From nobody Sat Sep 26 01:03:41 2026 Received: from LO2P265CU024.outbound.protection.outlook.com (mail-uksouthazon11021083.outbound.protection.outlook.com [52.101.95.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4D13A2E2DDD; Mon, 7 Sep 2026 01:51:51 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.95.83 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745912; cv=fail; b=erQcJ04StZI70WYJePy9v9JNAW/McggSx79Ok30ywfghDMsg9aT+MTDLs5ec0wC4GNQvI1j5W59SwUtpK+UzAqlgLAGufWqUxITXsZaiCj6AkKrDBUCdN+uEYxgpGBKZmjTfzZnCc0da7Wwo1lRT0VYRs3kR+7QFNMJLZ//eGb0= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745912; c=relaxed/simple; bh=ZpnpghZ0z524mR0DKZs2zFnsVNI0s4Sm6Xpdy7qOwao=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=RND4NVYYHkUoAc8hey8KHsnWTwmFRyQxrcKlSsFjYfWZA/3nz1wcw+eBgiym0faZCms4K4M1XI6pyq/4i5H/AY8Z8P91i+TFA42u2FG2sOw1W1D2BJPvVj6SvCpQlWTKzfvzH+RY8I4xgipxNr1SvA+j/i1Eg/nbkG/OD3BalV0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.95.83 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=PT0xClBoAXRh+qdxddYlb4g0xAk09lyr/0O/OAB1ICXuIDxNWC3SNVKshXNIMLznF/OSYO650vbDKZw5fUp1i7RfCKcYRTRGTd5KN0wpg059zRfkUjpBri4VNKtM4tgHpeI8CWv/dnzfbgZrcYzFTpL3ERB9hRrqgTE0AZKzvqwme3U3dBGzvq7ycV4IfpamNgUx2T+atWgNzsGwQcQeJN/O3ZqQOuiM5fEE9A3h1IYkOcPkv4/UeR+VRKzyWe/+5xjcdEUMAo9dhgrZ+OLNDiNutOp6CTEUw5Kbyozkh20/QSHbFitke82BqpHG2tf1Y3CzkHdBHxvHE0N844V6Sw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=u8N9PIlQkD1JtlRBzMDFvp9S8jRdFuxaB5wRbbyP+yI=; b=gcS1OnwIZHkM81wSUupOyOMeRNxB1AMIVaCjiSf5VAMWNAVhIouy41/E8mf+oXfxcUuVs3KtUyTn4mVXUIcBZRe8oxBwy6gvYBG7+7Z9gM5IKNiDl4VvlTxPYb+viKwTdo2/Yei5tIH6gfKlGB7AECrNZUgvxfao8aLqXdNuQDBf9Vj3RDyei4lpVbaf3zZTzqStq7ljF99+NLIUnBrQmh3YpBBANK/ekHiuZUXu36sI7E732f1uhXYEcQNelzmR6Pd+ykODsDj4KUQCGUj6S0fzZYuoSodJaqPAKDhWiHG62szOaUNG8I5Lf2HlUtlR/nds1buJ+uJOtRiZqGq5/w== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by LO0P123MB7403.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:335::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 01:51:48 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 01:51:48 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 perf-tools-next 1/6] perf trace: Add upper bound checks for augmented BTF struct printing Date: Sun, 6 Sep 2026 21:51:35 -0400 Message-ID: <20260907015140.363076-2-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260907015140.363076-1-atomlin@atomlin.com> References: <20260907015140.363076-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0736.namprd03.prod.outlook.com (2603:10b6:408:110::21) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|LO0P123MB7403:EE_ X-MS-Office365-Filtering-Correlation-Id: 6985aac2-d75c-48c2-12af-08df0c82941a X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|366016|1800799024|376014|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: PQpqg3jln+R0uDOSRyVnUX3bJRuKrsL+138B9pjyZN0cnFMyj3IVb+WKNd5f9Y0eYJgNZ4t5DMAzr41COqIb+hWvp7gFxR5HZHIkZgvkCvzLMBv0KiPoJbqVzjbhSQJ/G1L3F9RDl5r61jplfIGcfVrQP6wadxltWrLEdf8juI58pAWRdb2ts3SNmC/f45duqUJ6Cg60ml5VZbRanzCOXFXV98aLHLB1wcgSREUQKD2+AUDpy79kG6cC7+esslHeKhEccTZhDeqjEYk4unb9dh7NBgnASld7+tZwBof7qU8bjNJH523Mzzv1U37KSsjrTRuconr8jFMgqfgvJxZVFCwv5r5ds3Irp4X0XY7LMQfd5yctO22vuQQg7zdySGwNm3oDm4VM6csw5DISllZ87JuMXC1ni17ztxUcJm8xSwPLKZJKhPObm+T46wUMIzrbcBpxWyW8BKrmnBxUImtvU7gz6hONNqJnqxrUGn2M8a94o8xmVzxbenooE6EK5tBZ2lEMFAX/kyhyouj5r46gnybifRO0c+746j9H0V6TMInbRLH5l6mznuvTQ/kxSBH8mQLpFPBDjm3+Gv+/Zze1G2rNXXfO2Jf/dU7uLVPZwrbNor7H7LoNLgo8sF69uqUEZ6CDjpJekGg4nmmDFUzWm2V8zfSr4RcAkxHaevBLvss= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(366016)(1800799024)(376014)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+GJfCGSY/YSiJVy8Tr3AAQjomZsOiFOgsGGmlOLiqtoZ7Z6RQfwM7TOriQ03?= =?us-ascii?Q?rNgg8TrGg7h9JOChV6+PsVCxshLxRHB9DZn/lPiB0Jx3iuRdxmW9q+JWMB3O?= =?us-ascii?Q?Uk1pbyMtRdYCLixtj/timMm0zMR9u2Z3v7F6t3/PH+U+jsdm3VRObP1OaeXh?= =?us-ascii?Q?dhpzcLmyC/Fi1rQWfqBlLfIuTvmcGpfc60rA/Co2Qcp8HUMFgJkvEAgD5/nE?= =?us-ascii?Q?V7qlFriNbai7sYOKeY06h+hCDbF7ufxsYDT4/DsH7IBUcMcictx63byHCs23?= =?us-ascii?Q?kTzEhMMyWqg6uOkvtvt9q2pP43GF09utjkdHUGAdeNYdJCPec6NkGUQcMguw?= =?us-ascii?Q?jXuSShiOr0YH0mwoGkUuLNRKzAkxSjBbySsjjRyICud3IEfddeAhmxQe9nuA?= =?us-ascii?Q?sUvNMrkDA/0vyX5C6fRN4USTQWu0eYngX6NADcUXeE1RwuuiymdhxM/tPxqm?= =?us-ascii?Q?bBUiybvOlnaGo38dRE5SI37rATIsgcjSUdBtBTR2j+hSRcgUoKrgCWybixCr?= =?us-ascii?Q?MiZUBfPM+CEcbcjDQi/iLFXBVlsVK6QMMVB3zci1txZizBUxejfUYTxQz2iK?= =?us-ascii?Q?gXlHyrcNjWlugIe2yy1mFybYdiim/fHlwmsbaHhhERcxl0ls9wiVrGpmmZQ9?= =?us-ascii?Q?4JG9U7puPIzca7wb2eDzds/yIkGxKDMfwq5n8Z7Rj5y4sBCgTYP12mmrlBpG?= =?us-ascii?Q?xY9pl8HvB+VbE96SEi2ZL258XW0/sOflvInTAUDZA5UigSZJzVtt4hDwFDKM?= =?us-ascii?Q?1wKeEvKRgteXOfV3RNaobdiII6/q+qHLN4wr87WAOTcdV4KjWDR0h4RObmx7?= =?us-ascii?Q?jT0qX6isD4o9mO2ti34VybJoEcMfaHApMNpEJA4jtlcGwFh9zSeRqQtcQF4h?= =?us-ascii?Q?9fKQbAgj7WI7pvL1LOcZZL6XvIu2Pgl9cIevRUb/76j/+qvLByi7DLwOILUr?= =?us-ascii?Q?du7yeMT2NYtgByEHZ1/Rrkcs4bsv+jfk6ASsG6uHZfSSgkFB8cEQdTJsHfwy?= =?us-ascii?Q?C8FBMrJ4yaR0CtIazzDFVics3ptE3oYGF+LVS7XVEjTfsogu1mn9IQfVskMP?= =?us-ascii?Q?spAGWNMNZWZtdfFlhAF3yrqTEUfGTfY0Yl08IN4x5v6q6BqNh2HNHFshz0J5?= =?us-ascii?Q?7b6n0ohMK8BiTeCs5XxI6GJOHl+uo/PfX9aA3ZnTmtvtDTIKlTgM+K3IH9jN?= =?us-ascii?Q?0w55EEwa2kdSazEjigCavD9vNBRi2rJzuSwvnMHrL+Ep4r3kh4RpTfta/CKZ?= =?us-ascii?Q?RG/uDpfyzLHI5pA1c09GqJoAO/vznJtY+AIAqPViA/KfJcZZZ3HLjo2wv38e?= =?us-ascii?Q?M+mtLH7rMsVDsXPneguDmZKOQcR0LAdRlgC4I+lWEklu8Kz4h5tW/ThdLiNV?= =?us-ascii?Q?PEqQIOx8Ik2uo30AfrJ8nJRa23528pZy4UGCTcyATT4Kzr3qi/n3lkdlRn9h?= =?us-ascii?Q?e95AvIz5nE9WxPUPOlHGVAxjpBlM+tmxJ/3Q5xSoyaaItVEp9c+Vzoyx6IuR?= =?us-ascii?Q?BkMAqtNUV6L9aUASmcmjCLP2OQt2Jes6NGx9qtGhdskW1cajOjH85czgwqdJ?= =?us-ascii?Q?HzFZZaJ+IUnR7meEuyxRvDqzOkSVR2F+12q47sfnyS8jk77LhUdH1JueByqE?= =?us-ascii?Q?JpBvK3THieN7sjc8Q0iihXFgx376z2xJSUbsvQsILALjhyof4RLIdt1/+91V?= =?us-ascii?Q?kfc8PLdeqLMGYE54eKCbDNqrf+xDndft3lTACjF4c1qPchLo6BebAzvaCIEa?= =?us-ascii?Q?t8Mx3jp8Mg=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6985aac2-d75c-48c2-12af-08df0c82941a X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 01:51:48.0956 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: zUoelcRJ/9t6mhwVmZUDhttgX23JZgrPRF8VFI769rh3h6Qtd6HqFjGW0pto9iYY9xyEdzAbycPtHcDFSnDZYg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB7403 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented struct payloads using BTF via btf_struct_scnprintf(), augmented_arg->size is currently only validated against values <=3D 0. However, several edge cases can result in size mismatches or buffer over-reads: 1. If arg->augmented.size is smaller than sizeof(*augmented_arg), dereferencing augmented_arg->size reads past the available buffer. 2. If augmented_arg->size exceeds arg->augmented.size - sizeof(*augmented_arg), calculating consumed =3D sizeof(*augmented_arg) + augmented_arg->size can overflow signed integer limits (e.g., with crafted INT_MAX values in an untrusted perf.data file) or cause arg->augmented.size to underflow. This advances arg->augmented.args out of bounds, corrupting the parsing state for subsequent arguments in multi-argument syscalls. 3. If the captured payload is truncated (e.g., short reads in BPF, or during cross-architecture analysis such as replaying a 32-bit perf.data on a 64-bit host where host BTF type->size exceeds the 32-bit target payload), passing type->size to btf_dump__dump_type_data() causes libbpf to read past the end of the payload buffer. Enforce an upper bound on augmented_arg->size against the remaining buffer (arg->augmented.size - sizeof(*augmented_arg)) and verify that the captured payload contains at least type->size bytes before passing it to btf_dump__dump_type_data(). Fixes: cb32035214b9 ("perf trace: Pretty print struct data") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/builtin-trace.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c index be19d70eba09..20fffc24507b 100644 --- a/tools/perf/builtin-trace.c +++ b/tools/perf/builtin-trace.c @@ -1133,12 +1133,13 @@ static size_t btf_struct_scnprintf(const struct btf= _type *type, struct btf *btf, LIBBPF_OPTS(btf_dump_opts, dump_opts); LIBBPF_OPTS(btf_dump_type_data_opts, dump_data_opts); =20 - if (arg =3D=3D NULL || arg->augmented.args =3D=3D NULL || arg->augmented.= size <=3D 0 || + if (arg =3D=3D NULL || arg->augmented.args =3D=3D NULL || arg->augmented.= size < (int)sizeof(*augmented_arg) || arg->fmt =3D=3D NULL || !arg->fmt->from_user) return 0; =20 augmented_arg =3D arg->augmented.args; - if (augmented_arg->size <=3D 0) + if (augmented_arg->size <=3D 0 || augmented_arg->size > arg->augmented.si= ze - (int)sizeof(*augmented_arg) || + (size_t)augmented_arg->size < type->size) return 0; =20 dump_data_opts.compact =3D true; --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from LO2P265CU024.outbound.protection.outlook.com (mail-uksouthazon11021083.outbound.protection.outlook.com [52.101.95.83]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1BAD32E764D; Mon, 7 Sep 2026 01:51:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.95.83 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745914; cv=fail; b=HyPzTQaLMxWqVqtL9/1HSKGoEHwJ3UMX/XJHrkxROAFV7sSKaFEIrkmrywWsk6+FIjK+4BqFa0ZrKQZNt4JQBpZp8Fbhl7xGvVFrmsppYNMiV8Fd8hwPW8rBv4yM2l4iBi3tX9Em2fdCyWc440prmguvDYgu+06095Am4DYPTEs= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745914; c=relaxed/simple; bh=C0ho0ECfUSWhfjusBtkxaMEDbiCpn3omFMqSt1NAkDU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=edcvZUivi9eDu6L3rWAFSVRqEu5jeNjGQiqHmyl6RleqjhXoR1l9ERMPSxcRBBHRk67eXmzsVlrm4TVAzSUnsCLIypFR3WMPTLtK1f7iQnPubDgud+EfWFXxyh7FSj07DDbOaMPHM47fQJPYnwPJfttPAxvbX6HIv7r+QJgDQ+A= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.95.83 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=BFLfuIO4rLKEhzavA9sO3Wa3zIKOkndxeGpEyRuJ6wAS6gg9Ea+dOI6EPRJ4HGi3d9ghU5PpgkKfvn2Mbf/YX8qyfaTAm9GT9/cvFj4GZuYROWxTQRLl62JW2iIdMYzni/l/3UGcJtzFDhpf7kYBAjnAiG8J60zrSeBeQQ3SrrjqKpXVGkiNwqFGRnkwDg289IW4dOcSiiqVoLGr5Y589b2oYoQqnuI8b7OsL4WLTYYCuyUIFD8I7tjPdrjiy/e37huSrTzmsQ3YTkkAJdxy3/Jn2AIRn1bTYloO0tKWb/6BqsDfrdmwkct8qbwxyenjIynv/J2md4nfkDBS28KCsw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=NOh4e6+0KJwE8pI0XdW3en9J5OAlN2E+WPL5u6yEnys=; b=AUIiNJ3VX9KEjFownncocNLEertFsfDXq9U99HALgk1lYI8ju8zdBFI4wd26xvodPkx/hkFmyoPVTb0cleM9v5gCqS7gqRR5kyEEGVNt3ZBgtwFr9wObaveK+Y/nlLzEmIPhvEdF3vBMi0Qj3hFCKdt9vWJl1eZa1THdqA5pCeFA3VJnL88LsDZLxFJt7/ZWvcNhcbz7z/33jfUNg042mlHS/Q7zNDkbF+myNDr0fG82uzqaRG+AytdyV4qmadrJdjcmnfjUb171aTN2TiLzxUV3LQk61ajBOSHZ51MJE3pL1wvXzSHcOtEp6vwxEeT5/gbSq575WB8dkUHrtmc7Zg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by LO0P123MB7403.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:335::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 01:51:51 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 01:51:51 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 perf-tools-next 2/6] perf trace: Validate payload bounds in augmented string beautifier Date: Sun, 6 Sep 2026 21:51:36 -0400 Message-ID: <20260907015140.363076-3-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260907015140.363076-1-atomlin@atomlin.com> References: <20260907015140.363076-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0209.namprd03.prod.outlook.com (2603:10b6:408:f9::34) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|LO0P123MB7403:EE_ X-MS-Office365-Filtering-Correlation-Id: 95e2ffec-0644-4e20-897e-08df0c829602 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|366016|1800799024|376014|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: A2GuVKTyU7/4/GJ2pIky7Tm53X6HZ2aH4g2pSbbZhDbbb3rHYrYe2NI1Md0PGy2Q0A0ExsgZcRWJloI8i2CDpOiCEZXSvMs3oCe83DrPVtvaO6XYaVSgr6wcgPL8HQJmdtw0YZkUT0ejZRhTOcoSYZV5s0ph6BYJAismhOlHpG8rcrr+JI0QAIi/NFoyhCJUomRxAHiq6JYGtx4Hrwqvu4gZIAcGJJyYjIlL42xoV8NefEv/AO7T7iMkX7G8ftoujr5msGqKBlQtc3Ug+fNP1TKoPw5PePApQ/qTDP2UCXJm1gvpzCayDt098ORk3ZBtmqYZewtuslVMnVLMQ5WacH6yiQGlniFkWl5rImCQprTBkOctHRB/RQyrxEpK5LqKtsapQlXGiSNFgIQWTe3K60Wx7+tiGqmZ36nb2JTSsxAOH2NBdIMIKWIG/wdGZ1ib0Kp8swnW5Jo/MAdm17JkairYtF7rdW9nlq5kwbftDaqgjjY38gGN34fRBXamrm5kZIOXTzoYtf16xoRWcCLbKEcHGQwC6W2AoWqrIdVeFUmfOzmpa8CiIHXF6U7xLEFD2kcYGAQOfnm7UmrAA1Ov8bVdwD8sLU2o/8lw1YQdDw3YcM4MIAuBceQjcvDzWoKGxfWEejEnz/YVCULxP8PQPKpJD5tTrZnAv5C6WagLUiI= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(366016)(1800799024)(376014)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?Z8Fts/3tgkuJA2HVHbeGz51zpVxF9MOVVfvwAzMxz/tXFze7PNocXT5W5sWx?= =?us-ascii?Q?jxQX5EOdkKmZXrQnIExRSzHQ3cFPSu33m6FWT9bo4dSTpo5Q1rLDRI3th8em?= =?us-ascii?Q?zMmQtiIpRLBzsICxl5WInSmlpR3wRTcOG2b2C0RnYN9TplQ8v3MOX+xFgh/X?= =?us-ascii?Q?byNX/u77ODJqlTHRT1AKqZTheJ9kCS5VYUS/9SPXAEcGw9+fa+bN2/bAyA4Q?= =?us-ascii?Q?PKOaPjxTTcxlPzdJM/HEHmlZBzqTzGSOqkRdAO0DfsLZHYsttreYih3sN47e?= =?us-ascii?Q?QLolY/pv+6fLxbBb0GfDSgw5PPCuNrcm+4HMXsHtdWB7X72hWxsyUGC46eXV?= =?us-ascii?Q?75Z3PCA3kjl6Tcftf4u9xK3+bygN77Vy3RB7dfmLK+s2x2+Pbml+ceqJr6iu?= =?us-ascii?Q?jNNpE9D2u3OrvNfmxGQBDWL9vhF8T8ypIcZGAVGA22p1esTT+UI6/bKb9oOE?= =?us-ascii?Q?bvJdIZzJOe4Hg58qa7+7RfxY4cOcD6rerHpRFIb6+DFHD7d/qRuAoD8HXHX0?= =?us-ascii?Q?TcyQUhLv9dCNqNeoa5Rn1J+mMwrN/otEk7vf6BhDf0GEg2Mj7PMhsIouhjeY?= =?us-ascii?Q?ktNqvdLm7EfVBZzKPbkKf30uPCLhm7MZSCBX1hdXxYY8fE07lIVMSAcXebAc?= =?us-ascii?Q?FLW3OwQCQxLTFtw0yn5bhCZp5ZfE4Fcx9bblIobNxp49fEMhUrQgo2JAMm7E?= =?us-ascii?Q?fpzwk/quQhbdHGnxPnMuYCaNLm3t2rI4TDRz7Lt5kQwT4i5T+hgIwH/yNxm2?= =?us-ascii?Q?8uqrU5rS8JHzElp3BsDkdoQSrJEEgOxT3lb7n02pqvmF2jEwZtctWYDUpyB+?= =?us-ascii?Q?XOxEKd+aLm7HNI4SzJYNOJJwRnWcurANZJjGSnfjqlZZ3zK7RU1ez7h8hss8?= =?us-ascii?Q?bRGGUGfk4qsiULcyl4+S/N7OSCy6w+8cWimWXYQBJ+iECInkW1O04jJcfEJv?= =?us-ascii?Q?1ZTHhRdyn2oISUtuQXLRYQD1vbGM+W62aWiUCakoW6AaE8/RWdK115vk3isj?= =?us-ascii?Q?CjkCo4YD0zL5nlfVZcX1anim/iTD1HOwF6OSV+3Br/qRXF81E6fJeG6MnrMu?= =?us-ascii?Q?JLsBerRwf9YB5FFMRnrXSI80aFMlZvkZeRYFCBTnGXmvZzLHdVp7MCqHijhQ?= =?us-ascii?Q?yxVzN6v1+gLwpX5eNXS4cgQ1XebctlhaRqbB3dXPn8bVB0C6YGXZ/bdOD6dp?= =?us-ascii?Q?wZhcOwu2eXiqpq22iyiRaIyVtFMWk4/gItqIsdOFkDNx8bf1wcSZ3owqjYlq?= =?us-ascii?Q?nQfW3Ffnlpi8AqSCglGGDCWgTyHzTJRhmVV1eXKJhdbRrkPSjNHydD+y/+Y3?= =?us-ascii?Q?0RHyKuunUl+0M7h0dNupmaQOAhgGBADM8oL3YdHMI8gZoDw1wepBi64grHB/?= =?us-ascii?Q?Oqcc4uccoHMmX5iBSdqzexqiblevFBHvCVcLoLsHCLAvS5fJHmqdAD4ZVKHJ?= =?us-ascii?Q?sg1KsIUZ5xR20cEypFWCrb9Ww2oojiOyyGvNyf+2JY227rINAmtTeu4JVE4g?= =?us-ascii?Q?ZfpaGcFcpMQkY1i5HRaraCAlTlKb/YPm9Z1Kt7XpeOqJEHX2CkoVm2muSxDU?= =?us-ascii?Q?GJ6UNHcxS6NTc6cAd2FP4X+vNWC67+gINsLZA0F/dBkz+cNzBfMBgs+srqYP?= =?us-ascii?Q?l+pwiisViXKslNQzKrVYy97cS9F0IFuvxbmJQa+vWlv9x2tUAkdr5kC1Gv5a?= =?us-ascii?Q?F+q9jbPa9VRzFmRzZ53a9hDhDT4X42lzepxvpadGlcbe7bT98g0V7QJXougm?= =?us-ascii?Q?id0F3Rl+UA=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 95e2ffec-0644-4e20-897e-08df0c829602 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 01:51:51.3851 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 6N2jySKPcvUGryxoVPrYJsGvXYc00uDc0bN2RrGzr76OGJ0Gj+HbvWTMoGWAuuxxTYbIDsaSooUkNJlwYRomqA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB7403 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented string arguments via syscall_arg__scnprintf_augmented_string(), augmented_arg->size is not validated against the remaining buffer size (arg->augmented.size). If a malformed or truncated perf.data record provides an invalid or excessively large augmented_arg->size: 1. If arg->augmented.size is smaller than sizeof(*augmented_arg), dereferencing augmented_arg->size reads past the available buffer. 2. Calculating consumed =3D sizeof(*augmented_arg) + augmented_arg->size can overflow signed integer bounds or cause arg->augmented.size to underflow, advancing arg->augmented.args out of bounds and corrupting the parsing state for subsequent arguments in multi-argument syscalls. Validate that arg->augmented.size is large enough to hold sizeof(*augmented_arg) and that augmented_arg->size is within the bounds of the remaining buffer before printing or calculating consumed bytes. If validation fails, fall back to printing the raw pointer value. Fixes: 8195168e8779 ("perf trace: Consume the augmented_raw_syscalls payloa= d") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/builtin-trace.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c index 20fffc24507b..91461ab927b6 100644 --- a/tools/perf/builtin-trace.c +++ b/tools/perf/builtin-trace.c @@ -1898,12 +1898,21 @@ static void thread__set_filename_pos(struct thread = *thread, const char *bf, static size_t syscall_arg__scnprintf_augmented_string(struct syscall_arg *= arg, char *bf, size_t size) { struct augmented_arg *augmented_arg =3D arg->augmented.args; - size_t printed =3D scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, a= ugmented_arg->value); + size_t printed; + int consumed; + + if (arg->augmented.size < (int)sizeof(*augmented_arg)) + return 0; + + if (augmented_arg->size <=3D 0 || augmented_arg->size > arg->augmented.si= ze - (int)sizeof(*augmented_arg)) + return 0; + + printed =3D scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmente= d_arg->value); /* * So that the next arg with a payload can consume its augmented arg, i.e= . for rename* syscalls * we would have two strings, each prefixed by its size. */ - int consumed =3D sizeof(*augmented_arg) + augmented_arg->size; + consumed =3D sizeof(*augmented_arg) + augmented_arg->size; =20 arg->augmented.args =3D ((void *)arg->augmented.args) + consumed; arg->augmented.size -=3D consumed; @@ -1916,8 +1925,12 @@ static size_t syscall_arg__scnprintf_filename(char *= bf, size_t size, { unsigned long ptr =3D arg->val; =20 - if (arg->augmented.args) - return syscall_arg__scnprintf_augmented_string(arg, bf, size); + if (arg->augmented.args) { + size_t printed =3D syscall_arg__scnprintf_augmented_string(arg, bf, size= ); + + if (printed) + return printed; + } =20 if (!arg->trace->vfs_getname) return scnprintf(bf, size, "%#x", ptr); --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022120.outbound.protection.outlook.com [52.101.101.120]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 487462D73B9; Mon, 7 Sep 2026 01:51:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.101.120 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745918; cv=fail; b=PBTMJAKBN58aWnkp9K11pZgfty301XQaKy/viTxQ3T/hpicmnMfi2eBGHwcn/hVM53lrt+RbdQxPdf8V5gTfyUMTPu63y12f5Wxj9zJ1e9vm9z47sBJVo7CeyuTB+Dvy271aOU+VLhSXoobHyJjHtZFC6JSR4CpYzQ0L3AE/oyA= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745918; c=relaxed/simple; bh=RGFS2X/KQMHNJkgST3azAycYtBzyxPbtb74WYLTgxCc=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=rGgpWdBX2VvaEwkbHafZ/90Q0po6JMaVXzdg8HUSsdQX0hZgVTR2oNfryoZPJ+ZGGoEPf42v5NtYMxe/TwFeJkD4JNmq9X0rk2t72iIc9rGhFMeuaS21SckVQ3e2u8PXmxIGMPd0TKPfaEnCsq/HfLrNQ7OMKIoTyRhbS7twvIs= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.101.120 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=jmWxzRAlxo6d70TDPYmiFIHQd0PYAgJs/5ekAZAsqsNPcikDaKsVVSNRwkLFOp7xiOYsaD3ZZrUMEYfe4MYYHnhuIiveLe2UEY+88Qb0LLcpU5FhatY/cDny7pvcAFgJywqD5zLwWtDUEapJZlITK0KvX9nsSvWE8wLG/LEjBKq+uDEw8OBLUI3ocQidD7osSszve3GwYFZo1kJFW76/IgqTkGZZKF4C9SQfgD1PuY7E2TQfhkWZRHULcenJwVz/R2BD+DYVhPsqDG0XX32GMwv6sHlfdAt3/afF8oj1sSbNgS2aMXlOT3vC3G5cZpRIBTSZKU5xCIkaz/l1XuVx4w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=SwDfJ/hWHypatmSql7kw420SmWri7a4VENtP3/iMWIo=; b=tjWo+bb3WL4qnnYxSsXs+nM5tLsFQuwwVWCwztEYA3k9m9ja8kKtBqvcSiavZu8b25z55KXyf6LlU3BmuZterKQ52r8osdhdVnITMWjMaM+OSZG87zYSTbKVO5OJM2Wq6ZayCgqY/z7wbo5l59Gpba9OiPHY4/KEe6GD7Njp9cHH5VJy/kgZL9vcUB4ccicSwm4+ofhPoqEn6NRP7MKLAkcL9wV+5LZY2eipq+jwhgi8/EQ7+OFq0YyOfQhqgn6X1TvkejudTQle/UyqGiMlGs3syc4hlhT1sfklqkdMHqkFVZMVGE7hTzRnA6qRUZNR9DpfqyrEdhcm0HgYBdEycw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by LO0P123MB7403.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:335::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 01:51:55 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 01:51:55 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 perf-tools-next 3/6] perf trace: Validate payload bounds in augmented buffer beautifier Date: Sun, 6 Sep 2026 21:51:37 -0400 Message-ID: <20260907015140.363076-4-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260907015140.363076-1-atomlin@atomlin.com> References: <20260907015140.363076-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN0PR03CA0003.namprd03.prod.outlook.com (2603:10b6:408:e6::8) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|LO0P123MB7403:EE_ X-MS-Office365-Filtering-Correlation-Id: 6f3594d7-85f4-4eec-6200-08df0c829820 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|366016|1800799024|376014|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: mYbiVN2k/xBucSSegpkGDZyLk/gzEmu78aEolQ0DGn7zlm5UUYLhmEdFL8aAtJNizh4EZbXm7B0YcY59jjzEI3vqwOhA5QkKh0AYgSp9AIF9l+AisX6q1BcC6NB+JOy01pNuZZzTTYhTJKuYhiE1ilAvvoY+FtFwfirDF7b3iPz9Q6mjO8thVwCaiRXPholnI/DPs96YDxk/MmCkAySrnyf+kSwyzoj/HUSzfG4WE3IolVp/fBvLMaLbkTXFY16DkYDgipQqBx1gkwa7mSBSFcdIFmVp8X4ScUEvXo0+LFQh/66uwF3a2ESTT20n5N4gry2OvWkud+ER8CfVyGkK9Qo6tuy+FCo9qdmRNn/yMgKYGFuffkVAXQoX9LlXM3FBQh274kprxbLFFWm3zbVBvuMZBPPwQC4ut1wr8i9vCphdQ2QjTZ0KxLN7IL2NENQ8PCCTiRnYR6ied2CbV+7+FOBjdR+ujvCE2EPCJZD0gRFK67e+MtDlUYIDEiMPrP/mt96ckFJLCieHsxR/8RdRo/DlKqSLj40+7uzJwaZwHqmeP+XMOrSyUEvFdJGfN3L2Lp3S+bpVS2n6iJzWsI4KwcOnl7WShRAh5qM2mAOZbg9cx+dff6+dbMAgDCp4Zj3IpiO/TAFhINWgN+TIf6ur2GWYtJF0SldmSBROGFa9AqA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(366016)(1800799024)(376014)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?/E46d6Zt7NwBMGYjyc8v4DzbBKlWx7IljbN6hDOqp5x+i2c+3EW+mbnJdVDO?= =?us-ascii?Q?CMmEPVKWRyoZB7BlJSISxopYMR5gnYp+iEN3rY4YX9nK1ms5QCjtYiDYmETa?= =?us-ascii?Q?ysN4xvNqsyWCkXkLCfVW2VTjPbENHtZ/l8hOu1kXPok5eDa7ACmVnaocdHhm?= =?us-ascii?Q?ZsJmvURC5NmM8o21NFmTQaOZFEWEFYzkZ3LZMjpRchIfAVdoCXD/GT+7d8nK?= =?us-ascii?Q?ejvtO7vILE8AAWtGrsxnK2hhijyTAqVUL+KjNlUZF0bgPMw4ugEJ7oKgclmP?= =?us-ascii?Q?/T1yiQ9AbZoMbmOOxXvTNMqzfUxTifT7c3BaNgJOR/jXnzWiOhjFWQAgxE1/?= =?us-ascii?Q?qYDp0D07qJHB+JDyDF7CYIQn96Lt6oIlhreoprlKVYyreV1LNta4yIX1tFeJ?= =?us-ascii?Q?vLrqcWB3a2XryvJ3RhqhcFKQ4WMfzD8ziUtxtHmX0jos3dbx1T9ggXI4s5Jx?= =?us-ascii?Q?wCVt2TEjyj6PuXgtTH1NWdG+o0dBVk2Ps3hlS7C6ghRjvVRFwUSwwIHaDhNe?= =?us-ascii?Q?FZo8Rq4qOMjFQdtt7gpzbL7IYqvYjosCkMwtXVxk89jMHrAxVh1ohqGkabeF?= =?us-ascii?Q?lPaVa6omz8sGQAWZMwtP5ER2sUT4KKQp43W4mTwy6qzpMrnV6n0WnvJObbMX?= =?us-ascii?Q?twlu/ZS9BzXgPgoxA0TnCkEm5OxoopY41AWD+XV3Qd+/QEEJD1MVT73SfMXU?= =?us-ascii?Q?xf81vvpC0WC9U62DLR50ZpYCBbtbDn1kaBCLVq4UAc3fe9rS2u+QklTOAIiF?= =?us-ascii?Q?/9QjMDfPRSA57MuQisCRVgn5WX7RFH1ctpb3LVosdkE1ZqVm+8sxnQd2rvr4?= =?us-ascii?Q?YGbkg7WuHppDHfLXtTCEea7ILn1Mz9Zzwegc1XlPkerewdJlYVBtnd9jTwOy?= =?us-ascii?Q?KcJsi6hC7zhmKkP8Z2tNSeSnk7uh6LBOl4X0QsxdHYZZGYq5UodEX4zaYSRh?= =?us-ascii?Q?S8nlQN5QFmgo/QFgwgKcACqBY8kQrUoOOsScjoqPRm2zAYmLpOOKh0bjylHJ?= =?us-ascii?Q?mc8UZ/6IV3MB8K0K3M6Ky7xstvGfl6kyNmRyYrOlR0gQ98gTxL6bqQFNMYbc?= =?us-ascii?Q?vyntQdhiAI6cuSKUxqOa0BWrMVkIbaqU/k/RrwO8FXTpxnqFi7LIsreqXkff?= =?us-ascii?Q?L1oukAncLes66n7rWitwtadllQpRkK32qrLRzw4uS4g4SZ4E5cLSZ0Tcad/1?= =?us-ascii?Q?hb0hx1ijOqzf/FJ/vIIxbnIxxMT0qwY47HLUcwYZOU+5/zGQXdmNHEQ6dJwo?= =?us-ascii?Q?b1DcfoXbg9wBKp7OmyChXn2xUpqnT1DnCovHMCt+0tIh80dI94TpCmQoJNzP?= =?us-ascii?Q?B5tjsexmZjp8DWOgvZG2TfFRR9lc7baS2ekDc+1Ok/DEFl+CxM2yugCe7RRu?= =?us-ascii?Q?HelkuI2qppswCrB+3kopB8J7pgFfCry+Xh9dJXQSJHBTfZgufIj5NVx9v/02?= =?us-ascii?Q?YQ8u9KMRbmjI/EoXSpuRuegNWIVOmhTlKR5C/VKLnWa+i+tYX34T5Re6Faha?= =?us-ascii?Q?tgyVJa+J/PKM+dzUsZMnUqWBIsQ9sFmPuGcAZu6eLOXYiUlC3UXlKiJ11O+X?= =?us-ascii?Q?snNxVx/uAAVDJGg+rY9VDLhiap4pJEYNnIouC9JKz338bm7LNt3O9qMcx/6X?= =?us-ascii?Q?fDawSdZY/XvlUzM0Q3egJSEd6cgFSOBvg8kO1DmdTyoWgC5f7OiStcsqt6YD?= =?us-ascii?Q?9Ui7GStQiSvPLH7HaUjicvIbLH2Nleye1PcdeaKR8P5qKksYipELP7MLjjGR?= =?us-ascii?Q?rnieePESSQ=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 6f3594d7-85f4-4eec-6200-08df0c829820 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 01:51:54.8636 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: yT3ZaJTIrrIyL/DXqVChfrO1YhN9N4NAEvZuVxmdMyK5l6CnrCcK38P0rqPfo1oUge8oQVwb86GXxXh1FubZLQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB7403 Content-Type: text/plain; charset="utf-8" When pretty-printing non-string augmented buffers via syscall_arg__scnprintf_buf(), augmented_arg->size is not validated against the remaining buffer size (arg->augmented.size). If a malformed or truncated perf.data record provides an invalid or excessively large augmented_arg->size: 1. If arg->augmented.size is smaller than sizeof(*augmented_arg), dereferencing augmented_arg->size reads past the available buffer. 2. The loop reads up to augmented_arg->size bytes from augmented_arg->value without verifying that they exist within the buffer, leading to buffer over-reads. 3. Calculating consumed =3D sizeof(*augmented_arg) + augmented_arg->size can overflow signed integer bounds or cause arg->augmented.size to underflow, advancing arg->augmented.args out of bounds and corrupting the parsing state for subsequent arguments in multi-argument syscalls. Validate that arg->augmented.size is large enough to hold sizeof(*augmented_arg) and that augmented_arg->size is within the bounds of the remaining buffer before iterating or calculating consumed bytes. If validation fails, fall back to printing the raw pointer value. Fixes: b257fac12f38 ("perf trace: Pretty print buffer data") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/builtin-trace.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c index 91461ab927b6..4277de761a54 100644 --- a/tools/perf/builtin-trace.c +++ b/tools/perf/builtin-trace.c @@ -1945,13 +1945,17 @@ static size_t syscall_arg__scnprintf_filename(char = *bf, size_t size, static size_t syscall_arg__scnprintf_buf(char *bf, size_t size, struct sys= call_arg *arg) { struct augmented_arg *augmented_arg =3D arg->augmented.args; - unsigned char *orig =3D (unsigned char *)augmented_arg->value; + unsigned char *orig; size_t printed =3D 0; int consumed; =20 - if (augmented_arg =3D=3D NULL) - return 0; + if (augmented_arg =3D=3D NULL || arg->augmented.size < (int)sizeof(*augme= nted_arg)) + return scnprintf(bf, size, "%#lx", arg->val); + + if (augmented_arg->size <=3D 0 || augmented_arg->size > arg->augmented.si= ze - (int)sizeof(*augmented_arg)) + return scnprintf(bf, size, "%#lx", arg->val); =20 + orig =3D (unsigned char *)augmented_arg->value; for (int j =3D 0; j < augmented_arg->size; ++j) { bool control_char =3D orig[j] <=3D MAX_CONTROL_CHAR || orig[j] >=3D MAX_= ASCII; /* print control characters (0~31 and 127), and non-ascii characters in = \(digits) */ --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from LO3P265CU004.outbound.protection.outlook.com (mail-uksouthazon11020108.outbound.protection.outlook.com [52.101.196.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DF05A2E2DDD; Mon, 7 Sep 2026 01:52:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.196.108 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745923; cv=fail; b=ZNiLHuL/qP3ZWZGgbVj+MLhJGL0VqUPzriDPboXDt8+DEOfPTW3HIvV+SW5xdkTOZWvTucPq9JvlDykJBAy1ke2ZO8/eNiwkgVK7mrtinkuWD/jfQA9NjnUvO3g3RWFdKVMTxJQcgXNN6n1q9hG/huPc2R26/2fDeOnQEDMZ4Bc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745923; c=relaxed/simple; bh=PYQXaYnf9EGw1HJA3Jv6xzlFH3wFrGMegCEY5iT99V8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=HhFQbufL7uhslUFLkC4bzDLOnnlx/gABQsgJJO+ZhGquFRBJhlnc8TS2FpaH7kYjg2RgyslvQ1+mhAXE8MBzOFmCgLWZKP2EyolPwcBgLIHSBZM8xDUuFdp7JvBq02ez9U31z6O+9s9XAChGVQTFZqD80RF44oJP6ibgR8blCKo= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.196.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=HhVlT9WZ+2OMjSPdXmbM27tj/5rrdwa6HTFlzyveA4FolPUd1xu4gpplB4Em+E+8KWlKNOqUk0gqlaJ6mMcLR7mFTbEsi2ZEgKkDES3rjMCkaGQxI3/zONXUj68GA3v+hJMF2l+MRhqEL0LjlLrcg40WdDOTss+AcwYqxSaso5SZjbT+54c8oi+Ygei+45N8t9SENSQvghtmfrKkTuz8qIL7P1JEqjfvaFppD/md5ucxot0mQcNAO6/ezIMQXH1IdVvGZnYQSHCPWSV7PsDLoFikB64VNhRhqkh5kGupFfDo+CIKa6lBq/RLdMRH1jHjEahnZ1wI+6ZrGYoEyuVP0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=0fdEjtYpQ27Thv/rlJc92IsGjW0quzSwQCYFYMYBXrU=; b=gi5t/UvVmtxgyVSeQWpYI6hN8CdyW5mSFQ2NpQ3jG1L7sw1U5I4x848PQUiRPYWcCifBqUioMsChDEthXdoEk01CTOVsaukpJlaFynt7I9KrelxxY0bTm1yyrFK0qXMAasOCqdawkWVIIw2hZ5oMHdcqXR6M2ykUUQP8ADvLPI14Wn7Q2w0KT4y/XUvmFP9EQQa0ugOQ8klID6939oNM8DZNR+by0q+2T6hRa784zaXNRk4ZYMPoAoNts9FwKp09+ZGPNm77u56KVyQVzT4//NiZ+SzeaxsiBdKUW9R0aqyI1YMhWcH0fe6f4uTkuNTN7Ef/B6MK5R7NoYjX1f/EeQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by LO0P123MB7403.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:335::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 01:51:58 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 01:51:58 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 perf-tools-next 4/6] perf trace beauty: Validate payload size in augmented timespec beautifier Date: Sun, 6 Sep 2026 21:51:38 -0400 Message-ID: <20260907015140.363076-5-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260907015140.363076-1-atomlin@atomlin.com> References: <20260907015140.363076-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN0PR02CA0057.namprd02.prod.outlook.com (2603:10b6:408:e5::32) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|LO0P123MB7403:EE_ X-MS-Office365-Filtering-Correlation-Id: 3710a9c6-bec4-4b2b-7fb1-08df0c829a26 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|366016|1800799024|376014|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: 4sFr9Lr5f8gjQ5haYhbZCjqG3fwnG6M2Y5zUcqM2BHlYEMnWKC/MJoEZfHPRDm21JbB37wningtIHtIfNSklPJnDUkliGgDbD8U7/ET4mjRlUEO/ZXNd/1IlH9lAoNbEpCeLgKv+KcQKPjy5vtx8hYx+KoBrnXVwIBQV1vV4QH4m8PrXaFMEFwx+ou84KMSwg6e4opjKHrYb8HuHfd2OHzrqCQyNXSH7FOfO7jLJMSoM7DktbrP+kmRxNUmz4T2x3ZKMVsE59f/J4UOP7go1mS0MOtP+GHXFSO1qGzMnOSHnzRhtZ20asmmV4buEj0D9y7SHmx17JWGTfDcaULBg77+t37otNnUeLZhx5mqd/uDhAL36UYWswC8hZ1NflZ9RJBf+5RJeltTtqcNK6XKyfQFwV6/JUQ8/mK/XUSU174SQ6mNDNNftlJcZsvqHDAtHfM4+jeKYFOfxmZ00RoP7ae/c9NhuhWOi84f3PGfrXs4Wx29ZHHtk8NmHrBy25o1DHSj0zoj16jZgzKRAymqOBDGqblqd50yXek/k1CMxwFxxgDYUy5cbd+68HS8e5y5Qgf55iqgzv8cnZ63h29Yx2MKRP/7xQODYsst0dtbNiyJUXPflFpE8kdven4RWyweP4iT+3ENHMnlDpKnJKZSmZZ5zclhQRuZpjBPT9v7EhXQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(366016)(1800799024)(376014)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?LKtd0iqKFOJHa2bQv3/E66phpyLDl8FsOmkMuMdl7B5F44B+H5xgjQCzP4Oe?= =?us-ascii?Q?Sd2ESRK4CxE5d6jv6H0OMP5HX4mbx6NQ2vrP0anAtDb0ZlPEQ++EWDhxySU2?= =?us-ascii?Q?YrrlfcBCyvlKfZINhWb6oZe7d1duP5HiZ1fqjNJcZjqbiqDZknoFOLZjPhD4?= =?us-ascii?Q?prxMbgwZjJhuQ+W/eGhoys4i27eTlmGvgMXfz3Jce8dlas8dq/ys/SnHbudD?= =?us-ascii?Q?EblOMGrv0NsuviTHgmC7V809SJq0kqs+6F41C5/EN9fhK8X7PfGWL0ZKMaTB?= =?us-ascii?Q?9f1RM39tZ2zDa9fXZiM3db01l9qLJ73ocTgWXb2Byvf7aiUFkKuMdIIImc6x?= =?us-ascii?Q?+rVlsEzCj+TS3oQETuhLuOHnmjVOy4Uv+8osW2saK80BVPau811Nq2Pqxm4E?= =?us-ascii?Q?5da7Q+xdWfhnB5SFDUIHlkES5aSNoU5+hiM+pAS7Tw0uRFdjE+P5ezMPtPEx?= =?us-ascii?Q?tGM7X5rh1yn7OCeac4wsBAxFyoMtyZzzKqxpV8d4fukdmA/GofKQFMq55CZ9?= =?us-ascii?Q?AYoWhu6/x0PyeP+wLFfPzFNKmEfgaRpGJ1OLNNbP51GxrIsfZAQ1IONtmrFd?= =?us-ascii?Q?TfYs79F9Sqy4lfUwvo+jJvRuXZ/6/VpMSXRUWcClxSXgfbtHxE3TDG1jv5tP?= =?us-ascii?Q?Z8GrtmR8TBzcPp58rEhawM6owYxBIyDmTJWIG9drcoQOKkopfweazR6R26OD?= =?us-ascii?Q?TPNawhDYzISAVCmUWqngtc1NnFeT4phz1ZS0JQdchHFd/2yZInATPcdt7IWW?= =?us-ascii?Q?qV9o+IGHsugxmGcGCmd0CLu9Nwgk1eaDDuGDOupKsTuTGH7gxOfEyomtCiyD?= =?us-ascii?Q?jkqknyHbA+I2n5IpfyIbkqV+qtyn8M3uUCvuOABaxCb15S+kc3UxLyt3t4fD?= =?us-ascii?Q?aim2QgMW6ScUw8P5ihJk05Pg0UqBuHbSB0F0bpGCp4Uc3yESIhpbF0L6Dpsj?= =?us-ascii?Q?KdNiBB6noX/Yta2hFgcVaC4ZpIiHq0ReurzkelT4mCalix1Gfp4OrHF3ki0t?= =?us-ascii?Q?6Pe7z3iFn2qgO2Odk64ajftFZtKqlHrxMkguETuhCgSCKvI+XF6hU7RZdIHm?= =?us-ascii?Q?yxK6Uo9gGfc43hIsvmOSjBDVHMl/uIX+AYQC/c8uQoismEHLqWsI492I1l8u?= =?us-ascii?Q?qrz3gxjvJaqOogEagzoKjoYToKaJatKaOIXa6N9pfx1kRuSyYApaHHM/mPEw?= =?us-ascii?Q?82/YqcxiiphsEDWufElHUwfCZrQMzf+721uwXKrU6HWXA9eTpKjL4XQD83/q?= =?us-ascii?Q?VFAhV0gRDshA5OboUpUqm3QrULu4tuXRqRK43l0E6BCm1Jotd+gJ4ZG8p9aZ?= =?us-ascii?Q?fVE3KWqBxVWFhI2Z+Otv25EwnjrKjreDlUWXWxA+dTE/1nsFlluaacoCIEm/?= =?us-ascii?Q?FINGq+FwDwMifSNum+KWoWIKWlAwoU9yced7Nf9OP97/g1ACjs5w7oe3zPv4?= =?us-ascii?Q?Cjbn3/dswYSM1+FLDcDf0gAS4IUp+UtG1umUNwZvJCCEKgsSiMykZfk0gIKH?= =?us-ascii?Q?DPcwVPr80LQoEbS9ZMva1Ox3Ca+nh2j9kwMXJdrIiIocZoNHkes30dv4REjY?= =?us-ascii?Q?UuRcoUM9+cPMVY/IxkwmR+XKSEx6l8yMiDRrdmvJ0kt0hcd0TP4vj+ORVOzX?= =?us-ascii?Q?L4bKsHlP6/4T4ueJn6EW3pfvNkn4fFgeJGY8Ry/VpPRCXWpNVweMXGh1vHBp?= =?us-ascii?Q?wvTOKxgOhBj8rkVqxwExIrXiG+sliURm7iNIIlhhn8LKAA8tN7fCc5Jcf6Yp?= =?us-ascii?Q?7nOIx9dq/A=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3710a9c6-bec4-4b2b-7fb1-08df0c829a26 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 01:51:58.2291 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: Dt6SodSsXNG1PPo4OABrnvw70/ZOA5wvMe19RpaM/wlqa7/VUPORmkL3YuExahLlbkEzD9bJ5pFaHE/4cEIrvg== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB7403 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented timespec arguments via syscall_arg__scnprintf_augmented_timespec(), arg->augmented.args->value is cast to struct timespec without verifying that the captured payload is large enough to hold the structure. If a malformed or truncated perf.data record provides an augmented payload smaller than sizeof(struct timespec), accessing ts->tv_sec or ts->tv_nsec reads memory past the end of the available buffer. Validate that arg->augmented.size is at least sizeof(struct augmented_arg) and that augmented_arg->size is at least sizeof(struct timespec) while remaining within the available buffer. If validation fails, fall back to printing the raw pointer value. Fixes: 6ac73820993c ("perf trace: Add augmenter for clock_gettime's rqtp ti= mespec arg") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/trace/beauty/timespec.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/tools/perf/trace/beauty/timespec.c b/tools/perf/trace/beauty/t= imespec.c index b14ab72a2738..fad503bd953a 100644 --- a/tools/perf/trace/beauty/timespec.c +++ b/tools/perf/trace/beauty/timespec.c @@ -7,15 +7,28 @@ =20 static size_t syscall_arg__scnprintf_augmented_timespec(struct syscall_arg= *arg, char *bf, size_t size) { - struct timespec *ts =3D (struct timespec *)arg->augmented.args->value; + struct augmented_arg *augmented_arg =3D arg->augmented.args; + struct timespec *ts; =20 + if (arg->augmented.size < (int)sizeof(*augmented_arg)) + return 0; + + if (augmented_arg->size < (int)sizeof(*ts) || + augmented_arg->size > arg->augmented.size - (int)sizeof(*augmented_ar= g)) + return 0; + + ts =3D (struct timespec *)augmented_arg->value; return scnprintf(bf, size, "{ .tv_sec: %" PRIu64 ", .tv_nsec: %" PRIu64 "= }", ts->tv_sec, ts->tv_nsec); } =20 size_t syscall_arg__scnprintf_timespec(char *bf, size_t size, struct sysca= ll_arg *arg) { - if (arg->augmented.args) - return syscall_arg__scnprintf_augmented_timespec(arg, bf, size); + if (arg->augmented.args) { + size_t printed =3D syscall_arg__scnprintf_augmented_timespec(arg, bf, si= ze); + + if (printed) + return printed; + } =20 return scnprintf(bf, size, "%#lx", arg->val); } --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from LO3P265CU004.outbound.protection.outlook.com (mail-uksouthazon11020108.outbound.protection.outlook.com [52.101.196.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B7E282F3614; Mon, 7 Sep 2026 01:52:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.196.108 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745926; cv=fail; b=f8W07TlXDISnrzYH551nR6GFX8JAZyMAPIdgO9IfaCc8SuXXsKfbZKBARG4Ol9VlXkKYbl8RAynjmDbHhJ48kaiRUI5LD77vgRX1cLl8jp4I/uCEbrFkyeaS+GTyHjDz+rQRFHTd2FTqENKxeF94hf32TTi4aieTAhrR3Tn6stE= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745926; c=relaxed/simple; bh=U8KSIja2UBCU907zkdUIqXz6+I3bx+HWktLYtKi/+vs=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=UNRQrb1E8GjlR1BqUsR3R7Jf2uRL4O0R/anYz4IJoNWlERr8vO8rj8VaBwsx2I7jCf4D/+CMrthKLu8FWnWhGuLhxyu7EymwQv68EWgFe8W296YnDeiM4HU02s8GQ7Zrkf/iyXTVlw76FqWfETyxfowvz4ZYBX1aj8CyFGqowf0= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.196.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=vxkT51Qwgok2tE5eREQ4L9KcVWqaJrBayYPHw/8MtaOZSeLm7aL11u+/QmZSXkk0nLOwV1deozGqk43+srMqn6SOqWJ8PMLzoAzlglh92MdHVXzIhZzInsr7mRMfOhVCAMYI3IRDJTvVx/Mrt0Yht5bnb6JUAS3GTEIai/asb3WwDlMi4yMdZeD9GIZpcO5DTaVDAQlF0G2r6VBA7Giit1nRtZ8487SyN6bZ3KgetnxMULuDsTciNoR/WOhRk6wtmiJw94pZ78mMuHmt1fphIQqtEwikH6pCNC2G+u/0dgSCxlzVwQxJAkwhGJ+8WeDeBfY9dxIq8yrFcSe8JXEFKw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=jcgkStY4dczj06TSKc8pO2Hev1gEEbX35EjxVf1fh4M=; b=vd/TYM6H5swppASgJBUO4+AD1KmXgZ3OpJ5GZC8nAzMRrU2OQtX+qgM3R4BrANDZneSXjEWAE8kFZv4pBy5pEUssxDj+rPjGw2/u0LcPjqldn9feJWG0LRnWUguui4ZcBe1oqlQA/BUIvUUrmPk9SWPd/bv1SyoyUjeRiGUF4sthArTz3gO99Vf8HHVnQDFYKNZml7q1MAFGmdJyVOL+SdQuQeWAM823OLIUnjEcpxzuLmYAUgxorO5YRUhjcobEsHnaBl7vjDT/+HCotcEUNXTl6AaIeb8hAZiydWjS2/JmYZeewSMM+xMRigGIjosJiJXtXkMYUio3bQO2CdjlmQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by LO0P123MB7403.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:335::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 01:52:02 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 01:52:02 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 perf-tools-next 5/6] perf trace beauty: Validate payload size in augmented sockaddr beautifier Date: Sun, 6 Sep 2026 21:51:39 -0400 Message-ID: <20260907015140.363076-6-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260907015140.363076-1-atomlin@atomlin.com> References: <20260907015140.363076-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN0PR02CA0037.namprd02.prod.outlook.com (2603:10b6:408:e5::12) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|LO0P123MB7403:EE_ X-MS-Office365-Filtering-Correlation-Id: 93560f19-4ba8-4475-54b9-08df0c829c65 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|366016|1800799024|376014|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: qCut888iCbKQsVQweP6EQAW2tKy0GUU9dPo4af18hs8RX2Vh4ZEvbuoCnS7mF3tCwX/hX2FDQFS0e5GZepRN7GN7UHMcfSjArB1ojUh/iuxn1feNHGrdRbOFJe4y6Mu5VEZjUNqxu7jGROo52KIciZLJ11HKirvd2yUBb6xnu3eDPyEvya5MsSlABwccVZTXvZpuJ+ILeYNYPUZy0rVnDBYXgEWtZJzEO72FmGZs+OZh7WW0fyeYhfCcdB7THPs/+K6++GMQ9KJMixS8jERbZNgig5exJ4hVf2pkEAS9frNz78+LxA8ZCPnNqlcauovWT0sG+9AUjC0bl64QqBeYIsiUhz0jk8jxKcecOCwiL1nK/u7fCE6HMDI4IqiFY+LU6Q6a2AyAWnS/9EbnC1RA8aLTk04HGdFK+bGLxSTs51JLxBRuhSmCVEsFDs7EJFcevrsm865JHPbK061o35ZVl426MkKj0GCvTNII6woEdzkX4PhwoPxLRi7pZ5fxV80pLuPClFEDFNO636CSvV8eBcv5TqzGzVHMLpUT6g4GuOHtdTaKAJIsimBe1toE5kR/2fwTYpySPhqs9PyMKLkEKT0Lxwqgi2n1t/h1fuWjmceyNjPPvt/rlVD29Mo6nbNbKEaVSeg2zkNeyp8BbHQw03SEqDkHnxxNggdhlElBHbA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(366016)(1800799024)(376014)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?9WJLQV18ir2eJdUGsPw4xIYhvRO/GGFaZvOGt6bhCw0xGPeLVcf7yE4DLLUs?= =?us-ascii?Q?8vpGVWQPypbEaQHr9MZOJBr6liEEUbjhbXaIXrlSzhUDveVlVvhOaglJRzZy?= =?us-ascii?Q?q+scKNkf3jDT8ZY3PXHs60gS95pamTrm5EiAN9R2+o5wL+uR3ZiSMeZ+PpVU?= =?us-ascii?Q?F9+lRLFnMNBr2I10BxjrwzJEHFcu9xo0iRpdV8xmhlj++LEFvRe4CXDoCr6Y?= =?us-ascii?Q?tKbtxehO5GVLWItjooafMdXp5Mf2TQTwaX2BNUIMricxB3kRMolAN0iyMMVa?= =?us-ascii?Q?13NCUE4HLwHN6jfe4tSzbWsVLq7UasEaA8qnF56V4edc8hA35ouboqFqlH6n?= =?us-ascii?Q?sQqS2tXJfASyAbZVtswVYKMfZwVGnnObqWQWxQnWHYTJrJEHTZ0QZfzonWrT?= =?us-ascii?Q?dfGDRGCKndTiABn/IHZXn+hdImh0iiKDK10pwbz/Rsc0CR3ew/WzSry4QLob?= =?us-ascii?Q?2ddEuMW0SClYyxjjktNttFubumDerAwdib+NKUpKFlY77UR4Ch/Ae+3tWhj2?= =?us-ascii?Q?IxE164PpKwg4+enlCDQ9I+XxQmsVrU2ojBeVpNp1/kjgfmPBL8joVpCUKC5z?= =?us-ascii?Q?PSuKnLL+Y17CnO+RB2cVcYRrXr4i+18gr/l304HcfJFARWXzI9Y3TAb34jne?= =?us-ascii?Q?pnYAEuFI4yR68bsQX/ojMQxfalbBeFZo6236Q0i7ZBR+YnQ+O6YWkgd5DJUk?= =?us-ascii?Q?BfKkjockbdueJV7kx5DYn9EPAnNyLzWeFh/1gXjBuniKdkdM0oKMXEyIbtXj?= =?us-ascii?Q?19rtwS2OVPbjmQh19LGAeQh3YwcpJ5GLenu0O1ZEGSEtTOijYgZMoDOIfFOC?= =?us-ascii?Q?qIg8gMOWHs5YS/AxB23z+7p8/953ERsilwLRJckxRDS72qjlaTEhy0yjyLqX?= =?us-ascii?Q?lfg7cM7nndPDt+uezzYUwQMeKj17sAluL+8R+1yDkAKSvk49qfXYSiD2jGgq?= =?us-ascii?Q?W/LLz8b119bN3rinVJvtSXtjQwFGZYU8wYi9JxOM+lUC7fUZ0OGHcVY5eG+8?= =?us-ascii?Q?HqFYDP2KUH/mgwpnlmnFhoZn9wGmPvyy8jEIgMZfCHn+KXBzoRzoOT7l5HgI?= =?us-ascii?Q?kXgAU3KDZYm0lRrQPrWkPKjUuAWI+d/CmbacEgt0ufiDDkZZi82bsmpn2M8P?= =?us-ascii?Q?mAHIn9SyXbcKicc5HoXwPOS+WM7WCvivMnkpo0TcW5FuKQH8BVUxW3CPi+H2?= =?us-ascii?Q?7tN+Lqx6AopUZ+7d0BSnXNnE/iDtEG4VVvaB+ABF1fnzmUrJCiNX6+vHpQ69?= =?us-ascii?Q?tkrAf36GxhUdNRZ9gW8DLtSroxlMLEpQWpoANuLJSvPDTK68OznrB3tOPsly?= =?us-ascii?Q?cie+sZ+2ZBUR6oVbGbVPPelkydXQTwKIaPLdp2YSNN9W2HMJX/UG9ymjQ4+f?= =?us-ascii?Q?Tj0SnKyXbPlrrhi8AC4yXFwWPmR2ktzhWetnUYSkSIgHUiP/QcK/fPaolZ0V?= =?us-ascii?Q?2P5QgvE8pxZRd+p6AyXJY9Z3JxvrI1Qqqa6a428AqOb2NIarVJwAS57PY7Sg?= =?us-ascii?Q?19AfKNqOOfbl/s02lt3kNsdz8awW7HC47NFU9yjd90n4LdyGvgeYw1qs4OdA?= =?us-ascii?Q?KJbImel8XNOX+mDTb3vSuBPjcIl8TkYnPK+lkIJLNgFv1HrbqpxteO/GKLeP?= =?us-ascii?Q?AeAq6UXYuu6bfg1jx7kPoTGc/GMrFuiNc3kNy0KWw8Ur/vxYLTSMRSQ6TFAq?= =?us-ascii?Q?3KLPekCRtV8J9JZXKGWr/Z5LDXAe7uamgx6tTg6ctyQB/fXdT8Two1xWbulc?= =?us-ascii?Q?b76ZWFYQyg=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 93560f19-4ba8-4475-54b9-08df0c829c65 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 01:52:02.0807 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: L8W269Ymo3Gu8kYNTFVnMVftoLSURiIcaWwI911WvIH0Qkx663hv4Tuw1avVL48jhGD1dhsxotLVDTLw6uyxzA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB7403 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented sockaddr arguments via syscall_arg__scnprintf_augmented_sockaddr(), &arg->augmented.args->value is cast to struct sockaddr without checking whether the captured payload is large enough to hold the socket address. If a malformed or truncated perf.data record provides an augmented payload smaller than sizeof(sa->sa_family), accessing sa->sa_family or dereferencing family-specific fields (e.g., struct sockaddr_in, sockaddr_in6, or sockaddr_un) reads memory past the available buffer. Validate that arg->augmented.size is at least sizeof(struct augmented_arg) and that augmented_arg->size is at least sizeof(sa->sa_family) while remaining within the available buffer. Furthermore, ensure that the payload contains sufficient bytes for the given sa->sa_family before invoking the family-specific formatter. If validation fails, fall back to printing the raw pointer value. Fixes: d5a7e6613b00 ("perf trace augmented_syscalls: Augment connect's 'soc= kaddr' arg") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/trace/beauty/sockaddr.c | 35 +++++++++++++++++++++++++----- 1 file changed, 30 insertions(+), 5 deletions(-) diff --git a/tools/perf/trace/beauty/sockaddr.c b/tools/perf/trace/beauty/s= ockaddr.c index a17a27ac2a6f..00c702ff4465 100644 --- a/tools/perf/trace/beauty/sockaddr.c +++ b/tools/perf/trace/beauty/sockaddr.c @@ -47,23 +47,48 @@ static size_t (*af_scnprintfs[])(struct sockaddr *sa, c= har *bf, size_t size) =3D { =20 static size_t syscall_arg__scnprintf_augmented_sockaddr(struct syscall_arg= *arg, char *bf, size_t size) { - struct sockaddr *sa =3D (struct sockaddr *)&arg->augmented.args->value; + struct augmented_arg *augmented_arg =3D arg->augmented.args; + struct sockaddr *sa; char family[32]; size_t printed; =20 + if (arg->augmented.size < (int)sizeof(*augmented_arg)) + return 0; + + if (augmented_arg->size < (int)sizeof(sa->sa_family) || + augmented_arg->size > arg->augmented.size - (int)sizeof(*augmented_ar= g)) + return 0; + + sa =3D (struct sockaddr *)&augmented_arg->value; strarray__scnprintf(&strarray__socket_families, family, sizeof(family), "= %d", arg->show_string_prefix, sa->sa_family); printed =3D scnprintf(bf, size, "{ .family: %s", family); =20 - if (sa->sa_family < ARRAY_SIZE(af_scnprintfs) && af_scnprintfs[sa->sa_fam= ily]) - printed +=3D af_scnprintfs[sa->sa_family](sa, bf + printed, size - print= ed); + if (sa->sa_family < ARRAY_SIZE(af_scnprintfs) && af_scnprintfs[sa->sa_fam= ily]) { + bool valid =3D false; + + if (sa->sa_family =3D=3D AF_INET && augmented_arg->size >=3D (int)sizeof= (struct sockaddr_in)) + valid =3D true; + else if (sa->sa_family =3D=3D AF_INET6 && augmented_arg->size >=3D (int)= sizeof(struct sockaddr_in6)) + valid =3D true; + else if (sa->sa_family =3D=3D AF_LOCAL && + augmented_arg->size > (int)offsetof(struct sockaddr_un, sun_path)) + valid =3D true; + + if (valid) + printed +=3D af_scnprintfs[sa->sa_family](sa, bf + printed, size - prin= ted); + } =20 return printed + scnprintf(bf + printed, size - printed, " }"); } =20 size_t syscall_arg__scnprintf_sockaddr(char *bf, size_t size, struct sysca= ll_arg *arg) { - if (arg->augmented.args) - return syscall_arg__scnprintf_augmented_sockaddr(arg, bf, size); + if (arg->augmented.args) { + size_t printed =3D syscall_arg__scnprintf_augmented_sockaddr(arg, bf, si= ze); + + if (printed) + return printed; + } =20 return scnprintf(bf, size, "%#lx", arg->val); } --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from LO3P265CU004.outbound.protection.outlook.com (mail-uksouthazon11020108.outbound.protection.outlook.com [52.101.196.108]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5A5582E7F3E; Mon, 7 Sep 2026 01:52:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.196.108 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745929; cv=fail; b=m6/g34OZkkSJHXoMekSO/hVaca6wIKSJhV+lSBEoJCo8yQtU7icCN3xStOzrydEd4xIrnQWy9TXWgErBTUfcpTTmPgMdc5BxNRIKczOr55RicdUhoeYU6+6mFJMeLWzYc8BE7qMr0Ehjt6qrUaW9KMrkw/jVzBMDSwvyZY7UN0I= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788745929; c=relaxed/simple; bh=yjYdQ5rDmIE3BqdsC/KePQx6+Z6Y1b6mllvjpv2ifMU=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=EHLX5+1FthtSljqEJtsex/gnF3x5f6BW7OQkxx9X2LtC7yyT/PoFJOdccU9C8AXng0KZcBECkeGzYb5kryh/iJLH3bCovPwFj9LNvABIjIq2DwG6t056CbkWXV5Gk26QTPLBoDRxLD8KZ0ppRNB+lkQsEvVA/wacSsM1mfmGieY= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.196.108 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=W6X2i41GnIFT1jxIsRGdHESj5IZaquVi0myXt/ZwgOwLYKqKVxgjWfSI7PufbgkofR50HxGgAaWQtq8IjjOIBr8Ax+hUHFETJc2WjBRX5LBHC5neLzw2+NA3l8F0NH66q8dCxogOw/5opBtus+wjxLdP8VVHaxjYghLN43Le3yJb+XM/ATGAivr89uYWSnaPPMCRwvI0rPoqlSSNpG53aamFrL/q6DZtKwquRdelXbRl1qibRV/lD++J0jcDQ48gcw0JHTmq/tvNvnt20YRM4c6v4WF/wrUAEwiMH9M60JYf8qplU6lBuiMpcvm03CtttvvY1qzKl0bhVEwB5ibRqg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=GpsL4FQW0kQ1tbKtkBn0svhyHb/qQieD8Hoov1EGkMc=; b=eyUwD1qv7Avb2iRp7sfiNNMLcZucz5W7r/Q4xsDwKzc3i2xUOl+HlqEnidbnlLHmDMukT7v0YpFvlml0V1s2H8ScDRFQp6m54HN6JTOr1rhlQZzbSPrXn+4yC7Zf88L/aq0QiCUm02MDIf6d65xPIXacP830MxTtDmc+VKJv39ve223CZhx5CtYJubw47p5fK5fyHnbQfi2dmJ62ukIqMR3aOKvYf0AGP4kY8YpKRCygsqUtIfRK2h1+LMyzcAVZiZM/tKrX7XaN+DS/SfHb+Lg6n7yQ3SeZd051BWvWH7wVtf7NJi9qrxhli4ZXWrD2qncI6WtJbm28KufeJ/yw5Q== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by LO0P123MB7403.GBRP123.PROD.OUTLOOK.COM (2603:10a6:600:335::15) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.382.15; Mon, 7 Sep 2026 01:52:06 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0382.014; Mon, 7 Sep 2026 01:52:06 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v2 perf-tools-next 6/6] perf trace beauty: Validate payload size in augmented perf_event_open beautifier Date: Sun, 6 Sep 2026 21:51:40 -0400 Message-ID: <20260907015140.363076-7-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260907015140.363076-1-atomlin@atomlin.com> References: <20260907015140.363076-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN0PR02CA0042.namprd02.prod.outlook.com (2603:10b6:408:e5::17) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|LO0P123MB7403:EE_ X-MS-Office365-Filtering-Correlation-Id: 96ed322a-e8d2-4073-6bc0-08df0c829ec8 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|7416014|366016|1800799024|376014|10067099003|6133799003|22082099003|18002099003|56012099006; X-Microsoft-Antispam-Message-Info: MKvwZEFTO4HnAq0rNApI1ErU6Zi7ROmLYQj6jp5tIfdIltYmlxatAHPe1b+3tPKdytiV26OnxJ2VS9q452/kvrN/oo0k9zT4H+1JnXK5nXHckEET5yS8R25VFAgdn0FQ3JEDVlfnBz3XlMgXBlmChXTxTUZQmN4HjR5GYLNBYQ/I/qkcw75gneVBHkddUmWDofh2MdZ5yWmy4FKIpti+BO1PAcf7vDRDMyPw/lTFRMUpOojdhABRqTFkfYfaZVp0dwcWxNP0IEcifzpt4dONPU4vTgiIWd/Ea5il34mPQ//EkkzbeuE2XiazwCqPf6SfjFf21A4qIN8R9JrfTAGuWcRXrNyHlwBGvHxlP5L+lM6PSNScN50mEyKiIJtZAUlplC2qL8qnnzQKukFxngl+TnUPrBCUcRm0zihLffYvwVA8OXbvf/bpWxqlfln7x1u1Oar5YvRVPwYnbG6OWY5fIlD8F6AW4BTh9gFB/jGZRqhrm7l+1RtbPyrEtpnoAfMB8Y3DZM9evxgwnqMwlHH4fwgVOLQ6mwnQdeVtb3O2pPKPMKboK+tT9RODsFSzN5s3SzYtxrAauSe4MXFSoX2Z6NuXuZpcahVK97jOGU//DklKxyA5E7Z/dF1Dk7VkYHvOFPO8ULX/wvCYgXmxVbNdqh6hC6E71wcXGIRyJWlWumM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(7416014)(366016)(1800799024)(376014)(10067099003)(6133799003)(22082099003)(18002099003)(56012099006);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?C8v7kLHO9abapHpgbQ3UcecJsJT4qhGt5AaXNm6lEQnQ4StQpY046bnpxDCS?= =?us-ascii?Q?anrZ1lq+09yQFMojgJZdZG9meqimpVinzR3vvMZKGOcFMyl7075Hf1A2VCJb?= =?us-ascii?Q?iBIjXh13dL0X5AvQ2LLu7DbbAvf251wt4RGiW/7hqy2cp2RUQL5jLTIIxQ3u?= =?us-ascii?Q?UyojCbXbDy7u6kAxJBzuL/0BagEwlVDmQCewhji9j7PYUzPlyhkmcMUx2z4l?= =?us-ascii?Q?bRF2VU+H7pzJ8zh8f5n5HS/N7sisLxigvMV4sDydk1jly9O8Jc4fmx8kJE3F?= =?us-ascii?Q?IGKBBOWw/LswD4LCkIxG+QW0BaDJq3ISQ7Xwv6cHOuJQR41ms2BvAHMFd+qd?= =?us-ascii?Q?MJY2csdfelGeXl+z/ItBkfjGG+X+p30mWU+ZwiSheuSXjFvlNXpYzlK71Ya3?= =?us-ascii?Q?rw1Cx+4XiEgIq+pmB9zwOzTHl8bAH11XONrbruqMnlODJNynBUrKCmkinVo9?= =?us-ascii?Q?uXuhHKZ5i/+Fm4pMa6EeINtM5t4doxgPCNF3gz2nvRWOmzrDE3GNO0xFkr5L?= =?us-ascii?Q?lmKIuUgvOS0j1w6qZiwEhczjVNTD9moi0CT2UUROg7EOy3FiaTmAX0iQjJsY?= =?us-ascii?Q?DBuXeXxtD8WyfMO7YfLpGpzVhJyYQ/eM8iyaQS6OJk+XVnaYyCKG/Sf87k5B?= =?us-ascii?Q?6aRMDvLm8F8JCrV5DQFrgy8gBHRw+Bk7b6sH9F56CIEPwuq1vIMC011BPm/e?= =?us-ascii?Q?XnK8IJYZ7GOdKfG8onxdnhhUUk1ZX/vJpTF11BTfoy1AERZatoCtdIWJzC/n?= =?us-ascii?Q?b6kIXkWMfnzVSa8RwtPboewUHZZegsMzQkNd9r/oziMFAgrUZlV8YhxCeuCX?= =?us-ascii?Q?g3raA1WSedYqyZHGdRFdNvmUjYO8WMjvsAjcEWHJIBROaCSpQlvlOaaROIVo?= =?us-ascii?Q?fvtZltfS2+97/38n+jd89He7POoXRoML+Pfx3Tpzye/QkxDU2guKdab0yF1K?= =?us-ascii?Q?mDIs+Uf0Qk1Fmn8qm3Ics4JWUlXmoOFwCqv8opygvHdomJ2IiMpMkxn9s0vm?= =?us-ascii?Q?YbVim6lCXVfbdhsNdkzvwtVqp2uUYSfJ1kq+OAXAr6+W0wQSGQhQo4iieuFR?= =?us-ascii?Q?LT2QmUoNGsETV8iu2q1EHJoikfYLbLxQQSW8pBKwB06yIBGm77MaJDrYlhTr?= =?us-ascii?Q?w798dlTioYljLW0uDRWaThMJFFQ29qAZpGFHGpHCLC9s3HHfUO0kg0Zz3ojN?= =?us-ascii?Q?J1UhU9/9gYxt9xAfKj9UC0NksFcmCDKARAmHV6ykhKngk7O+U1GBCZefHXkP?= =?us-ascii?Q?rdAdfJBCKsQUSzIDvmkkxzFKCkFpNGlfLoGXLBXUDzC48rnUkD4Pa5o/Irwz?= =?us-ascii?Q?JuCYnldaYon9zI8vs0wRND2By8cWnDEtybUB792vAYWoRlR/xRO/bR9bSKIY?= =?us-ascii?Q?69mNxqDtyP0krMFtShR+E5pplbMqLUA3k7vb+j0lb9syL/PrbA0aSsjPgyPU?= =?us-ascii?Q?Il+Yz4hvaFjqV2olxWvfUpo2ylzCixJPtv6qNUQh5IWqJnCxPcsA8zPLGZAk?= =?us-ascii?Q?ybbQH9B4Eq0rNxLOYmB7MqQKwiyBcZ+qci3kU4X2NybvDUn2eijyfKECcD9I?= =?us-ascii?Q?+0fzBmQO0HPoutgGZyrR8Hu5zqzkMFyguYb8d7xalfpZla3hQnfOtZOxuC1D?= =?us-ascii?Q?T+9jz3oRCixuO+SJEuwUx4prq/1Xkhjo3bn6SJrYqL/SGzP04+DsE7iJzbge?= =?us-ascii?Q?fqgR8TES7ig9vN9UZcBs4U0L655U2UIaWITYkPJh2btUjYr5sk0r1/o8GIzq?= =?us-ascii?Q?cucFSHFObA=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 96ed322a-e8d2-4073-6bc0-08df0c829ec8 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 Sep 2026 01:52:05.9850 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: SYO3eIQV63orqNfyD6SlwkN979joCICalRyLJfM0IQGPSF6ZT8sLcbNpuKtFkFO73nGYwGDzTErH76+f5z5bFQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: LO0P123MB7403 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented perf_event_attr arguments via syscall_arg__scnprintf_augmented_perf_event_attr(), arg->augmented.args->value is cast to struct perf_event_attr and read without verifying that the captured payload is large enough to contain at least PERF_ATTR_SIZE_VER0 bytes. If a malformed or truncated perf.data record provides an augmented payload smaller than PERF_ATTR_SIZE_VER0, accessing attr->size or executing memcpy(&local_attr, attr, PERF_ATTR_SIZE_VER0) reads memory past the end of the available buffer. Validate that arg->augmented.size is at least sizeof(struct augmented_arg) and that augmented_arg->size is at least PERF_ATTR_SIZE_VER0 while remaining within the available buffer. If validation fails, fall back to printing the raw pointer value. Fixes: a9cd6c676685 ("perf trace: Add BPF augmenter to perf_event_open()'s = 'struct perf_event_attr' arg") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/trace/beauty/perf_event_open.c | 19 ++++++++++++++++--- 1 file changed, 16 insertions(+), 3 deletions(-) diff --git a/tools/perf/trace/beauty/perf_event_open.c b/tools/perf/trace/b= eauty/perf_event_open.c index 6315b46bcdf0..846738225abd 100644 --- a/tools/perf/trace/beauty/perf_event_open.c +++ b/tools/perf/trace/beauty/perf_event_open.c @@ -81,9 +81,18 @@ static size_t perf_event_attr___scnprintf(struct perf_ev= ent_attr *attr, char *bf =20 static size_t syscall_arg__scnprintf_augmented_perf_event_attr(struct sysc= all_arg *arg, char *bf, size_t size) { - struct perf_event_attr *attr =3D (void *)arg->augmented.args->value; + struct augmented_arg *augmented_arg =3D arg->augmented.args; + struct perf_event_attr *attr; struct perf_event_attr local_attr; =20 + if (arg->augmented.size < (int)sizeof(*augmented_arg)) + return 0; + + if (augmented_arg->size < (int)PERF_ATTR_SIZE_VER0 || + augmented_arg->size > arg->augmented.size - (int)sizeof(*augmented_ar= g)) + return 0; + + attr =3D (void *)augmented_arg->value; /* * augmented_raw_syscalls.bpf.c (shipped with perf) copies * PERF_ATTR_SIZE_VER0 bytes when the tracee passes size=3D0, @@ -107,8 +116,12 @@ static size_t syscall_arg__scnprintf_augmented_perf_ev= ent_attr(struct syscall_ar =20 size_t syscall_arg__scnprintf_perf_event_attr(char *bf, size_t size, struc= t syscall_arg *arg) { - if (arg->augmented.args) - return syscall_arg__scnprintf_augmented_perf_event_attr(arg, bf, size); + if (arg->augmented.args) { + size_t printed =3D syscall_arg__scnprintf_augmented_perf_event_attr(arg,= bf, size); + + if (printed) + return printed; + } =20 return scnprintf(bf, size, "%#lx", arg->val); } --=20 2.55.0