It turns out that PATH_MAX is respected by system calls but isn't
respected by file paths in /proc/pid/maps and /proc/pid/smaps. In the
kernel "//toolong" is placed in the filename of mmap/mmap2 events
where the filename is longer than PATH_MAX, do the same in the
mmap/mmap2 synthesis code to avoid overrunning the event buffer -
note, the filename buffer is bounds checked but this makes the
synthesis more similar to the kernel approach. With Gemini's help try
to address other correctness and overrun issues.

V7 addresses security review feedback:
- Adds a standalone patch (Patch 3/5) to fix a pre-existing stack
  buffer overflow in perf_event__synthesize_cgroup(). Eliminates
  in-place null padding mutation of the path stack buffer, calculates
  aligned path_len using PERF_ALIGN, clamps raw_path_len to account
  for machine->id_hdr_size, and uses strlcpy with combined memset for
  alignment and sample ID header padding.

V6 addresses review feedback:
- Ensures Patch 2 leaves module synthesis callbacks completely
  untouched, preserving the pre-existing build ID clearing logic in
  baseline.
- Patch 4 explicitly clears PERF_RECORD_MISC_MMAP_BUILD_ID, build_id, and
  reserved union padding members in module synthesis callbacks to guarantee
  no stale Build-ID state leaks between module synthesis iterations.

V5 addresses technical review feedback:
- Clamps pathname buffer sizes in read_proc_maps_line() and module
  synthesis callbacks by subtracting machine->id_hdr_size.
- Casts member array memset destination pointers to
  (char *)event + offsetof(...) across all synthesis handlers.
- Restricts max_filename_len in perf_event__synthesize_mmap2_build_id()
  to the minimum of filename array capacity and union payload space.

V4 addresses review feedback:
- Ensures io__drain_line()'s do-while loop is committed directly in
  Patch 2.

V3 addresses review feedback:
- Updates io__drain_line() loop condition from a while loop to a
  do-while loop.

V2 addresses community review feedback:
- Corrects read_proc_maps_line() and io__drain_line() to safely handle
  already consumed newlines.
- Restores early exit block for timeouts so TIMEOUT flag is emitted
  to tools.
- Removes unused assignment to avoid promoting warnings to build errors.

Ian Rogers (5):
  perf find-map: Remove PATH_MAX 128-byte stack array restriction
  perf synthetic-events: Fix line synchronization, bounds, and
    truncation bugs in proc maps reader
  perf synthetic-events: Fix stack buffer overflow and bounds in cgroup
    synthesis
  perf synthetic-events: Fix bounds, stale state, and misc flags in
    kernel module synthesis
  perf synthetic-events: Fix bounds and union member access in mmap2
    build_id synthesis

 tools/perf/util/find-map.c         |  10 +-
 tools/perf/util/synthetic-events.c | 309 ++++++++++++++++++++---------
 2 files changed, 223 insertions(+), 96 deletions(-)

-- 
2.55.0.229.g6434b31f56-goog

On Tue, Jul 21, 2026 at 4:52 PM Ian Rogers <irogers@google.com> wrote:
>
> It turns out that PATH_MAX is respected by system calls but isn't
> respected by file paths in /proc/pid/maps and /proc/pid/smaps. In the
> kernel "//toolong" is placed in the filename of mmap/mmap2 events
> where the filename is longer than PATH_MAX, do the same in the
> mmap/mmap2 synthesis code to avoid overrunning the event buffer -
> note, the filename buffer is bounds checked but this makes the
> synthesis more similar to the kernel approach. With Gemini's help try
> to address other correctness and overrun issues.
>
> V7 addresses security review feedback:
> - Adds a standalone patch (Patch 3/5) to fix a pre-existing stack
>   buffer overflow in perf_event__synthesize_cgroup(). Eliminates
>   in-place null padding mutation of the path stack buffer, calculates
>   aligned path_len using PERF_ALIGN, clamps raw_path_len to account
>   for machine->id_hdr_size, and uses strlcpy with combined memset for
>   alignment and sample ID header padding.
>
> V6 addresses review feedback:
> - Ensures Patch 2 leaves module synthesis callbacks completely
>   untouched, preserving the pre-existing build ID clearing logic in
>   baseline.
> - Patch 4 explicitly clears PERF_RECORD_MISC_MMAP_BUILD_ID, build_id, and
>   reserved union padding members in module synthesis callbacks to guarantee
>   no stale Build-ID state leaks between module synthesis iterations.
>
> V5 addresses technical review feedback:
> - Clamps pathname buffer sizes in read_proc_maps_line() and module
>   synthesis callbacks by subtracting machine->id_hdr_size.
> - Casts member array memset destination pointers to
>   (char *)event + offsetof(...) across all synthesis handlers.
> - Restricts max_filename_len in perf_event__synthesize_mmap2_build_id()
>   to the minimum of filename array capacity and union payload space.
>
> V4 addresses review feedback:
> - Ensures io__drain_line()'s do-while loop is committed directly in
>   Patch 2.
>
> V3 addresses review feedback:
> - Updates io__drain_line() loop condition from a while loop to a
>   do-while loop.
>
> V2 addresses community review feedback:
> - Corrects read_proc_maps_line() and io__drain_line() to safely handle
>   already consumed newlines.
> - Restores early exit block for timeouts so TIMEOUT flag is emitted
>   to tools.
> - Removes unused assignment to avoid promoting warnings to build errors.
>
> Ian Rogers (5):
>   perf find-map: Remove PATH_MAX 128-byte stack array restriction
>   perf synthetic-events: Fix line synchronization, bounds, and
>     truncation bugs in proc maps reader
>   perf synthetic-events: Fix stack buffer overflow and bounds in cgroup
>     synthesis
>   perf synthetic-events: Fix bounds, stale state, and misc flags in
>     kernel module synthesis
>   perf synthetic-events: Fix bounds and union member access in mmap2
>     build_id synthesis

So while Sashiko is reporting yet more pre-existing issues, I'm going
to stop here. The changes in these patches have no issues:
https://sashiko.dev/#/patchset/20260721235254.294053-1-irogers%40google.com

Thanks,
Ian

>  tools/perf/util/find-map.c         |  10 +-
>  tools/perf/util/synthetic-events.c | 309 ++++++++++++++++++++---------
>  2 files changed, 223 insertions(+), 96 deletions(-)
>
> --
> 2.55.0.229.g6434b31f56-goog
>