf synthetic-events: Fix bounds and union member access in mmap2 build_id synthesis From: Ian Rogers To: irogers@google.com, acme@kernel.org, namhyung@kernel.org Cc: adrian.hunter@intel.com, james.clark@linaro.org, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, ravi.bangoria@amd.com, swapnil.sapkal@amd.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Modify bounds and union member access in mmap2 build_id synthesis. Bound max_filename_len against the minimum of filename array capacity and the outer union stack layout minus sample ID trailers. This prevents both -E2BIG overruns and _FORTIFY_SOURCE array bounds aborts on strlcpy even if the enclosing union expands. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/util/synthetic-events.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic= -events.c index 4043d17a6140..704760e1dd5d 100644 --- a/tools/perf/util/synthetic-events.c +++ b/tools/perf/util/synthetic-events.c @@ -2450,13 +2450,18 @@ int perf_event__synthesize_mmap2_build_id(const str= uct perf_tool *tool, size_t filename_len =3D strlen(filename); size_t ev_len; u64 sample_type =3D sample->evsel ? sample->evsel->core.attr.sample_type = : 0; - void *array; + void *array =3D &ev; int ret; + size_t max_filename_len; =20 - if (filename_len >=3D sizeof(ev.mmap2.filename)) - return -EINVAL; + max_filename_len =3D min(sizeof(ev.mmap2.filename) - 1, + sizeof(ev) - (MAX_ID_HDR_ENTRIES * sizeof(__u64)) - + offsetof(struct perf_record_mmap2, filename) - 1); =20 - ev_len =3D sizeof(ev.mmap2) - sizeof(ev.mmap2.filename) + filename_len + = 1; + if (filename_len > max_filename_len) + filename_len =3D max_filename_len; + + ev_len =3D offsetof(struct perf_record_mmap2, filename) + filename_len + = 1; ev_len =3D PERF_ALIGN(ev_len, sizeof(u64)); =20 if (ev_len + MAX_ID_HDR_ENTRIES * sizeof(__u64) > sizeof(ev)) @@ -2476,16 +2481,15 @@ int perf_event__synthesize_mmap2_build_id(const str= uct perf_tool *tool, =20 ev.mmap2.build_id_size =3D bid->size; if (ev.mmap2.build_id_size > sizeof(ev.mmap2.build_id)) - ev.build_id.size =3D sizeof(ev.mmap2.build_id); + ev.mmap2.build_id_size =3D sizeof(ev.mmap2.build_id); memcpy(ev.mmap2.build_id, bid->data, ev.mmap2.build_id_size); =20 ev.mmap2.prot =3D prot; ev.mmap2.flags =3D flags; =20 - memcpy(ev.mmap2.filename, filename, min(strlen(filename), sizeof(ev.mmap.= filename))); + strlcpy(ev.mmap2.filename, filename, filename_len + 1); =20 - array =3D &ev; - array +=3D ev.header.size; + array =3D (void *)((char *)&ev + ev.header.size); ret =3D perf_event__synthesize_id_sample(array, sample_type, sample); if (ret < 0) return ret; --=20 2.55.0.229.g6434b31f56-goog