From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C21182475CF; Thu, 6 Aug 2026 12:36:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019779; cv=none; b=OySmwgDMgcV5BiIzee020WbvkOP4221HQuWISnwxSnuqrAW28Ti6hFEV5kEJuAfO9QM6/SHaLjVPhoWywE0uIChm8Yw822gfWH0Bquc8aHIaEbZWRfXfQp32vXuNHGrMI6cqM7rsguEOtBorhbEVEeBKDOel0jZqtrOeHzLxHXQ= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019779; c=relaxed/simple; bh=p1S8g7m1+MhoK7RRb87ukE8btgQpT7Hp/ZdsQZAHicE=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=dc0T7pVpqx9QI1Tct9xR6EGWmwkggGc/uiR6p74jUmmhYjrM/Y6xBb3z/7HmYc4keZEo/lcAs9GZ7WI4kpvZpYB2wKayVvb+L2SFDfUqA0IjGPaJbWCrsClZnJ+4UvkuosSNw2e2FjUWvf4w5TnS7T6JBbeqPY440nDNBS0DSwg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SwOOQlFi; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SwOOQlFi" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 5DA221F00A3A; Thu, 6 Aug 2026 12:36:14 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019778; bh=L+XgG3zRC2xuZyKC3GoSym/L/+7SSWd9pP/277f7PNg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=SwOOQlFiq6hUMvs0mSpVFMkI21Rzb4UWbDEFR+HWKgL4+hFaNZ4hV3lgUGxOzHmdn WensEXjPOdlSsceK+KZrzAElQwF0eDfIfn7hD9ldCWzBeo8hU8ypSAi2uteFme/rog rN7ivfsfi2hh6APGtY07xT+54qZFawJmZTpK2nqlP7de763/lwieDUAYNoisJxQ7LF tKkABb1wee7JDy2bXvFv2AJAOm/PXz3TX91TURco6XB3iI/AtkkKIybJVU5X8xNAJA zwJz7F3n4IivRnAiatvf1OU155x+nQRjIrWQdXE4pJkXrw5g5FMli4M6RrhjJji4hs LRqCXad0YZYaw== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 01/12] perf jitdump: Fix extended header read that always fails Date: Thu, 6 Aug 2026 09:35:52 -0300 Message-ID: <20260806123604.271277-2-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_open() sets bsz =3D bs before the fread() that uses bs - bsz as the read size, making the expression always evaluate to zero. fread() with size 0 returns 0, which triggers the ret !=3D 1 error path =E2=80=94 so ext= ended jitdump headers (total_size > sizeof(header)) have been silently broken since the original implementation. Additionally, when 0 < bs <=3D bsz the if (bs > bsz) block is skipped entirely, leaving extended header bytes unread in the stream. Subsequent jit_get_next_entry() calls then parse those leftover bytes as a jr_prefix, corrupting the record stream. Fix by separating the buffer growth from the read: realloc only when bs > bsz, then unconditionally fread bs bytes when bs > 0. Fixes: 9b07e27f88b9cd78 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Cc: Stephane Eranian Cc: Ian Rogers Cc: Namhyung Kim Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 83005b30b9bf3fd7..4b7c7ba7cd95ddbb 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -224,10 +224,12 @@ jit_open(struct jit_buf_desc *jd, const char *name) n =3D realloc(buf, bs); if (!n) goto error; - bsz =3D bs; buf =3D n; - /* read extra we do not know about */ - ret =3D fread(buf, bs - bsz, 1, jd->in); + bsz =3D bs; + } + if (bs > 0) { + /* consume extended header bytes from the stream */ + ret =3D fread(buf, bs, 1, jd->in); if (ret !=3D 1) goto error; } --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id EC07E2475CF; Thu, 6 Aug 2026 12:36:23 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019785; cv=none; b=BAqK1wpBlWxc7rQQJR3/xCZAcNd6mqJ4mnp4+cdOQxNqq7e8pi5wkM3Odk9yN6LhnJYWTQNwyQgekkwSroQZQJpVEMy5NaJxkVhp9X9KZEDiybqqUljEzaRwD2d4P75viE9QknUV3Hh7IFUbR8PK33WDpM/wTAu7SJrsG3K7s1w= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019785; c=relaxed/simple; bh=6Ni7j0E/bIou28tOwawA8ovzn9pVVf3EUrKSs4YbOmw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=jsNiz71gKLspv/ZH4pFnvEZcTbf/g021TwNRyCuepbMqzJt4JQqqDGrX7MbLl+6Ct2FZ8IlawDqZNhsVkyj9nRtzpCfxQSjiNOV1dGiFtU2RrPwwJC+KzkspFMDzsEJQzOT3Vi3g+tfuFq50AnvQQ/gYPTg5JfTslght637QEQw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=FmBJngA6; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="FmBJngA6" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 17F471F000E9; Thu, 6 Aug 2026 12:36:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019783; bh=cOlsHJTllobXCXHA2FciNnYd7K+XwZx7chaSeLWgM1w=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=FmBJngA6/Jb/mwQypxOhdctUUdDNG0aXBCHWQmbHX6GGn8YcMPESL2ei/KtI72lL2 HhdZY6k9EIQzwNAHblAaptzga4lXrUemsrpHeUvfrBTcr6WHUVQ2mZOzr2pnyRBUlf u0aOv/++BO9Tg/GYxF+FiX4+vgamd8IbQqWX+P3R9IBv/vxY/afwpFf8mzZWe33sV0 smkkOpujdyj4XLHofgC8DKKlN3xEWXz4iZYgzwWVdmPPFkMeYOLVcVmBZWPpE22OAB lI2ZlS+TFEsZcTDEmX0MiBGpeVX3dLAAo14Algfuera/1csZFhpvIxQvv+JBCPCqSK uvyeiAOV/c2pQ== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 02/12] perf jitdump: Fix debug_data and unwinding_data leaks Date: Thu, 6 Aug 2026 09:35:53 -0300 Message-ID: <20260806123604.271277-3-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_repipe_debug_info() overwrites jd->debug_data without freeing the previous allocation. If two consecutive JIT_CODE_DEBUG_INFO records appear without an intervening LOAD record consuming the data, the first allocation leaks. The sibling jit_repipe_unwinding_info() already frees the old jd->unwinding_data before reassignment =E2=80=94 add the same pattern to jit_repipe_debug_info() using zfree(). Also add cleanup of both buffers in jit_close() so they are freed when the jitdump session ends, even if no LOAD record consumed them. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 4b7c7ba7cd95ddbb..dcb26d9c6c8fc551 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -117,6 +117,8 @@ jit_close(struct jit_buf_desc *jd) funlockfile(jd->in); fclose(jd->in); jd->in =3D NULL; + zfree(&jd->debug_data); + zfree(&jd->unwinding_data); } =20 static int @@ -665,6 +667,7 @@ static int jit_repipe_debug_info(struct jit_buf_desc *j= d, union jr_entry *jr) =20 memcpy(data, &jr->info.entries, sz); =20 + zfree(&jd->debug_data); jd->debug_data =3D data; =20 /* --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BD03224A047; Thu, 6 Aug 2026 12:36:29 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019790; cv=none; b=UeRkiliFAGUOLXdPOHNP8/L/VnXZK21yBpf+cZsSX/1VKuuCPPlaB8DC8AHQxYSHR+WE99nYyeQrvcefXu6FE5k1U66vy8i7+kQ0lNqxKNJqOerAnuO78Pb6QrrYOrOZN7/zocHLD4Xug42F3HrKhp55gb1UC1fG9kmEjRXxC9I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019790; c=relaxed/simple; bh=CDCKFwCfPfmcjkEOEl8ncWKeHh2Q/pyhiz/e9U/uYr4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=JfRG35tl0ToTH58K2WLaUAcap0eI9TDFpcfLCpNPnTIfagNltCKRAWJqxbr+zpoBeDK1CGjI48IJBG9q0BMevZ3LtXGF358nI9XUsBfQ/qu2oy73GhQB21WCViUX0VxAxYbNzaITBKGYzmYXhPgcqSeu0liPyyJMInDq+32JMSw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=eNCVyR4T; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="eNCVyR4T" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 7F7601F00A3A; Thu, 6 Aug 2026 12:36:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019789; bh=B/uvvDQ1yB6qzXLpKraWtRVkItiDchEOjBPUMLg+uIs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=eNCVyR4TOVJo2SzVFHbLbW+LOaUsBvnpXmrO1Mc4sX/VYHEP9uEHTpf9rTdymA+rx MfuUWle7K/35NYiO8sbMBFp/PwUoRiF1thzopvxzOvEmFsGiYoaay1wLiLKoqjpysX gt2DyGhIjEq1EuA65c1vVGKf8QKZhqbX3gNUtZXUNf0thsQ4/V1p542mQxAtX/0hB6 nWqiloPn4bTTHY2k4CaLt0tuQG4iLdGkCH9oeNIKGgW3ebu8B72dTL9uKfdbQGmh3O hkdRVGu/+WdYd83wfEBIcQV+zwns1ejwYvM+xDoGfDmmHybPpTtNVkHNOFKPaEKWt/ w0bv7Aj7p5bZQ== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 03/12] perf jitdump: Validate code_size against total_size in code load Date: Thu, 6 Aug 2026 09:35:54 -0300 Message-ID: <20260806123604.271277-4-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo jit_repipe_code_load() reads code_size from the jitdump record and uses it to compute a pointer to the code blob: code =3D (unsigned long)jr + jr->load.p.total_size - csize; An oversized code_size underflows the pointer arithmetic, causing OOB reads into earlier heap memory. Validate that code_size fits within the record (total_size - sizeof(jr->load)) before the pointer computation. code_size is uint64_t but csize is int; values above INT_MAX wrap negative when narrowed into csize, which defeats the bounds check and sends the code pointer past the end of the record. Reject those too. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Assisted-by: Opencode:mimo-v2.5-free Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index dcb26d9c6c8fc551..14bd23c8d1963e92 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -452,6 +453,16 @@ static int jit_repipe_code_load(struct jit_buf_desc *j= d, union jr_entry *jr) csize =3D jr->load.code_size; usize =3D jd->unwinding_mapped_size; addr =3D jr->load.code_addr; + + /* code blob lives at the end of the record, validate it fits */ + if (jr->load.p.total_size < sizeof(jr->load) || + jr->load.code_size > jr->load.p.total_size - sizeof(jr->load) || + jr->load.code_size > INT_MAX) { + pr_warning("jitdump: invalid code_size %" PRIu64 " (total_size=3D%u) in = code_load record\n", + (uint64_t)jr->load.code_size, jr->load.p.total_size); + return -1; + } + sym =3D (void *)((unsigned long)jr + sizeof(jr->load)); code =3D (unsigned long)jr + jr->load.p.total_size - csize; count =3D jr->load.code_index; --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 726F5233946; Thu, 6 Aug 2026 12:36:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019796; cv=none; b=tqXGKLQA+JcslFm0/FpKlxXLH1mvDaj1KbeO1hZ4sAgAc2zfWWbDgQcWO6/8e66ick+VJIg3vkrCVnwpT/yMnffh8WdeD8ulJL0SRtCPOpGUIm0erXj2krH7CRKT9OX6+GfwIoLY1nFC42mYTAJw0Otff0PUSb5M8vRWUbpRHBI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019796; c=relaxed/simple; bh=FFkKcdyGhQ08NmxkzO6fJ7ipzicX9hbBdn226DLbthY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=F88g4aWQed4EUAAy7KTU572lZFCxpWtw0N5CwNfaH5d+f6U246sxoPw5Xh1/9GT+xAIGo3FXA2tiLjF0B7WmCdyw2q+YYaZMnt31Q1ryL6F9BQB4ZQ7TjMPfNIX8a/CWx10xbG+DQeWKml3wYHaPybiZEbgVhOIUMhZi4P54oVE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TbMP0ZUT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TbMP0ZUT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E89C21F000E9; Thu, 6 Aug 2026 12:36:29 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019795; bh=bOV0ZaLH/oUBi1ChkEZxJZfm7NSfyMtKGz3vkX58DvI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=TbMP0ZUTCwPh4kuYLvrK6jI6s805XktlCqBs0KxS6WSIjGI7iTsvpg54OXAvFLay9 1eHBLWmJr8UNEguyXMTumVIchCV9EXGq1WbbThRTVr5uaMQswaRdfrrtkqXfTFO30g 1eH7/gVmoIRPJ2/h0LMApOfdifBJCICVVy7Dzop4010xDZjYAS1X+N6NoeqoFIYi3q +NSL7zxRK+PRoOEH2RxSvekBrCkVKIci56Rjv/ToJ3xA9Kay33xy8z9LD6vVjo4CHw i9p9y74FfC8tEySQnS7xXyvAiD/TKW8ObApdlvOKyIq74CzYUsAF7N4lma4D5DD+oX agyM1f10YjLZg== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian , Stefano Sanfilippo Subject: [PATCH 04/12] perf jitdump: Prevent integer underflow in debug info size calculation Date: Thu, 6 Aug 2026 09:35:55 -0300 Message-ID: <20260806123604.271277-5-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo jit_repipe_debug_info() and jit_repipe_unwinding_info() compute payload sizes by subtracting the fixed header size from total_size: sz =3D jr->prefix.total_size - sizeof(jr->info); When total_size is smaller than the header struct (from a truncated or corrupted jitdump record), the subtraction underflows to a massive value, causing an oversized allocation followed by an OOB memcpy. Validate that total_size covers at least the fixed header before the subtraction in both functions. Fixes: 598b7c6919c7 ("perf jit: add source line info support") Fixes: 0284fecd13b6 ("perf jit: Add unwinding support") Reported-by: sashiko-bot Cc: Stephane Eranian Cc: Stefano Sanfilippo Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 14bd23c8d1963e92..f79e9420c6bd7c51 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -671,6 +671,10 @@ static int jit_repipe_debug_info(struct jit_buf_desc *= jd, union jr_entry *jr) if (!(jd && jr)) return -1; =20 + /* total_size must cover at least the fixed header */ + if (jr->prefix.total_size < sizeof(jr->info)) + return -1; + sz =3D jr->prefix.total_size - sizeof(jr->info); data =3D malloc(sz); if (!data) @@ -699,6 +703,10 @@ jit_repipe_unwinding_info(struct jit_buf_desc *jd, uni= on jr_entry *jr) if (!(jd && jr)) return -1; =20 + /* total_size must cover at least the fixed header */ + if (jr->prefix.total_size < sizeof(jr->unwinding)) + return -1; + unwinding_data_size =3D jr->prefix.total_size - sizeof(jr->unwinding); unwinding_data =3D malloc(unwinding_data_size); if (!unwinding_data) --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id CE67D246770; Thu, 6 Aug 2026 12:36:40 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019802; cv=none; b=EQIqorHO2q/5pORoDA0hUnkp7hkXZLfJJRvrTxvU15KBxP3ZOuOikVJlgEl/ww0+7mKhGauJe2ONn+B3dKuQ8a5A6bN1tE+3BJxtVFnabk8fqM/XEHF4KLxxi+SonG2cmNChVX8gbCzCKWhlTlM5Rt2D5ngnvUm/ojC98uc3ENU= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019802; c=relaxed/simple; bh=F5t1pmx1MJGa+4Wacd5mAjTnkxXeeTJwGRMqw0Y/6fM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=C0aYLLmFbbwssbl3GFCVshZmOUs0738bsh4glKc+pxEMcwK0FUSUBr8Ujn+l9AsmUu7SN6DRM4mZWtn63j4FkdRYjnDZGga7ahfQDTAH91Ydxy4z9SPsFNWCjI/LK0/6l2zFoDogzIsJBm/Avy4/cv9f2uHxUjhHBQWJiP1RwuY= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=F/jSOIob; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="F/jSOIob" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C05191F00A3D; Thu, 6 Aug 2026 12:36:35 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019799; bh=E+1OJPyfkUfOKy6ZjfP6envJXPAjjgNC0CBQ2p7QvNM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=F/jSOIobcv6tCaQ+wA0rfhA/SwLNlTLLaOuy5KxCau9+J7Oyml40ND3nFepn7Hao0 zedv5ZCcyKJHnXgy/bzrC3JAqsHDxHUfWEQupdT733F6SKSJwB29OMlKn3X18YuB0S aTmnK9uoAg79VJctNof2qx38pd6JkAz6ZFMyJlFNH9wH9EtIkWbj1aA5PDekAu1+US 9qjn1JeNedIRX7av3Zx2wvBbF+RT1k3ZCgA/ZHhepvJKfc/0cYcONDR6ldgx+B1SVh Googs/PRff1PQGKa38MJf9MqvLw1lZsWcJ1CW53DuIcpPVTS34I9eVZxY9OrEwgNU4 cvW7ClC83FXiw== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 05/12] perf jitdump: Bounds-check debug entry byte-swap loop Date: Thu, 6 Aug 2026 09:35:56 -0300 Message-ID: <20260806123604.271277-6-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo The byte-swap loop for JIT_CODE_DEBUG_INFO uses array indexing (jr->info.entries[n]) to iterate debug entries. struct debug_entry has a flexible array member name[], so each entry has a different size. Array indexing computes offsets assuming fixed-size elements, landing inside variable-length name strings after the first entry and byte-swapping garbage. Additionally, nr_entry is read from untrusted jitdump input without validation against total_size, so a crafted value causes OOB reads. Replace the array indexing with debug_entry_next() pointer arithmetic (which correctly accounts for the variable-length name) and bounds-check each entry against the record's total_size before byte-swapping. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index f79e9420c6bd7c51..7efbaa07f1ba73f9 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -320,14 +320,32 @@ jit_get_next_entry(struct jit_buf_desc *jd) switch(id) { case JIT_CODE_DEBUG_INFO: if (jd->needs_bswap) { + void *end =3D (void *)jr + jr->prefix.total_size; + struct debug_entry *ent; uint64_t n; + jr->info.code_addr =3D bswap_64(jr->info.code_addr); jr->info.nr_entry =3D bswap_64(jr->info.nr_entry); - for (n =3D 0 ; n < jr->info.nr_entry; n++) { - jr->info.entries[n].addr =3D bswap_64(jr->info.entries[n].addr); - jr->info.entries[n].lineno =3D bswap_32(jr->info.entries[n].lineno); - jr->info.entries[n].discrim =3D bswap_32(jr->info.entries[n].discrim); + + /* + * debug_entry has a variable-length name[], so array + * indexing would compute wrong offsets =E2=80=94 use + * debug_entry_next() and bounds-check each entry. + */ + ent =3D &jr->info.entries[0]; + for (n =3D 0; n < jr->info.nr_entry; n++) { + if ((void *)ent + sizeof(*ent) > end) + break; + /* name must be NUL-terminated within the record */ + if (!memchr(ent->name, '\0', (char *)end - ent->name)) + break; + ent->addr =3D bswap_64(ent->addr); + ent->lineno =3D bswap_32(ent->lineno); + ent->discrim =3D bswap_32(ent->discrim); + ent =3D debug_entry_next(ent); } + /* clamp so downstream consumers don't overrun */ + jr->info.nr_entry =3D n; } break; case JIT_CODE_UNWINDING_INFO: --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82EA7298991; Thu, 6 Aug 2026 12:36:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019806; cv=none; b=sDYafpyRT6ed15Q7PtJMgCnl74UAJap7neo87+fvXVFC4nMjOgkhd+vZj4g2t/T+mkXXleRIuds4BbfkQdajJRd3a1gK30js9c5EgTCecQqcUf6cPJo/hovh+ct4btEaiNjHf+jjrvm34JzRtEXiiSkQC7rNswTWhFvcgfwIiIk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019806; c=relaxed/simple; bh=zOzZ6R9n9cX/hkQsyXcUak2eXDWTGufaDSt4AoIwZiw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=MptKzwKRmKa22xSRTp8PE7rJJbm7YckwP/10oBur1kjUALVXyTUhbWUdEJVGirjTLo5dnO/5e2IlyW3NifvFf16Jt0wUC7Eki9ubs5iRcq8Ngv0Dk5Qgao8VAmkzfYwMhIhNaGZfycikA/dggx53Iz1poDljyADjExTVj9M9G3I= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=ldam6ImE; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="ldam6ImE" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 922431F000E9; Thu, 6 Aug 2026 12:36:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019805; bh=qkYprDtGWPa4KjbGn9gcW9pfLi13mKr1cL3g3IKZD+g=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=ldam6ImE6X1NAPm1hZBdMkqEKTpPCAZA2A5ByP4ACXimS2L+3Wpe02YC5rkLv+syg Lo6Zpp2mu7AE2iHn6HP5maYpjQ7QZWLVADMdvh9YbZ2iEkC7uYs1MzvUf8cHvv5Fag I2rGKCasHxdaUeDu+E5GSqDbKB8GAZRgzXrEycgDAdsMOUj2eWy7K2GCoH2gjAEP0j Fx6JLOrlfkrTrIBmjMWt55Dgx04cK55659eCH7IEWKmkv2Qu/Ww9r0dLLcYze6eIQA d+bqYOk3DV8G4MDxzrJrskGgA2PXlJLBMQ1bBVnF0ot8z2qV7M42DFhMsePse46aeV njlbAaIR0Ph4w== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 06/12] perf jitdump: Check snprintf return before computing header size Date: Thu, 6 Aug 2026 09:35:57 -0300 Message-ID: <20260806123604.271277-7-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo snprintf() returns the would-have-been length on truncation. When the jitted filename exceeds PATH_MAX, the unclamped 'size' value inflates sizeof(event->mmap2.filename) - size into a massive underflow, causing the header.size computation to write an oversized header. The subsequent write to 'id =3D event + header.size - idr_size' then corrupts the heap. Clamp size to PATH_MAX - 1 after snprintf in both jit_repipe_code_load() and jit_repipe_code_move(). Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 7efbaa07f1ba73f9..45f0e21b0e780cb6 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -495,6 +495,9 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd= , union jr_entry *jr) jd->dir, nspid, count); + /* snprintf returns would-be length on truncation, clamp to buffer */ + if (size >=3D sizeof(event->mmap2.filename)) + size =3D sizeof(event->mmap2.filename) - 1; =20 size++; /* for \0 */ =20 @@ -625,6 +628,9 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd= , union jr_entry *jr) jd->dir, nspid, jr->move.code_index); + /* snprintf returns would-be length on truncation, clamp to buffer */ + if (size >=3D sizeof(event->mmap2.filename)) + size =3D sizeof(event->mmap2.filename) - 1; =20 size++; /* for \0 */ =20 --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6221F26738D; Thu, 6 Aug 2026 12:36:50 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019811; cv=none; b=ZKMBLRXXldcnvlO8m9hhw7lA2wip1z/6KTbwexaGjpumvDPjbUGjjgdwEpZaDaWUGgiFQ8rCatTn8AbXgcKuTMSzxCyOJynFNOe8CXZssC7yE5xm1zrCTRIUlLRdyaIZuOvWQOAhucwiGBFVJh8bvWzLrHGoU9GTWDIMICGmkt4= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019811; c=relaxed/simple; bh=Y7qE4d/zcx6zywiShfuPhfsAQaXh59POJvtoif4LMe8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LKAuHJy8e/02uFeqHIn7cENbIqFaFtGvf8Lm8BNnBXiGtI0O6r/34o1iOyRB4MYlRHXNjSQ9ksDySRNyBf87LVPNoHfjkHmKAEOLVkqjm36x/MwBnP/H50B+iATu7TzSqbic2hLckJLw9F2aIqkXU7c1IT5A167tK45xqpbcSow= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=c3woAotn; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="c3woAotn" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CA2E51F00A3A; Thu, 6 Aug 2026 12:36:45 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019810; bh=kKy50RliKU/qsCAJenQgHACMcOw9d+wUOZ+IfaGHPKw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=c3woAotnVfIvEHARjxGIgG1TxHGoItVYJ2vJJ4pG848kBWAZAIZtrsbYcxF17+1HF n//Nn4MCml5at4W67hOPjUdG2xZDJKtBMnbGgYDdfQZshg5kXW4+8Z3OPEbzdzh+yo G/VZEA+iiK2mEJGveolnFW4MH0dkNSalx+zsR4PBxUa4TILnZevW8lo2EtNyB1iqCT lO/bUOOzN4QKVMpa7LYEF2voAzeVRMRFYghYr/s4EXRelCyZqPDTmCnekebbY8wOj6 G2D5kuj6mBVftQ4XRgZE4Bzk52G1Xrpqeruv5qzNQmEeyIr5uTsGgckUZRtF0wyCjq jq5UpmFdIaQ/A== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 07/12] perf jitdump: Fix funlockfile on unlocked stream in jit_open() error path Date: Thu, 6 Aug 2026 09:35:58 -0300 Message-ID: <20260806123604.271277-8-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo If the malloc() for the initial read buffer fails, jit_open() jumps to the error label which calls funlockfile(jd->in). However, flockfile() is called later in the function, so at this point the stream was never locked. Calling funlockfile() on an unlocked stream is undefined behavior per POSIX. Split the error path into two labels: 'error' (after flockfile) calls funlockfile before cleanup, 'error_noflock' (before flockfile) skips the unlock. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 45f0e21b0e780cb6..ae63366b86c6d765 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -157,7 +157,7 @@ jit_open(struct jit_buf_desc *jd, const char *name) =20 buf =3D malloc(bsz); if (!buf) - goto error; + goto error_noflock; =20 /* * protect from writer modifying the file while we are reading it @@ -246,8 +246,9 @@ jit_open(struct jit_buf_desc *jd, const char *name) =20 return 0; error: - free(buf); funlockfile(jd->in); +error_noflock: + free(buf); fclose(jd->in); return retval; } --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ABC4524DFF9; Thu, 6 Aug 2026 12:36:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019817; cv=none; b=IpuPFndcm0aKPgZRyelBVL6LvxnFT3Vm7qegPiOJ/XNdCtTCE9q94jyg+55dN2Ftis0UTvc9hS5GCxvrBDdGHL10mc3Rqjja68JIb5a82730QF4/7ha4aOC+5COn1LxprxMuNASiZpSabmQS5h9gG+E+hvR0cd6hu3c2iAOLEZs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019817; c=relaxed/simple; bh=OLE+kfWsYBXHwKS9jCVJiWVrON8POOg2LLckCnx1WjM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=Uh+ZalN27kCxiGhfADStTuhHUGWG/Gtvl6VrYgvlS3pDFSnFznSC8qVPr6JyrO6D2DwkVwnDAcoksuxphDHUmziE+Bo/8eTM6VLv+pGx6I9HH46A4twrBN4QAQGFNce3Q7gyiDdoPGXR/Ls4JpoRRFPuOtXDyGCisPFHajDx2do= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=UQ/6vZSp; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="UQ/6vZSp" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CE0961F000E9; Thu, 6 Aug 2026 12:36:50 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019815; bh=eN9S5ZHoWuKMzVLeKazGTDHy6iIEOvjet1utFvcBteI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=UQ/6vZSpDl7hBJe2XwnQ3O5MDAWchITs1lyyd5YzZC+jc8erg5mOJpuixpDL0sBNf PBe7vEssjVn3EMCRjRBswu1UlWd/is21EI7Bh1TMaWi/4B0oMoQB0NgyjYwdGyi4iV XXtPRzUqZw8T0Kw+KOTVjW5Vf880nYgrBrRy/iSYNOJS1jULfK/dvvupNWDSnpISkS 7wOaVN2rowzCxlDacRDqKDvZC4yJGoLURqx1eCgsaAXC3TLer2RD/dvVlTHy2MkV4L DbV3ymGBOLLcQpKAyJrWzz815cfngAM70LCcNDZOHJtQ9b8fu41DgpmYmtH6Z/a8qu 3MEyizwhsSy5w== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 08/12] perf jitdump: Free event in jit_repipe_code_move() Date: Thu, 6 Aug 2026 09:35:59 -0300 Message-ID: <20260806123604.271277-9-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_repipe_code_move() allocates a perf_event with calloc but never frees it =E2=80=94 the 'out' label exits with only perf_sample__exit(). The sibling function jit_repipe_code_load() correctly calls free(event) at its out label. Add the same free(event) to jit_repipe_code_move(). Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index ae63366b86c6d765..91aa1eea8229faac 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -685,6 +685,7 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd= , union jr_entry *jr) build_id__mark_dso_hit(tool, event, &sample, jd->machine); out: perf_sample__exit(&sample); + free(event); return ret; } =20 --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 78FF9233955; Thu, 6 Aug 2026 12:37:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019821; cv=none; b=sTMlTu+7ux+Bbqfurt2VZghVF2hlXgIYz5yWCuOk2ttbfkhK4h7PMCMqR4nM9ZRBfId8XMbYX2dmw26jTEL4nIXucIum3KXfMD0/c0Pmaeog6zSXjOLw9QF2XBbd0mLAceMMIbemWFsPKPjYlLAIrFeMIzvnWbDvXq+IVlHH3ts= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019821; c=relaxed/simple; bh=XpzrkI/AxHUiRdfyTzZwu7rrNLNVt1IZLGOuFgGBLvg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=uZqTwLO3cRpruhrikq1mbc6Q/Rp+9YxQ7OZsA7d/74aA87A1th1SFMbtiWbLOMBBQ4F+hp39hVVeec9aseU3AAxIJGaVEVF9NrCWHnIL8S78vpPc+lHjSq3OTzAq+oOP9B68ijhe1GESjB2TB39fxVwM8hJm5t8zYgB93pHz1oo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=G2asDk11; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="G2asDk11" Received: by smtp.kernel.org (Postfix) with ESMTPSA id EF8341F00A3A; Thu, 6 Aug 2026 12:36:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019820; bh=46Q32NiiQU+GiIomMs6YY9FirnAhja+ozdHIENQBLbs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=G2asDk11TtXjQ54eziAkkgkh7KcnT+pgQ8XB41iFr+S3xx4cnKs8ukRzUo6lcl5TO q2JymGnB2XB5QeMJge422qcsQe7AzuOHddxscNYJiEN2GDwjoN4KI/tmkvpoOLVrv0 KN9x01s0U90mxolo9uC6k9nsQHHQTHVk1YUiCJPwRevlmN6C1Hcjv2pG888X8Lyxao nTNl5F6N7Zn/CdwIFIjki2iB8y09WeDqGkeMIYEY3l1tpOt0iLrw+a2cDF1E6ifj29 HFVtIb1/aOwDuU/Lm35t0wp57a6mjlY1ILTe/bWLV6c9siCdWY9EdCpbc4BNTd85Ak N50fEgoo5eosw== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 09/12] perf jitdump: Use dirname() return value in jit_open() Date: Thu, 6 Aug 2026 09:36:00 -0300 Message-ID: <20260806123604.271277-10-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_open() calls dirname(jd->dir) but ignores the return value. POSIX says dirname() may return a pointer to internal static storage =E2=80=94 gl= ibc does this when the path has no '/', returning "." from a static buffer and leaving jd->dir unchanged with the original filename. Capture the return value and copy it back to jd->dir when dirname() returns a different pointer. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 91aa1eea8229faac..d3de307532d55065 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -146,6 +146,7 @@ jit_open(struct jit_buf_desc *jd, const char *name) ssize_t bs, bsz =3D 0; void *n, *buf =3D NULL; int ret, retval =3D -1; + char *dname; =20 nsinfo__mountns_enter(jd->nsi, &nsc); jd->in =3D fopen(name, "r"); @@ -241,7 +242,9 @@ jit_open(struct jit_buf_desc *jd, const char *name) */ strncpy(jd->dir, name, PATH_MAX - 1); jd->dir[PATH_MAX - 1] =3D '\0'; - dirname(jd->dir); + dname =3D dirname(jd->dir); + if (dname !=3D jd->dir) + strlcpy(jd->dir, dname, sizeof(jd->dir)); free(buf); =20 return 0; --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1CF01233955; Thu, 6 Aug 2026 12:37:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019828; cv=none; b=o0RSDjoRAPg3zQ47NoxBTy+K8r8k8UPw4obY3UiQL1wGLcFMAqwR1Nu0eTkOyiWc9LSD9v3wcn8T27JaoaSRiJ7Y7yJ+0EbGEHBmreL+c1fMBk3+x6UPBAQuLzxepKA8+8Zjnx8lZyroZXHHE+E2Xzpy44LsF1NoBSysvwX/8Ds= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019828; c=relaxed/simple; bh=XsPXYUoTfryy3R2b7vz0UCgSVVqpijR0pZ48YPHUBAs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=RKyPtdAOkP2CRK7dbawhMGpNJYHX6EC5XL22+Pykkdu4IZ5pUk2MMTo/Md+ww6EgFHRbCwYkwZgx6HF5FKB/F1no+68+0sKl1IpKdu3qChMzys6z1xbKwM2+SW3dzeAlzq00j3jZldmBIne+5he4kSMqOoL6kDIN0R0qS6xPZE8= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=gQTeo54L; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="gQTeo54L" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A3D881F00A3D; Thu, 6 Aug 2026 12:37:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019825; bh=uG0bUCcCsV5Kuer6dfyDYUG1djfBK9KIj4YAd8oXHAA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=gQTeo54LRma0cT+JkbVzWG0KEJciLqRBBC5xSU47J43fU8TmoNOzTPYC6n/aRiDoH Ap3Ab32/Hv+d/w0p0JREO1XHosRx170YMpTXY5jrmoopAHzeL7SpOWdOg/LGn4Kx4K SzzQb6ClJeWw/uSz2AJnOh1B6TTt2qGQBp2ecBcQFMi9kGABs4LWzAjDj6AX9WQZLA 08woG0Kyi/kzBqrs6Vhgv+KA4ctXom/Gi2dxfUoH2pzdSnUdgJY2uHJTZNuofdJokQ xG+xqSXZVHjbPsB40Cw4IE9aB8ekt1r/W6PxULMqfpJwhDQq71/aZyVt4EYQWwCR+j yaYrrXPwhzK8Q== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 10/12] perf jitdump: Validate debug entries on native (non-swap) path Date: Thu, 6 Aug 2026 09:36:01 -0300 Message-ID: <20260806123604.271277-11-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo The bounds-checking and nr_entry clamping added for the byte-swap path only runs when jd->needs_bswap is true. On native-endian files, nr_entry passes through unvalidated to jit_repipe_debug_info(), which stores it as jd->nr_debug_entries. Downstream, jit_process_debug_info() in genelf_debug.c iterates nr_debug_entries times via debug_entry_next(), which calls strlen() on each entry's name field =E2=80=94 a crafted nr_entry causes OOB reads and writes. Add bounds-checked iteration in jit_repipe_debug_info() that validates each debug_entry fits in the payload and its name is NUL-terminated before calling debug_entry_next(). Clamp nr_debug_entries to the count of valid entries. Fixes: 598b7c6919c7bbcc ("perf jit: add source line info support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index d3de307532d55065..5a3ea2681fb37105 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -694,8 +694,10 @@ static int jit_repipe_code_move(struct jit_buf_desc *j= d, union jr_entry *jr) =20 static int jit_repipe_debug_info(struct jit_buf_desc *jd, union jr_entry *= jr) { - void *data; - size_t sz; + struct debug_entry *ent; + void *data, *end; + size_t sz, valid; + uint64_t i; =20 if (!(jd && jr)) return -1; @@ -715,10 +717,25 @@ static int jit_repipe_debug_info(struct jit_buf_desc = *jd, union jr_entry *jr) jd->debug_data =3D data; =20 /* - * we must use nr_entry instead of size here because - * we cannot distinguish actual entry from padding otherwise + * Clamp nr_debug_entries to entries that actually fit in the + * payload. The byte-swap path already does this for cross-endian + * files; validate on the native path too, since downstream + * jit_process_debug_info() iterates via debug_entry_next() which + * calls strlen() on each entry's name field. */ - jd->nr_debug_entries =3D jr->info.nr_entry; + end =3D data + sz; + ent =3D data; + valid =3D 0; + for (i =3D 0; i < jr->info.nr_entry; i++) { + if ((void *)ent + sizeof(*ent) > end) + break; + /* name must be NUL-terminated within the payload */ + if (!memchr(ent->name, '\0', (char *)end - ent->name)) + break; + ent =3D debug_entry_next(ent); + valid++; + } + jd->nr_debug_entries =3D valid; =20 return 0; } --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 66CF7279907; Thu, 6 Aug 2026 12:37:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019837; cv=none; b=HG2TJWeflgwJC+DlPWWSJJJTZsnaWr3RjQ5j4lsrlskHa1aGfPv9FgRrWFxMOCAcNzhX+GzPadiUulLPXQkoWEpgCyW2fMDL2XUk+wrBeJdNXhS8i+pJIVfcqZ0iCztxslC0fBDktAjeebCrTRuu1wfrglLdiwzqAj9OqVeaRwk= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019837; c=relaxed/simple; bh=SZQuzrP/ehv3y8PwjY5jperLSL3kBkBVUroC8jwdI3s=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rCf+X5wkQTj08SKfGXdDweclltot9WRJ5duuX7HeK97JBOtTqkv/1/sulRD5q+o+ZGiBRnaovJ0VmNBTiRhphtey8C2VvyO/aeMbShekGedk9ScnNK1p6gceGWTDdOBMSeTBG/+fdvwmv1huPIZr9K91YzkPf9SUIZBGmLkK9nw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=cHh/ZG2c; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="cHh/ZG2c" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 322261F000E9; Thu, 6 Aug 2026 12:37:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019830; bh=RUyxmj3vxNdvlR8l7JK2MtQk0vGO/OK+dQDKwAGY5Bw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=cHh/ZG2cVOE+oWqh9qDmf8sLi6UbV3c7NcW94Pvmu9CwaNnV4hBdVJ5/nGuOUXl4N 2LIHUPz7HblL+8rbTiutxd+eN8l7FBiIngPg9RmXfD9d/rFNMMnAMehBdwww9h3GBy MPJyLL9UfoyCUCgYeVioDjydEULnwQ9iI+q9MzXx7C1zRfTSOkY1jPgLIq7biCCdgp iRUy2ltpwhwAFRtn+OLdXrWuPDRp5K2Xg4U7xpMuLS6RncrZ5ESz53sSnYeHNujPaS KJ+hHWLp2EqI03uhXG1WLZBYOKenE9RhPQ/jSqVg/mqmnxdKx869svOKVjPNayO7x3 zB1hREg3ckTtA== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 11/12] perf jitdump: Validate sym string NUL-termination in code load Date: Thu, 6 Aug 2026 09:36:02 -0300 Message-ID: <20260806123604.271277-12-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo jit_repipe_code_load() computes sym =3D (void *)jr + sizeof(jr->load) and passes it to jit_emit_elf() which calls strlen(sym) via jit_write_elf(). If code_size equals total_size - sizeof(jr->load), the sym pointer aliases the code blob with no NUL terminator, and strlen() scans past the buffer into adjacent heap memory. Add a memchr() check to verify the symbol name is NUL-terminated within the region between the load header and the code blob before use. Fixes: 598b7c6919c7bbcc ("perf jit: add source line info support") Reported-by: sashiko-bot Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 5a3ea2681fb37105..5898a7d8eb962daf 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -487,6 +487,13 @@ static int jit_repipe_code_load(struct jit_buf_desc *j= d, union jr_entry *jr) =20 sym =3D (void *)((unsigned long)jr + sizeof(jr->load)); code =3D (unsigned long)jr + jr->load.p.total_size - csize; + + /* sym string lives between the load header and the code blob */ + if (!memchr(sym, '\0', code - (unsigned long)sym)) { + pr_warning("jitdump: unterminated symbol name in code_load record\n"); + return -1; + } + count =3D jr->load.code_index; idr_size =3D jd->machine->id_hdr_size; =20 --=20 2.55.0 From nobody Fri Oct 2 01:07:14 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 939FD257845; Thu, 6 Aug 2026 12:37:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019843; cv=none; b=V8t5xZgYZkIKphlQiFl2BQlhZPkaNsODnLXVEF/f+CGGBu5q36SePC5FGwcGNpWOggNBEFXj6fAECrQjbRs2sCYsMfXibb+oJiCoTvVY+VzGw1UUOPazvp6w6SjjnzFmHCKOaftEJfaUegx44UsHCODLA8Vfe4fdHtAH6ve9z+U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786019843; c=relaxed/simple; bh=BMSZSbh4QqCDcAj4jNHr9AUogJVXdKpevF2vPUwfF7g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=k+Xo+esrRV9Ix4qiYNVU+zP9pAdAlG2NLI6qVSq59f0PSwJeYqPY3RQy7HUYJs9RaqBqAMEcxTVGTDk9ePi9X2sL93Emza7ekc4pu1+fPUpql4+1qTTnB4C3gYfuflTyaL+vYxLKpDkUrB2apTAhay1tcsPmRtrrJkWSyW3gthw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=OGOnma2U; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="OGOnma2U" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 681A41F00A3A; Thu, 6 Aug 2026 12:37:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1786019836; bh=jz8pdtxPjlYzX8D8R/3BRdPfTaskLXym80/LcGKzffs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=OGOnma2UVXQxld6SfHRu43/mJs2w5nWaZEyO2uZJO8R8Zq9X5G3pGkixtNXjwIbsC JvDDa74/RfrJMEf0XNgQZ/uIurICsUfhaq1ASt5kr41H5jPmvACGSzoDl3J7l6jkne PP4qIMOFJhOoJLYPMowP2H4EV0GhTST8sSASKSmTfr/skOULjVM7IYbzoV9cQAwv9C dARar73/Bf8FvATiuhDqJq3VAcJyh7C5UJk+c9LghQVqTI5kjpIEJY25rarSCK08R2 UkeRtUBEsGI9/fhH5mfR4xisV/a4eeEj1hmXDGc4Jw5wyAhKhDOMvZZ+GWnwkBoDAT bwDVjMRhHvATA== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stefano Sanfilippo , Stephane Eranian Subject: [PATCH 12/12] perf jitdump: Validate unwinding sizes against record payload Date: Thu, 6 Aug 2026 09:36:03 -0300 Message-ID: <20260806123604.271277-13-acme@kernel.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260806123604.271277-1-acme@kernel.org> References: <20260806123604.271277-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_repipe_unwinding_info() copies unwinding_size and eh_frame_hdr_size from the jitdump record into jd-> fields without checking them against the actual payload size. Downstream, jit_add_eh_frame_info() in genelf.c computes unwinding_table_size =3D unwinding_size - eh_frame_hdr_size, which underflows when eh_frame_hdr_size > unwinding_size. The result is passed as d->d_size to libelf, causing an OOB heap read into the output ELF file. Validate that unwinding_size fits within the record payload and that eh_frame_hdr_size does not exceed unwinding_size before allocating or storing the values, so a bogus record cannot force a large allocation that is then discarded. mapped_size is likewise taken from the record and was narrowed into an int for the mmap2 len computation in jit_repipe_code_load() and jit_repipe_code_move(); values above INT_MAX would turn negative, producing a wrong mmap2 length. Use uint64_t for usize so the value cannot truncate. Fixes: 0284fecd13b6db3e ("perf jit: Add unwinding support") Reported-by: sashiko-bot Cc: Stefano Sanfilippo Cc: Stephane Eranian Assisted-by: Claude:claude-opus-4.6 Assisted-by: Opencode:mimo-v2.5-free Reviewed-by: Ian Rogers Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 5898a7d8eb962daf..d25a9fe9b020ce87 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -462,7 +462,8 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd= , union jr_entry *jr) u16 idr_size; const char *sym; uint64_t count; - int ret, csize, usize; + int ret, csize; + uint64_t usize; pid_t nspid, pid, tid; struct { u32 pid, tid; @@ -543,7 +544,7 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd= , union jr_entry *jr) =20 event->mmap2.pgoff =3D GEN_ELF_TEXT_OFFSET; event->mmap2.start =3D addr; - event->mmap2.len =3D usize ? ALIGN_8(csize) + usize : csize; + event->mmap2.len =3D usize ? ALIGN_8((uint64_t)csize) + usize : (uint64= _t)csize; event->mmap2.pid =3D pid; event->mmap2.tid =3D tid; event->mmap2.ino =3D st.st_ino; @@ -612,7 +613,7 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd= , union jr_entry *jr) char *filename; size_t size; struct stat st; - int usize; + uint64_t usize; u16 idr_size; int ret; pid_t nspid, pid, tid; @@ -761,6 +762,18 @@ jit_repipe_unwinding_info(struct jit_buf_desc *jd, uni= on jr_entry *jr) return -1; =20 unwinding_data_size =3D jr->prefix.total_size - sizeof(jr->unwinding); + + /* + * Validate sizes before allocating =E2=80=94 jit_add_eh_frame_info() + * computes unwinding_size - eh_frame_hdr_size and uses the + * result as a buffer length for libelf. + */ + if (jr->unwinding.unwinding_size > unwinding_data_size || + jr->unwinding.eh_frame_hdr_size > jr->unwinding.unwinding_size) { + pr_warning("jitdump: invalid unwinding sizes in unwinding_info record\n"= ); + return -1; + } + unwinding_data =3D malloc(unwinding_data_size); if (!unwinding_data) return -1; --=20 2.55.0