From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A5CCE332629; Mon, 31 Aug 2026 13:11:28 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181889; cv=none; b=oxsKvGKOdwT3bwblM/CuXgfHcLhFb0C0wV3MCE7HlIcOYMEdRq9Tllm9TSBIF/8tyviuQy2Jk59x4TNMmexwNui0qeClxnPuW/ZPSzFkgQ9ddbnEhARk3hEsC3XywdKrOsziG8tVFEJioA8YrkMpHuhAr8zhjCUBpzPfUhWOGNY= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181889; c=relaxed/simple; bh=xfFObntrl3MqzhkA//sxs5FzBMlKzetmWbUp3feYzu4=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=jVyxmLBCZhkLovbQkoDlqeMgFFjpkWnNItqBkYAStc6kW/5Nx6X3VPv+GOQ6wMRfs0MQc0xRdn2/ruufGZi7de+LghlFopnAZ0v8sB21Wfsf79DwIbvvATBH2MzZR1uU2m/ndNM96ERyoP2B0eQ9Io81v6viafhFK9Ntjtr8ZNc= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=SG/WNBLf; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="SG/WNBLf" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 6D8351F00A3D; Mon, 31 Aug 2026 13:11:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181888; bh=HDLIWnY3FmW/7weGAhAHGuE8Z/kXZbN9jNMUaKnDRGM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=SG/WNBLfiyRJSI1hIqjQwSPs7mvh3J6YVfN0/xTTwC9RyuExGAjkitTgzr1xDJB1p pS2HI3tUqlkW6m1S5THq4hS0QJ3FL/Aj/BMoskjMe0Zr2XbAtqMYKht1FEko9zFFao 4TMqb/fdeHH4Lqdf75SJDelSzI93a3YiVLprUkkYsrk6D9KBwricjCwY6En+5C35CG C2VJsu8JJFmkoRtxbzhUjW/bvTQyGZ3Vqki1erAOGw09KwNhsPB9UP9y6dCO/9hkwU 8QqrWAq1DQL/yoDBoGHFXhNwjckUCTfcJN5bjx2nlfG2olsTYB1QCVwFZtd44CBOq7 9J4aWizR9/B/A== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 01/12] perf jitdump: Fix extended header read that always fails Date: Mon, 31 Aug 2026 10:10:57 -0300 Message-ID: <20260831131110.4681-2-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_open() sets bsz =3D bs before the fread() that uses bs - bsz as the read size, making the expression always evaluate to zero. fread() with size 0 returns 0, which triggers the ret !=3D 1 error path =E2=80=94 so ext= ended jitdump headers (total_size > sizeof(header)) have been silently broken since the original implementation. Additionally, when 0 < bs <=3D bsz the if (bs > bsz) block is skipped entirely, leaving extended header bytes unread in the stream. Subsequent jit_get_next_entry() calls then parse those leftover bytes as a jr_prefix, corrupting the record stream. Fix by separating the buffer growth from the read: realloc only when bs > bsz, then unconditionally fread bs bytes when bs > 0. Fixes: 9b07e27f88b9cd78 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Cc: Ian Rogers Cc: Namhyung Kim Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 83005b30b9bf3fd7..4b7c7ba7cd95ddbb 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -224,10 +224,12 @@ jit_open(struct jit_buf_desc *jd, const char *name) n =3D realloc(buf, bs); if (!n) goto error; - bsz =3D bs; buf =3D n; - /* read extra we do not know about */ - ret =3D fread(buf, bs - bsz, 1, jd->in); + bsz =3D bs; + } + if (bs > 0) { + /* consume extended header bytes from the stream */ + ret =3D fread(buf, bs, 1, jd->in); if (ret !=3D 1) goto error; } --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4E54933D6F7; Mon, 31 Aug 2026 13:11:33 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181894; cv=none; b=VvLVLaqCM6b1rGyLV0qYwlRplcPCLD5ij+oJo97VD5c/v3dLv7sHlUqQZ9zFFevOUq/erTmkXbcoJgVQIR33lXiFLJPXPYegy8dvPLP2EPzTAbepyk1aiTpt5P6raYIL2xIjhFNv96QM3kq6BfWe7EmdvLdYC5j2oSMUirK0S8g= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181894; c=relaxed/simple; bh=PkmIIdfHx/N23qc2OX//duYuVGo7nKRZz614GKDL9e8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=iiGe4tpdrfP2nsAlLyLU8LlimO6w+qRou9Op/tS6IqmqV+2C43P7i4TD2uvfn4FVwVTNWvdtEkZTEJ+4jNV63GSGNCnJroCvO5cngU4gghGHyzaSrqRsyGPlYG+d5Ufmn2f+pF73ESq8RelHjxE3dmTvN+NvusNzQ47Xnw1x8Qw= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=I6ay6jJN; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="I6ay6jJN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 63CDF1F000E9; Mon, 31 Aug 2026 13:11:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181893; bh=cX/28PGpuDv9PzjzEDzpUDECpxJ3PzWqb3WeckAUN04=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=I6ay6jJNAvQ1Ow9VbUfRuhxWnILeZI0//nKmsVf4fixsN0IQ2W0rxDLmdi+oyIDPE 1oD7aecH0fGtIIfSj6gl+TzVkOfnFqWWaHmlN2QZn24R462Sb3E9PqVagpLNlQAvJR az1RQP4FvgM+HbZo4XYPiQT6pb1rTx5HCz9wExjnviFtHzDXkALpEL0GQPC09fcn0Q i9ruyp5OpmNvh5Z9Pz23USLSVsLkg8oEtmSqLie1AJrLM1XHaf5N+9w/iuco0Nzik1 c7NuRLYA3GMcLr5x+HOtGIKQuH5T58DmYjp3D0NuFhvMBZSpRVdMsqiMQ+9lcUmfYb /aHcXut0HAHtA== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 02/12] perf jitdump: Fix debug_data and unwinding_data leaks Date: Mon, 31 Aug 2026 10:10:58 -0300 Message-ID: <20260831131110.4681-3-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_repipe_debug_info() overwrites jd->debug_data without freeing the previous allocation. If two consecutive JIT_CODE_DEBUG_INFO records appear without an intervening LOAD record consuming the data, the first allocation leaks. The sibling jit_repipe_unwinding_info() already frees the old jd->unwinding_data before reassignment =E2=80=94 add the same pattern to jit_repipe_debug_info() using zfree(). Also add cleanup of both buffers in jit_close() so they are freed when the jitdump session ends, even if no LOAD record consumed them. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 4b7c7ba7cd95ddbb..dcb26d9c6c8fc551 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -117,6 +117,8 @@ jit_close(struct jit_buf_desc *jd) funlockfile(jd->in); fclose(jd->in); jd->in =3D NULL; + zfree(&jd->debug_data); + zfree(&jd->unwinding_data); } =20 static int @@ -665,6 +667,7 @@ static int jit_repipe_debug_info(struct jit_buf_desc *j= d, union jr_entry *jr) =20 memcpy(data, &jr->info.entries, sz); =20 + zfree(&jd->debug_data); jd->debug_data =3D data; =20 /* --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D18BC3403EA; Mon, 31 Aug 2026 13:11:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181899; cv=none; b=smzsSzVnGrf/BZrUU+1RDhBon+UpuOvsXPe82U+cFmsubqKGPHQmxVhIIg6zN8b8WDi9MhCWcS20qTiee/SaAm6F/Seaewu3/6KrrHiGwAgMBxrCuIEp2X/gDdiUADnpr2ARZXpGGoQlFpt143R4OCsL4Koyfa4uxCeDOyvlB0Q= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181899; c=relaxed/simple; bh=1plszNX5YJI2grUZ9UoSn5KchYMLJbBYQ1UxdFC5Kzw=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tKSIOq13HRewrRacJ3lcIhrYRofsAZ/FL3Ylu1sn7HebfDorERXk5V1OkI7jqw9rl7tZQKl4cWwYshw/aE+Cer8SisJWmi6amPDZTI20/4Tqd21ZpTxEQOPNVd/CE+yaIef94zzPcoPum7kHo48nkajw5nEf8JVKswR5znyRenI= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=C4C8USy1; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="C4C8USy1" Received: by smtp.kernel.org (Postfix) with ESMTPSA id BDD401F00A3D; Mon, 31 Aug 2026 13:11:33 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181897; bh=pyoeWkFyGgKAhAYW3vko3P5GY3z1QKRZ4IjWXd0etss=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=C4C8USy16mOE15C6B6l8NNPH4rFvZ9zjsz98egtyZt9M5c47/fDY1ulqgzM/Amw6n mDRnp+OgA9tZAjijpIaN4pOnIlvCy8ADT20PmkYQ5tYHStlSLas1xfHiGu5laj86R5 OWHNC5FvaLPrOG0R9kOOkKsGCkktwpCfBn2AwIKh+shHZdZQodxB/feox5zkkcKs31 HWy4Ce+66Iax4WTtMgPuHt0eJZJazKJOaPP4J/8qOxVWvTEb8aIb6TtjRpL5BJLeEn VXkaDQWVdCeQWmVJO/jtJYo+tcVTjdvPmPBse/JG5pHrCD+XROFjAvrpxQzn/hbeue DyYvgpKWrF4+g== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 03/12] perf jitdump: Validate code_size against total_size in code load Date: Mon, 31 Aug 2026 10:10:59 -0300 Message-ID: <20260831131110.4681-4-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo jit_repipe_code_load() reads code_size from the jitdump record and uses it to compute a pointer to the code blob: code =3D (unsigned long)jr + jr->load.p.total_size - csize; An oversized code_size underflows the pointer arithmetic, causing OOB reads into earlier heap memory. Validate that code_size fits within the record (total_size - sizeof(jr->load)) before the pointer computation. code_size is uint64_t but csize is int; values above INT_MAX wrap negative when narrowed into csize, which defeats the bounds check and sends the code pointer past the end of the record. Reject those too. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index dcb26d9c6c8fc551..14bd23c8d1963e92 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -9,6 +9,7 @@ #include #include #include +#include #include #include #include @@ -452,6 +453,16 @@ static int jit_repipe_code_load(struct jit_buf_desc *j= d, union jr_entry *jr) csize =3D jr->load.code_size; usize =3D jd->unwinding_mapped_size; addr =3D jr->load.code_addr; + + /* code blob lives at the end of the record, validate it fits */ + if (jr->load.p.total_size < sizeof(jr->load) || + jr->load.code_size > jr->load.p.total_size - sizeof(jr->load) || + jr->load.code_size > INT_MAX) { + pr_warning("jitdump: invalid code_size %" PRIu64 " (total_size=3D%u) in = code_load record\n", + (uint64_t)jr->load.code_size, jr->load.p.total_size); + return -1; + } + sym =3D (void *)((unsigned long)jr + sizeof(jr->load)); code =3D (unsigned long)jr + jr->load.p.total_size - csize; count =3D jr->load.code_index; --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A335541168C; Mon, 31 Aug 2026 13:11:41 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181903; cv=none; b=MMJFYTPeYLC68XoJKOtOs5OazJw7KqoMV3hjAHa9M3omZENZTnnRi9hFbTVMNDGmoPNMkD74S/VW+rfrnclHL/RmsRfUY9rErvdFCx0QQmhHM5a6HIR4TeO7jUIYRErbF/mB/KXNEHjz+stlm4Ibl00rxhbb4CxiscbDZ2Ol1NA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181903; c=relaxed/simple; bh=mQ9/gJJcQQov+Doh+sJfAXCLJ1leHtvJWreaTIrvAVI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=cOE7XRLPjPTNZLogT5R0levimS946rhTkyssd677Gd59lL9meTQT1dGR3KEoEDLUzQ+oaEAlxta1YpO/rfxowkCrtbtDAlxGbUa9n/1k6SY+35wnv8xDyUlasS4Mw6azFKEggP9AYDfBgbg1dSOTwoXfjfMNoAp7n8wMooYeyHg= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=c56civa9; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="c56civa9" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CDA161F000E9; Mon, 31 Aug 2026 13:11:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181901; bh=okQFdCODrC8WurKsSQVifgP3fXAC2pPoWES9ZUJp16I=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=c56civa9VmfMf3j9KdYiDzKEzAeiLk9Pr/V2nAGuGwZ2obAkJ+K2KYBjZ2gpCryCQ Dnb2euWBg6JlLLAnRoo9uNAT//pokxlaO2rRtwmB7GZFSkDoImx3ixHw5NcVMI2QTJ t/wKR8vfVkohi198uaC0JHZ/HsfqOlQQdqYyZ5wT2ns7hPKIrk8FD9DfBuDu+5kYRs 1dw4kG/cgckvnukoe33WDfPe83AH2f7GTf8TTel5L9EhkndlqR168RSnogM7XOLYBK Ok4kKPoYoqMa7ZKnfSzQU9oRd3LAqr0kJprwoeEa4dJ3Qw6P3OzErmJP97y9kN29n9 bmjrCtwfMLXrQ== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian , Stefano Sanfilippo Subject: [PATCH 04/12] perf jitdump: Prevent integer underflow in debug info size calculation Date: Mon, 31 Aug 2026 10:11:00 -0300 Message-ID: <20260831131110.4681-5-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo jit_repipe_debug_info() and jit_repipe_unwinding_info() compute payload sizes by subtracting the fixed header size from total_size: sz =3D jr->prefix.total_size - sizeof(jr->info); When total_size is smaller than the header struct (from a truncated or corrupted jitdump record), the subtraction underflows to a massive value, causing an oversized allocation followed by an OOB memcpy. Validate that total_size covers at least the fixed header before the subtraction in both functions. Fixes: 598b7c6919c7 ("perf jit: add source line info support") Fixes: 0284fecd13b6 ("perf jit: Add unwinding support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Cc: Stefano Sanfilippo Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 14bd23c8d1963e92..f79e9420c6bd7c51 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -671,6 +671,10 @@ static int jit_repipe_debug_info(struct jit_buf_desc *= jd, union jr_entry *jr) if (!(jd && jr)) return -1; =20 + /* total_size must cover at least the fixed header */ + if (jr->prefix.total_size < sizeof(jr->info)) + return -1; + sz =3D jr->prefix.total_size - sizeof(jr->info); data =3D malloc(sz); if (!data) @@ -699,6 +703,10 @@ jit_repipe_unwinding_info(struct jit_buf_desc *jd, uni= on jr_entry *jr) if (!(jd && jr)) return -1; =20 + /* total_size must cover at least the fixed header */ + if (jr->prefix.total_size < sizeof(jr->unwinding)) + return -1; + unwinding_data_size =3D jr->prefix.total_size - sizeof(jr->unwinding); unwinding_data =3D malloc(unwinding_data_size); if (!unwinding_data) --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7865D339370; Mon, 31 Aug 2026 13:11:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181908; cv=none; b=TF/DLsg5fXjvrt9vLP6AjWdvf0u7xeqDC6O9k7ljYJQNxSiVusK+wrGnA5Uq9485EgdHKlVVxUua8FkJcVYeatiEtWde3xw7X429D6zRGy4gSVg3G095xLbWC480MXRrgUcPEd10tPzMYNawY4/LDGQ8Q8K0X4iA6DWiiwMhRWI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181908; c=relaxed/simple; bh=sdX+RhPHHulfgf9z0zDxr74gwEi5MYaKk0IR2NseyjY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=uaMa2qs4ybcbX/LyMZnTphFIW+KZvfhyzZAojFB3eoBK+Ob60yb2lcQ9MrmsE8PZbrLjHZEShTGe2iTBhSQwLIMmYKV58aXMr4JW+cBV5Z+/E75/GcbeW9UkSwG/DVUKypG3ARFOqqWvb15DNhsBMb9A9oxYrfJGvgvnlMUWzPo= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=o10dGK1J; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="o10dGK1J" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 277DA1F00A3D; Mon, 31 Aug 2026 13:11:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181907; bh=sC1DzcEl5JUC81Rna7UIZVoV911LNTe5zyxc+uDQV74=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=o10dGK1Jagz+MAZP22Fxj50Agj4zMitLERwULOq+IFeo48NdaXUUCdrlKHFKqadz3 uy6H2pNbZcD03J+oFmIbbgw5doC8g6cgv9MISD9rXoph4A3tAdaLNqqwadDvzbGZyy NVJvQnr0mU/Rw+rxziHh4OosTatNgkSdKwMxSeKVFRyA8sEwRqCfvMnZlwqP4ACBwq gYovXoficfbkI+K8pURTCd0NG+MagbPyW+e+T2m0fHlGKl90QjVKlArklUyosPH9jr NoXsinBjhEaHucidC3J3aaLmBPvYtXSLS2BbKKGZr7ZOdWj/V5sVWhhgPsPdBVHJkD dz9VOSTRUdgwg== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 05/12] perf jitdump: Bounds-check debug entry byte-swap loop Date: Mon, 31 Aug 2026 10:11:01 -0300 Message-ID: <20260831131110.4681-6-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo The byte-swap loop for JIT_CODE_DEBUG_INFO uses array indexing (jr->info.entries[n]) to iterate debug entries. struct debug_entry has a flexible array member name[], so each entry has a different size. Array indexing computes offsets assuming fixed-size elements, landing inside variable-length name strings after the first entry and byte-swapping garbage. Additionally, nr_entry is read from untrusted jitdump input without validation against total_size, so a crafted value causes OOB reads. Replace the array indexing with debug_entry_next() pointer arithmetic (which correctly accounts for the variable-length name) and bounds-check each entry against the record's total_size before byte-swapping. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 26 ++++++++++++++++++++++---- 1 file changed, 22 insertions(+), 4 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index f79e9420c6bd7c51..7efbaa07f1ba73f9 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -320,14 +320,32 @@ jit_get_next_entry(struct jit_buf_desc *jd) switch(id) { case JIT_CODE_DEBUG_INFO: if (jd->needs_bswap) { + void *end =3D (void *)jr + jr->prefix.total_size; + struct debug_entry *ent; uint64_t n; + jr->info.code_addr =3D bswap_64(jr->info.code_addr); jr->info.nr_entry =3D bswap_64(jr->info.nr_entry); - for (n =3D 0 ; n < jr->info.nr_entry; n++) { - jr->info.entries[n].addr =3D bswap_64(jr->info.entries[n].addr); - jr->info.entries[n].lineno =3D bswap_32(jr->info.entries[n].lineno); - jr->info.entries[n].discrim =3D bswap_32(jr->info.entries[n].discrim); + + /* + * debug_entry has a variable-length name[], so array + * indexing would compute wrong offsets =E2=80=94 use + * debug_entry_next() and bounds-check each entry. + */ + ent =3D &jr->info.entries[0]; + for (n =3D 0; n < jr->info.nr_entry; n++) { + if ((void *)ent + sizeof(*ent) > end) + break; + /* name must be NUL-terminated within the record */ + if (!memchr(ent->name, '\0', (char *)end - ent->name)) + break; + ent->addr =3D bswap_64(ent->addr); + ent->lineno =3D bswap_32(ent->lineno); + ent->discrim =3D bswap_32(ent->discrim); + ent =3D debug_entry_next(ent); } + /* clamp so downstream consumers don't overrun */ + jr->info.nr_entry =3D n; } break; case JIT_CODE_UNWINDING_INFO: --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 416C4339370; Mon, 31 Aug 2026 13:11:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181912; cv=none; b=FFju0UtCOBEV69ziwDsebhU247ehp6lB2Xn29QDV5PmM9LRgQMdiDX+AzC5cwO6vfGWChE0a6b7WYTwJWcbjfKG7Vy7LrcTLMZxR55NAjWmGjEFuVMt0JUKCgcahRTEb4lBxQEhGTpNrwWL8db9EaDOl4YJNyCYBiEd+NcSWGhc= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181912; c=relaxed/simple; bh=lepJkGAKkM7AIII9AU/p8r/TUwoDgv+2MiJ6+tlPhow=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=rAc+2ciuYUGTcz5p6+e8j9lD9oXNcpGYIUN4sVJCAcfzDGKske46hVsIOJz2YrJJMxJQZ/83/y5X0Q5DdiCtZeAZVPHx/AL+ahG2qKUY2hS/IIQxTmSZRsVOG2+GgnA/Y0Irf0Ps3yniURrMYjdfBrFzhXR/vAFJi3uTz5s3Wfk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=KIerOJn0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="KIerOJn0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 947B01F000E9; Mon, 31 Aug 2026 13:11:47 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181911; bh=lgFhw2YoqLSIzK97jx3aEy4Y1T0tZe9CdtP0GzyctiQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=KIerOJn01Cot+ImpKh69NquO8tdgIp3oOyyREdHwD53aSuClFQg5IC6Avqfvbxwi+ 8bdTgsN15o2Sb/37zZZNAysa60E1nQMoYWXf2dCAZMDy89oyd5yZx7Ffc58mTNcjcL cMCN1m1b1Pkl1rTSkRz41RyRwKHDnrYRl4pG2bFgCvqo4eeT2ChEpBize90IiSu18t CO6bSj7UtLjUhM0bu2urFowRrF0+DgGzrLARHalJlh89pPALtxJVNhGwYaAvP+qR04 z9EnCanwFAIJ825AasgEZfDP1UKLgxtM68PYyiOeiPnyseD9C5X/H6Wx/98Hr0xtG6 Cu7dYS1uWYbmg== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 06/12] perf jitdump: Check snprintf return before computing header size Date: Mon, 31 Aug 2026 10:11:02 -0300 Message-ID: <20260831131110.4681-7-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo snprintf() returns the would-have-been length on truncation. When the jitted filename exceeds PATH_MAX, the unclamped 'size' value inflates sizeof(event->mmap2.filename) - size into a massive underflow, causing the header.size computation to write an oversized header. The subsequent write to 'id =3D event + header.size - idr_size' then corrupts the heap. Clamp size to PATH_MAX - 1 after snprintf in both jit_repipe_code_load() and jit_repipe_code_move(). Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 7efbaa07f1ba73f9..45f0e21b0e780cb6 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -495,6 +495,9 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd= , union jr_entry *jr) jd->dir, nspid, count); + /* snprintf returns would-be length on truncation, clamp to buffer */ + if (size >=3D sizeof(event->mmap2.filename)) + size =3D sizeof(event->mmap2.filename) - 1; =20 size++; /* for \0 */ =20 @@ -625,6 +628,9 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd= , union jr_entry *jr) jd->dir, nspid, jr->move.code_index); + /* snprintf returns would-be length on truncation, clamp to buffer */ + if (size >=3D sizeof(event->mmap2.filename)) + size =3D sizeof(event->mmap2.filename) - 1; =20 size++; /* for \0 */ =20 --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B5DE933987E; Mon, 31 Aug 2026 13:11:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181916; cv=none; b=LdDC+AMD8K6/WI83iG1kgMZBGzflWWUWI4FZo9vCaB6F7olRvaTHoHyZvn+Ikm055sy3S+JNokjvJZqHpTqa1jFpfkOf0iRurqsQGe6ce6e56O40q/qeUG6u4/EVDl6fnrueFeng19MoeePOWiztasVu9fRE0z8cYgU3OPtp6ZE= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181916; c=relaxed/simple; bh=f+dIgZvTJAI+DW2DcuXBuQJqX95T1WBuYORqoWZy2HI=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DkjHR+UHURX0phxv2lzfEaxVGbkvjye95834xNbq0BMTwRQuXOs1FlvZA4ZlBBg54s4lU5QxGx8DEvah6OSnnLN7p4VYwlau28p/j7jj2EWv8ftwluHTTD783tn/x4BEdLOoCIKIfS4oLgTbuuICUy9ANuDVexcdoRN2XUvCz4o= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=Xe//guqN; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="Xe//guqN" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8E2761F00A3D; Mon, 31 Aug 2026 13:11:51 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181915; bh=aCPqOgghbr9UQeN7pOVRlMO6+bGSdt8wqV7LX59H+ug=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Xe//guqN6YzhifgQpSlPSVnXvI4Ra9dSgzioZKJiIJe4TMRTDjgAAoP7oXeqDsysK 6h3rPUTtVfHg60wE6olvtGK5r0gG01RIKntypj2bI1eLO34FD3VM+Q0cwOdzt/ZYSh 5j5ZHwz9CcFUwqg2RxEwIhYx7Ye4Aq1WSLc6SotYd2jZJSnS9Q2hGfo+t2VoDAnsAp s+vmlAdKfL36IwTYXH9dYmJVzU9la5a3aZWbI2MlXPE4zjeCvWd0nugVqWAwNILbP/ 2cL/uJVwe+jo/4z3Mnde5mhW5Gh9wWTYmjQLNSXpK3/msECfboz1bP8ovteOhKdSFc n6G8yXP1Sv3Pw== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 07/12] perf jitdump: Fix funlockfile on unlocked stream in jit_open() error path Date: Mon, 31 Aug 2026 10:11:03 -0300 Message-ID: <20260831131110.4681-8-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo If the malloc() for the initial read buffer fails, jit_open() jumps to the error label which calls funlockfile(jd->in). However, flockfile() is called later in the function, so at this point the stream was never locked. Calling funlockfile() on an unlocked stream is undefined behavior per POSIX. Split the error path into two labels: 'error' (after flockfile) calls funlockfile before cleanup, 'error_noflock' (before flockfile) skips the unlock. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 45f0e21b0e780cb6..ae63366b86c6d765 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -157,7 +157,7 @@ jit_open(struct jit_buf_desc *jd, const char *name) =20 buf =3D malloc(bsz); if (!buf) - goto error; + goto error_noflock; =20 /* * protect from writer modifying the file while we are reading it @@ -246,8 +246,9 @@ jit_open(struct jit_buf_desc *jd, const char *name) =20 return 0; error: - free(buf); funlockfile(jd->in); +error_noflock: + free(buf); fclose(jd->in); return retval; } --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2593A415B69; Mon, 31 Aug 2026 13:11:59 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181922; cv=none; b=Vpx+3tQG2C9eNIYgd2Hyw/Sz/sPM+0sCFwvdK5AFPfvBF4jFXkRTC7LiCRQirNWjjoj7C0Q+HjmHB+ZPbaaHQjtaH7cn2K+kG2anrpdBszFETr77ZgJKWuma0lbVy/67bMM2dGV5O8CHc0Z9CstbKPR1HWyUixqjOSTuUWa7Ho0= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181922; c=relaxed/simple; bh=/5KYpRSZZ4A+FSoqKWdzZPBZ4E8KAHVb+7eP8Tf4kGY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ZEMi8d+488pFQDczat2iM+y2lycJfhv4eUAFImFe47qDxmhEE65aV8BrN3OlGTb7NpaGQuAufoMB5QUm5FYmQc7PHd9uncDadx8Le37Cm+dHx51RqcdJ6EwrcuyiP+YtwydeiQop0/ZXy9XGLf7sdvX2Auu28V6rZPzwETf92dE= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=d3xmVjdj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="d3xmVjdj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 2E6EA1F000E9; Mon, 31 Aug 2026 13:11:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181919; bh=zGvOqI1F59B/NBqV9bnLiOrTFhUb5hngXw19hg9wrKs=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=d3xmVjdjUVA7H0mxk+W62zv9dNFDF9fKuLmpLSsBHyLPF7/Ms6T/QOdk9tJ9X3w3b TmNGGrI21cXowAAQ31rtpTh6rEHgoQVVm5dOcaaTt7H40p41n1IT/1o/ds9ep2g+3l 6kJQBUVGYRFlSWCYxd/befeO0a7NGOCX3BFwfFV4HpQ2oT03EpcsqXZIk/lyTdwo+Z PPmborqsE+qu/JU90fFBDJlswhgJF1ZLi9u3+WDUkga5YkzjcrVkYjhA7SiW6ua1VQ pOjECtwEnkbVP/jI+La4UaoVz4vkyaerM5paPgR3K36rTF1spErsTsbgwlALiqd+kW lPO17L6Yvhtow== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 08/12] perf jitdump: Free event in jit_repipe_code_move() Date: Mon, 31 Aug 2026 10:11:04 -0300 Message-ID: <20260831131110.4681-9-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_repipe_code_move() allocates a perf_event with calloc but never frees it =E2=80=94 the 'out' label exits with only perf_sample__exit(). The sibling function jit_repipe_code_load() correctly calls free(event) at its out label. Add the same free(event) to jit_repipe_code_move(). Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 1 + 1 file changed, 1 insertion(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index ae63366b86c6d765..91aa1eea8229faac 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -685,6 +685,7 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd= , union jr_entry *jr) build_id__mark_dso_hit(tool, event, &sample, jd->machine); out: perf_sample__exit(&sample); + free(event); return ret; } =20 --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97660415B9C; Mon, 31 Aug 2026 13:12:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181925; cv=none; b=pjz8AOlB1jvfSQBWaICKVnrLqEDwS/qPMRnJfSi0hl9iiG8f3Kb/dtHepJUNdJ6ZEkz6DlcXqy5+lONcr5/MhIRtv72d9rz2WFZqFaYhFZPaKA4bkTuibMuOBqSLi1tL1fi2DwldJGBDF4NV9xMvitG6W3UohkXP3qxZyty2wgs= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181925; c=relaxed/simple; bh=n5JyfkLUI1umoPs3xeGc8sxlvVNnXZtD11X4RcZpEKo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=ndcrRY5JNzq3ZNEqCRJbQsG/PBINnLykB8UNzuBQOqMBgem5PViivveIKwCb2Pbywb8L96QVQbVcqSxksNBrnTERU0MvAnN83Q4vSEL53PWFCQADbd4cv5qrWFSY7HaR/kUL05l65b+I0rCBUREQSB25v00RwgCloETu/doNL1g= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=mOhtdU3Z; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="mOhtdU3Z" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 70DF91F00A3D; Mon, 31 Aug 2026 13:12:00 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181924; bh=7BJ4IbMFemaIyg3qYdYweZLVLYXJyCfnE4LQTgJgD/8=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=mOhtdU3ZGOvfzjADHFAgd7loMU0kbzq1mizMO/w0bwxASPoNg2TqCwWbDlKWyvVHI UazzUtlvxmGfQrYngOhiZ9EaDiPWNtWwBfYa91Bg6qV9ly3ptZRxxblMxtp8sgd+q1 a1Uw+dVegNdnK4Teeotaexqufh9QiJBqcw7Ay/beGgQXVA2Ac6J+ejuY4eO3lkWUvF 8m4SSHFCFn4jf/R7FQ5hgUR90AFWez43Y8R0nMdDMVVxhm0gxcdOS2DxiGqKAdcwW2 6OLRt/4kaOWE4eU22NIH4kLz9XDK0h139AA8wYCYLD0Zn419FeyLBwpo5XdKLfhW9s 3+Fu3e/pRM7sA== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 09/12] perf jitdump: Use dirname() return value in jit_open() Date: Mon, 31 Aug 2026 10:11:05 -0300 Message-ID: <20260831131110.4681-10-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_open() calls dirname(jd->dir) but ignores the return value. POSIX says dirname() may return a pointer to internal static storage =E2=80=94 gl= ibc does this when the path has no '/', returning "." from a static buffer and leaving jd->dir unchanged with the original filename. Capture the return value and copy it back to jd->dir when dirname() returns a different pointer. Fixes: 9b07e27f88b9 ("perf inject: Add jitdump mmap injection support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 91aa1eea8229faac..d3de307532d55065 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -146,6 +146,7 @@ jit_open(struct jit_buf_desc *jd, const char *name) ssize_t bs, bsz =3D 0; void *n, *buf =3D NULL; int ret, retval =3D -1; + char *dname; =20 nsinfo__mountns_enter(jd->nsi, &nsc); jd->in =3D fopen(name, "r"); @@ -241,7 +242,9 @@ jit_open(struct jit_buf_desc *jd, const char *name) */ strncpy(jd->dir, name, PATH_MAX - 1); jd->dir[PATH_MAX - 1] =3D '\0'; - dirname(jd->dir); + dname =3D dirname(jd->dir); + if (dname !=3D jd->dir) + strlcpy(jd->dir, dname, sizeof(jd->dir)); free(buf); =20 return 0; --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BA64D3B38AE; Mon, 31 Aug 2026 13:12:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181929; cv=none; b=NR214SSjMTFFKbT7Bq4DoAR9iyyCK5o2wIj1NnFvBgD5z332/gKZWzwKMfiv26erUpZayYmw4+CYdd8lDJReRBL7wPFMzaaHriP96WamAkB5hTF/VfAa9fc4uKfLqB2+gt4gdntMqRh5/9Bf1hPwnZSmIYtSfWqNzhJ91y4S99I= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181929; c=relaxed/simple; bh=RIXWK5Xpq0hJvX+WdUlbqftFt9dH/fDLM1WdS9XQQwQ=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=dY7hAb/FJZkc0yWxn1GqOQohcPeRbe8WbxFBFBS5OaNxxUtemYQ19EYvNzG4+/WW8S5l71eAPtqlQB3j4HWyMzCQp+N8DC+DcDHovcrLDcAlwem35IO9TyLdWVCBTTunOkpV8ok8V8WTrXuBoIMMZ8OmwlLjmYXOdw5uanHfg7s= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=CTJVfQcK; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="CTJVfQcK" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E7F941F000E9; Mon, 31 Aug 2026 13:12:04 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181928; bh=juj34A/JJwl6fZUb9XHua0ZaT+7EiiUokYzKnpwu/Jw=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=CTJVfQcKdauO8dnbl9cBsB1/cNAL9eCRYtsQUejZGj4ssYr+o8jzhjZXgZ04C3n5S pY667X38TapWKlBXe9WXJf1cHr889XWIQpu2g7SrLxytB005vGZuI2ytNLceDRwiaJ mrL9Wvb7evUpiWJDGlxRNPQrJQ1QfVOoN8vUFQin8heqndrQH/pgsUGi+KUY1P6pls gAAdcfy6t6ywi+dQ4JbXgsyC5pCXnDqSnKJewnvvLJX6AWTBVBdoSd/UzroxMs5lh0 qEPOnhFzTgulN3SPzSchwy+r+aHUuiCCJJCiO2rlWoxGEULQbigofHRPG8Hkn7+GSg 9z8VoiZzNFCxQ== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 10/12] perf jitdump: Validate debug entries on native (non-swap) path Date: Mon, 31 Aug 2026 10:11:06 -0300 Message-ID: <20260831131110.4681-11-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo The bounds-checking and nr_entry clamping added for the byte-swap path only runs when jd->needs_bswap is true. On native-endian files, nr_entry passes through unvalidated to jit_repipe_debug_info(), which stores it as jd->nr_debug_entries. Downstream, jit_process_debug_info() in genelf_debug.c iterates nr_debug_entries times via debug_entry_next(), which calls strlen() on each entry's name field =E2=80=94 a crafted nr_entry causes OOB reads and writes. Add bounds-checked iteration in jit_repipe_debug_info() that validates each debug_entry fits in the payload and its name is NUL-terminated before calling debug_entry_next(). Clamp nr_debug_entries to the count of valid entries. Fixes: 598b7c6919c7bbcc ("perf jit: add source line info support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 27 ++++++++++++++++++++++----- 1 file changed, 22 insertions(+), 5 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index d3de307532d55065..5a3ea2681fb37105 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -694,8 +694,10 @@ static int jit_repipe_code_move(struct jit_buf_desc *j= d, union jr_entry *jr) =20 static int jit_repipe_debug_info(struct jit_buf_desc *jd, union jr_entry *= jr) { - void *data; - size_t sz; + struct debug_entry *ent; + void *data, *end; + size_t sz, valid; + uint64_t i; =20 if (!(jd && jr)) return -1; @@ -715,10 +717,25 @@ static int jit_repipe_debug_info(struct jit_buf_desc = *jd, union jr_entry *jr) jd->debug_data =3D data; =20 /* - * we must use nr_entry instead of size here because - * we cannot distinguish actual entry from padding otherwise + * Clamp nr_debug_entries to entries that actually fit in the + * payload. The byte-swap path already does this for cross-endian + * files; validate on the native path too, since downstream + * jit_process_debug_info() iterates via debug_entry_next() which + * calls strlen() on each entry's name field. */ - jd->nr_debug_entries =3D jr->info.nr_entry; + end =3D data + sz; + ent =3D data; + valid =3D 0; + for (i =3D 0; i < jr->info.nr_entry; i++) { + if ((void *)ent + sizeof(*ent) > end) + break; + /* name must be NUL-terminated within the payload */ + if (!memchr(ent->name, '\0', (char *)end - ent->name)) + break; + ent =3D debug_entry_next(ent); + valid++; + } + jd->nr_debug_entries =3D valid; =20 return 0; } --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BAB334F24E; Mon, 31 Aug 2026 13:12:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181934; cv=none; b=cSGl8T1rD0ck+DzzoT0eJpnuZAvHBr+a9RIFErzuRvpOVjYbc2ZipNU06zm4gkDfvawCIVQfKVDqL5664qsEC3UzY15KHXNxZ7B5S+ZzbvMynmzk1/8jKDUnX07mTYUorNzZsmfGhsGUVEWMYAhbW1nwB4bPwN1so4fMkccffUg= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181934; c=relaxed/simple; bh=xl/07EV2vtr5hM95uAerTBPQFFkjji/5/upijS/97rc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=AQeNhbgOX0ADhrhe8601GhRPQTeilQ38JUHXKKV1rfNWyKXd/95npd/v+wlstWa7xntevQuCdMkzWfPs/gLM1nx5/hPlt3e5/wgjiAwCU5OiMz3uDe2qd2/VtcHX6+qPZOsNIpNmwIXdBH+M9oNzgZPWPmpUrHyfvSvqCY+NtlQ= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=L3woriln; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="L3woriln" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 058091F00A3D; Mon, 31 Aug 2026 13:12:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181933; bh=nhhOI5XjtPiaW/+0O6x/xQeN6xRlHOVXxDTNBWxUzIg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=L3worilnEbQmM8xMt6Xlx1enMnUvpJxfF5V6opr7c+oY5FAfIxWAuaZcvrqUhfVoz OnCcguMefqiGzJ4woqrYbFlHVsjjjzYGfmEphKFJn6juM5po+Dy+G27qvp2zSxUi7g ySrSbFZQlmSdj6G+EPlk6hEyRC2xkR2aHSS9RyZ40j71ZCpaH+Gn98kY0zZPneEGfV AnE7TpMVrgxU35+avUnlqbgDAmVht6jIwNHtnydqfTS9iZvdorUeLGBW+MwLd/AsE8 lJEgYMJPLhrg6URKU80jEQNUqWJ6f1Y149zz71Ab/bI80fqD6Ha8Isl07srvZH8BFu unstj44a9XpSg== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stephane Eranian Subject: [PATCH 11/12] perf jitdump: Validate sym string NUL-termination in code load Date: Mon, 31 Aug 2026 10:11:07 -0300 Message-ID: <20260831131110.4681-12-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" From: Arnaldo Carvalho de Melo jit_repipe_code_load() computes sym =3D (void *)jr + sizeof(jr->load) and passes it to jit_emit_elf() which calls strlen(sym) via jit_write_elf(). If code_size equals total_size - sizeof(jr->load), the sym pointer aliases the code blob with no NUL terminator, and strlen() scans past the buffer into adjacent heap memory. Add a memchr() check to verify the symbol name is NUL-terminated within the region between the load header and the code blob before use. Fixes: 598b7c6919c7bbcc ("perf jit: add source line info support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 5a3ea2681fb37105..5898a7d8eb962daf 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -487,6 +487,13 @@ static int jit_repipe_code_load(struct jit_buf_desc *j= d, union jr_entry *jr) =20 sym =3D (void *)((unsigned long)jr + sizeof(jr->load)); code =3D (unsigned long)jr + jr->load.p.total_size - csize; + + /* sym string lives between the load header and the code blob */ + if (!memchr(sym, '\0', code - (unsigned long)sym)) { + pr_warning("jitdump: unterminated symbol name in code_load record\n"); + return -1; + } + count =3D jr->load.code_index; idr_size =3D jd->machine->id_hdr_size; =20 --=20 2.55.0 From nobody Sat Sep 26 18:52:56 2026 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id C040A33555F; Mon, 31 Aug 2026 13:12:17 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181939; cv=none; b=l2ytN9IA8i1fB6/FcsGFAtJY6cQPUDN60bVSDUdz0Le9hKhg+h+xZ4/+wBgvox0kNDkPPDyzo1EqQKm+PMSk4nOZIHyCmqXTNp8jU3tQNnctusN6l7OI3RG+YYIm0zNVi1bBwq003dlgCDN9mZyrwB2qVqbBNvPwVig2z7sKppM= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788181939; c=relaxed/simple; bh=llpKev1Dqpe/1whA3ARXQ6reef6QrsLI9C4i/S64uUs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=nm9XzosA44BjAQc1lyyTRXWql8bf9OAi3VTqcs+iWVYwHxX2qB9m7skOWmxnLihGnUBtEcc+Qww9qAN4hSKuJPWUqZllBflto5+X69ftycqIbasyc1DPrcoiR1/t9q+X6OcK+AclmVQi5Odja03PTyMZXsziawvkPNNqR+nrxew= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=e386AWlG; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="e386AWlG" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9BEFE1F000E9; Mon, 31 Aug 2026 13:12:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1788181937; bh=32gxnMYpqc7W+ADUc7K9SwH9dlBo/g3B6bHhsMGOTRg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=e386AWlGFqlpFPVOrqkHItqTpYwoYd6loFs5Olw4ALTUUQIqklFLaoFSCy5O3p9ed /daFNZP2CQq2HOxiHROiNZEHfNV00ozfIJjtJXsUneaO9olpes4qnlNcxQkAokIYxx YQktZ7ZI0/WWVG/FTeAHEmuUquM9AtQj4hQybc2qBFLTuIxEVu8W+WNudo1THRb0qH Hxei6wqD0fOa6unfZ5gZcQrN5dDk1dEMVkwKot0Sv2oRBeza8W7wyZg2zQSkydpUVk jbU03zaeIDo9Zxx1X/ejO/rCa2/tdOCaigdPuiPpUZO6qc66Ga+VYORhYfDBvlmLv3 4eUyHfW3N4tJw== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , Stefano Sanfilippo , Stephane Eranian Subject: [PATCH 12/12] perf jitdump: Validate unwinding sizes against record payload Date: Mon, 31 Aug 2026 10:11:08 -0300 Message-ID: <20260831131110.4681-13-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260831131110.4681-1-acme@kernel.org> References: <20260831131110.4681-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable From: Arnaldo Carvalho de Melo jit_repipe_unwinding_info() copies unwinding_size and eh_frame_hdr_size from the jitdump record into jd-> fields without checking them against the actual payload size. Downstream, jit_add_eh_frame_info() in genelf.c computes unwinding_table_size =3D unwinding_size - eh_frame_hdr_size, which underflows when eh_frame_hdr_size > unwinding_size. The result is passed as d->d_size to libelf, causing an OOB heap read into the output ELF file. Validate that unwinding_size fits within the record payload and that eh_frame_hdr_size does not exceed unwinding_size before allocating or storing the values, so a bogus record cannot force a large allocation that is then discarded. mapped_size is likewise taken from the record and was narrowed into an int for the mmap2 len computation in jit_repipe_code_load() and jit_repipe_code_move(); values above INT_MAX would turn negative, producing a wrong mmap2 length. Use uint64_t for usize so the value cannot truncate. Fixes: 0284fecd13b6db3e ("perf jit: Add unwinding support") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Stefano Sanfilippo Cc: Stephane Eranian Assisted-by: LLM Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/jitdump.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/tools/perf/util/jitdump.c b/tools/perf/util/jitdump.c index 5898a7d8eb962daf..d25a9fe9b020ce87 100644 --- a/tools/perf/util/jitdump.c +++ b/tools/perf/util/jitdump.c @@ -462,7 +462,8 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd= , union jr_entry *jr) u16 idr_size; const char *sym; uint64_t count; - int ret, csize, usize; + int ret, csize; + uint64_t usize; pid_t nspid, pid, tid; struct { u32 pid, tid; @@ -543,7 +544,7 @@ static int jit_repipe_code_load(struct jit_buf_desc *jd= , union jr_entry *jr) =20 event->mmap2.pgoff =3D GEN_ELF_TEXT_OFFSET; event->mmap2.start =3D addr; - event->mmap2.len =3D usize ? ALIGN_8(csize) + usize : csize; + event->mmap2.len =3D usize ? ALIGN_8((uint64_t)csize) + usize : (uint64= _t)csize; event->mmap2.pid =3D pid; event->mmap2.tid =3D tid; event->mmap2.ino =3D st.st_ino; @@ -612,7 +613,7 @@ static int jit_repipe_code_move(struct jit_buf_desc *jd= , union jr_entry *jr) char *filename; size_t size; struct stat st; - int usize; + uint64_t usize; u16 idr_size; int ret; pid_t nspid, pid, tid; @@ -761,6 +762,18 @@ jit_repipe_unwinding_info(struct jit_buf_desc *jd, uni= on jr_entry *jr) return -1; =20 unwinding_data_size =3D jr->prefix.total_size - sizeof(jr->unwinding); + + /* + * Validate sizes before allocating =E2=80=94 jit_add_eh_frame_info() + * computes unwinding_size - eh_frame_hdr_size and uses the + * result as a buffer length for libelf. + */ + if (jr->unwinding.unwinding_size > unwinding_data_size || + jr->unwinding.eh_frame_hdr_size > jr->unwinding.unwinding_size) { + pr_warning("jitdump: invalid unwinding sizes in unwinding_info record\n"= ); + return -1; + } + unwinding_data =3D malloc(unwinding_data_size); if (!unwinding_data) return -1; --=20 2.55.0