From nobody Sat Sep 26 01:03:41 2026 Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022136.outbound.protection.outlook.com [52.101.101.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 8D3C7377AB3; Sat, 19 Sep 2026 00:55:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.101.136 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779355; cv=fail; b=DyxKYcFQOTWmmyNJ+/RR2Go5FuJXwy0WFFK4z3q6xtf8z7k6FsFPjjkjy/gPwLafgkLcwL1fa3583X22mu+wHfyGyoWdyx/9+NCbSVCfNEXh44F9yQTm1E1hfGSgsuWoKYBTVm4mhihvHdM7wdGnnFScJ6jM+pamY/DCQOSVWkk= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779355; c=relaxed/simple; bh=ZpnpghZ0z524mR0DKZs2zFnsVNI0s4Sm6Xpdy7qOwao=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=Qc0vym55G76ms5Ye+wVqMV5AIrwWtEFLNM1RwIivrl9+bsngJZfnPAjzMkoNZBZSavyylDR2PpZoq3HYLC6RuRO18vjXYf6hi/IpE2r3ChGiqn8z0NRgpIE816OVzPre0mkdVNRLApEgVqRNXKdGRP906lLmULPpf6PqRE8vHFA= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.101.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=PL2TpNSuL3SlX6cuBFKTR7WPgAFWBFUN6VAUD8MRPLPD5yqgMX0P31/oqKhOF/Q7XDlMpghbMnouBq92DDJ0y7JTtH2Rvlp2URAs8lFNAh6twd5oEYDqJ/R53MUm4c7N38YD+52PK71PeVJxOl1AB1lNc6q8jASlLX8BGFa1JpU5oBeA9DPZXsdm9unWHfMiM+K/5lcouzoGKbuSNPgN7v8EATRvwjQtcxpH5edf25J3r15lHr3llEyAAM6EZSEbYfhdDDkUOJbCnLR8CcepVhk04Cn3OR5wskKz26z4w6YClR7NvgRIH2mIiUM5rs/nLbXIy9yq9zWTrZQiTg30FA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=u8N9PIlQkD1JtlRBzMDFvp9S8jRdFuxaB5wRbbyP+yI=; b=TUMuJ1MXENwgML8tOVrQWDWMeY4U95wOHquF6bS5IJDYIGQ5tudSThKPxQ0fnZ3VjXs71OtzjGspqXzLoq3kbD296Ehn9Hqse1s4AmTmi1C3VgRhHVFxWnLSIP0x+2wy07ObWT0DYhTeROoAQcfU4lAqOhfRy4XLjUQM1FDXpMaVpOJes4AOjNfYRNaN3swmnf1hr4Gt49cpR8Lr+qlZIhBET87s6PDTx3qK/73LR0/50H5lRF77AtYmfNaVtFFr8q3HvBXsMNvEVUn8GK1O2n5R9n6ndshGOBRV40AG3mO9rA5Fd79brbEuXaLdAnjcOqf9UIJB+30sJj6uYJ+stg== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB2769.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:55::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.14; Sat, 19 Sep 2026 00:55:37 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0428.011; Sat, 19 Sep 2026 00:55:37 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 perf-tools-next 1/7] perf trace: Add upper bound checks for augmented BTF struct printing Date: Fri, 18 Sep 2026 20:55:24 -0400 Message-ID: <20260919005530.728615-2-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919005530.728615-1-atomlin@atomlin.com> References: <20260919005530.728615-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0205.namprd03.prod.outlook.com (2603:10b6:408:f9::30) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB2769:EE_ X-MS-Office365-Filtering-Correlation-Id: db5e5c77-8e83-4053-1280-08df15e8b80d X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|23010399003|366016|10067099003|56012099006|6133799003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: uisjBZ7DHg8qmbr1V+b9OR7QfjT0DHUAyo45hs+CcVzbbGamES6BoiNs2Tkl+RwFyqbLlUzGolljmDdbX62xengNkf5ELgVapW3/FYKu8y56kaQWPM0um+RhMKFzgA2M6Em9Gb3uBNi/rL/ntD6qQcjc3EhDBmeHv0XCUaaMgOz+SZpW9LoK2Vs1se5Gx/KCzF3joEiM292A4MqDnQ8kHgrTs1p6SIS7Io6ZyeNy7Z2r6ljBewdET9n7WEad+2H/3bhg9sgSaXC8iCRObxJXUVUKzraCBtyCoVYtZAArwJnCqm6TVV8OnTjV8j6XDV3XnNUP7MajwFcLWqpJlRHkmFDmniKguINJ33PfNEZAoTe+2GVHcrxuVFoROPz7rjkcI+L8ZYjBAOqWiwIlaxojagFAbwbZ4ZRVlew3rb4VlsDtG0oDdmlG+zo6w0Z770/D0f5Xi2DDZ8DRoUYEqzBFVIPAyA2QCF+StfeR6Izue0p5yjhLaxIuWL5nylyAdot8w0teeBN0uIqioAo/R3eos+NvNBW4J3yXSz4yzpFASEe2CDv/Y6KGATG1MtLWY7VJ7Zfrpq00CNM2c1V7R6XJvafStvRyzg+1sVoTqTc+u5qzPRWtU6PmoeOrRNDlpvs9aIl59ByJUgAyYYYfCIqo+x3psxvH9q26tJb4Zg7WoTg= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(23010399003)(366016)(10067099003)(56012099006)(6133799003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?HN19nIfgCvCa6RkrkdGW2uYx7d6To9dzrbYMozpALgAnjEEYi8X7MTL7tDUi?= =?us-ascii?Q?rHx3tBQK8RpqX0E2+mz/x2vUJsNC8bHezHTHDU6FWkqvLs/mW1xCEbc79gzr?= =?us-ascii?Q?jF2YfrDIFpHNRtbbY4Iaxg830T65mj1PWr5bCUANkD/aoiYUwES/Q9ednLsE?= =?us-ascii?Q?eGd1tC4mLa2G5DBDcn7+5RXskq665YxZVcftAoLbkdBOyhu4B8/A0xihNhih?= =?us-ascii?Q?MDfgG/eR0L28+xjjKDNN9TJmzaZb1zPRxgr6rv8SmFWDMugD5S1jOs09ZDeX?= =?us-ascii?Q?mhJvUrJVfW4JHICAIXAXdYQ2ld1IAIIUKV8WgnsCrdMjOktO3VqXH5eaYbr2?= =?us-ascii?Q?WutuajEEakws47Xg4vfzc/ScEpkSflLgG35keYx3yoPife3Nw2h4Tf22CF/Q?= =?us-ascii?Q?CofPAzXRkpv/9wNzqYnFVSBxydZGOoJDyNX8qn88SnDkGH/yAb7tS3Itrx3c?= =?us-ascii?Q?6L+Tl2RVnK5NgR7YEAx8y2Ss0bwxNlZiFveMQIPcSR4dpsUfk+Q199kn0zLD?= =?us-ascii?Q?SQ4WdfFmZvsC82549RURByVBd3Qii8sI41A7kQST2MCdj8m1V+DTH63UBzVs?= =?us-ascii?Q?yCxVOXwoNQe05mC6bmGRwF/MjNahJxtWEKW+AnTT54+6Wc8WVZGNYy4K+5U8?= =?us-ascii?Q?/xOjjdr56mzsFYdoXRU6YEevnAw9PLuNm5WcbLtyI5h9/oW+QhODLs/tjt7i?= =?us-ascii?Q?dzrQA6hWPjG/eHJK12cteRMStkOH03B3a3RMTq1U2EOVTjJxN7UbjQnwUnbs?= =?us-ascii?Q?KLnAvSGoLy9fIPn9otAyEsD5Y2aplhodfv8G2Yo+ppemYjwu7N5PbDJk9G5v?= =?us-ascii?Q?PxmEDHmxPOSteMUJiXTg1htgEuBlHnwrgp6KPGNywoqlaNocQF9FTWNf2iLx?= =?us-ascii?Q?cjNKwhndxP7bIh3yjyjpDGubmbRiBYljaxTsi6ZorzxiLVp6betRDVXf5sBM?= =?us-ascii?Q?8QLzAb3lheshGkBRi+RBT+ZxlF0E03BmDUdm/PGDD8nP+X+GWhd74tOVvyx+?= =?us-ascii?Q?wtc5+hBgy7F4fivi/+A7+312tLX+JU9ZF2UbqRLr+aEQ9FXOH0rdzkfW5Zl7?= =?us-ascii?Q?r60BHRrPSgBDkcf+uXvDAFJgkh78mt8WmaBAR98Qo+ZzC0oqiR9L+oh9Ov1L?= =?us-ascii?Q?o9i14uQIgDpSaS2YLfplUT1u5oEbNajS53e/dgKGnNjfdbH+qhZFvltq4gb/?= =?us-ascii?Q?9iqhjst84MXgOUDOVbaetGV7gpeMdZ+ok5XBAAEvTXxehgxoIT1E3she5GcQ?= =?us-ascii?Q?jiGmyvvuVi9Ce4b+cH4i53muX7yueJzfBb1FFwpceu11+fiMcWKbYv0MyrMM?= =?us-ascii?Q?mNyPyBLvsRGO590domN1dI3Nm/qZFIRQlU1ZUwy/IRrRgE1/oL+7n6pOJPX7?= =?us-ascii?Q?aC0m55YYCJFwia3Ygo//Iqoz/+BBhas9VCaVqjeeVXk2BiFhrCik+LS4ZWho?= =?us-ascii?Q?xQ+KUl7iUK/lj73bAMlP7o21nDY6Kqn95nNp9wBeV21kBoaO/iDnwci0cpcF?= =?us-ascii?Q?+rSGR0fkPfpYeBMs4LGXIf2vwEIYnNp6Uz1Bo6hjwOC/jL8OlhpvumTKlXZk?= =?us-ascii?Q?lHESrR+u+NfQCFtPmfvtmeQAah2AswtYLV5cxLrqkviMZqlNaey4gbhQCYc2?= =?us-ascii?Q?jrX24LtUusE1TYC5tOhnfE5v3kbT7oBevzq1/M99rym1eacU0gni3jdd/zIB?= =?us-ascii?Q?fDlSQhs8FocHC/WcTmkZOAoDzIDZsJXiqOpJp5pJwUe4KI4Cs5RzajA1qhFf?= =?us-ascii?Q?6X1lgSFt0w=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: db5e5c77-8e83-4053-1280-08df15e8b80d X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2026 00:55:37.5543 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: jAB4Pb7PW6CLjQFgwcfJrrK88YGznUJ2IdyGxqsuwmMelqrha18iDxheuksjFOGgN+sGidIX7HgjH1kfks8bsA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB2769 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented struct payloads using BTF via btf_struct_scnprintf(), augmented_arg->size is currently only validated against values <=3D 0. However, several edge cases can result in size mismatches or buffer over-reads: 1. If arg->augmented.size is smaller than sizeof(*augmented_arg), dereferencing augmented_arg->size reads past the available buffer. 2. If augmented_arg->size exceeds arg->augmented.size - sizeof(*augmented_arg), calculating consumed =3D sizeof(*augmented_arg) + augmented_arg->size can overflow signed integer limits (e.g., with crafted INT_MAX values in an untrusted perf.data file) or cause arg->augmented.size to underflow. This advances arg->augmented.args out of bounds, corrupting the parsing state for subsequent arguments in multi-argument syscalls. 3. If the captured payload is truncated (e.g., short reads in BPF, or during cross-architecture analysis such as replaying a 32-bit perf.data on a 64-bit host where host BTF type->size exceeds the 32-bit target payload), passing type->size to btf_dump__dump_type_data() causes libbpf to read past the end of the payload buffer. Enforce an upper bound on augmented_arg->size against the remaining buffer (arg->augmented.size - sizeof(*augmented_arg)) and verify that the captured payload contains at least type->size bytes before passing it to btf_dump__dump_type_data(). Fixes: cb32035214b9 ("perf trace: Pretty print struct data") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/builtin-trace.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c index be19d70eba09..20fffc24507b 100644 --- a/tools/perf/builtin-trace.c +++ b/tools/perf/builtin-trace.c @@ -1133,12 +1133,13 @@ static size_t btf_struct_scnprintf(const struct btf= _type *type, struct btf *btf, LIBBPF_OPTS(btf_dump_opts, dump_opts); LIBBPF_OPTS(btf_dump_type_data_opts, dump_data_opts); =20 - if (arg =3D=3D NULL || arg->augmented.args =3D=3D NULL || arg->augmented.= size <=3D 0 || + if (arg =3D=3D NULL || arg->augmented.args =3D=3D NULL || arg->augmented.= size < (int)sizeof(*augmented_arg) || arg->fmt =3D=3D NULL || !arg->fmt->from_user) return 0; =20 augmented_arg =3D arg->augmented.args; - if (augmented_arg->size <=3D 0) + if (augmented_arg->size <=3D 0 || augmented_arg->size > arg->augmented.si= ze - (int)sizeof(*augmented_arg) || + (size_t)augmented_arg->size < type->size) return 0; =20 dump_data_opts.compact =3D true; --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022136.outbound.protection.outlook.com [52.101.101.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BF5D73793D5; Sat, 19 Sep 2026 00:55:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.101.136 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779360; cv=fail; b=D7nkHjRhHlZSogZIwYSnVNQMIpQ+QBpsHkj49DjSmrYvH8864uaVfeozWmzThsN/0+1mpxkZJc7wP/UhcLgGC2wB3XSrDKIheXeypaA0cP2I+7vU+NfitrzyavS/nFZ2SZiNKdsK1CoCeB7+M1Q6AscKILJ2FUPTFip1luviLRw= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779360; c=relaxed/simple; bh=x24ZmTHBXsAk5BPrPRjAa5DtUj9NBdAXHv/n3V+pwlg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=P9yUjtwgnThzxJZrdgU5WwUzcRHmPW2GGyh1Ug8/bLeNLCoG2ATL2KtPn7hLoozeE6MLe0P2CC0CcUTF06nQzVdZEH4IcbVlbIUPw1kuyFTZabiXda5s3zlaoCFGGSJzTPbTtAS6x4MesZvW3urzlaITrEeJp3lcvU21TzGXoFQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.101.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=FeTCkuJlP5lLTWZHnEY+dSct9+nNgvlDnzCtXtjAtEk4x0FsEO3p0bPMpkoP3ZqMChEfU4Ycq2AId5qoQtDwi56Rrs6jiGTNhiYhMYxs5ozFK4w+VxUihDOJtjYtAyd8xFSAWmHfLnPCoAlt2t8AJzagjrC1iESlwH/Jmw4qgQgJhYzFAJ22XBo2S+JQ6JwJk99eUyT4qeiBtFTbmUy8ieXLqr7muF3ElXimuIWuwww7nl/r4JEYEhh6Dep39L4CBY7/yCay39sOPQ9mz+sS9N07gd3iJmmRMcYuR6HUTFJQcbaok9NChKfHNQNFuu/TBCTvdUG7/H5KSw4r143HpQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=qtwNUEQ6P1aVdHeKLYPanHhIQHzxTZXzFfhkJLV/8E8=; b=uqDmXD/voxXnxJ4+AUgeDznoNOzp/YdsowEKwWZFd+l57W9noJVKehpMMBeaTXg6eb4L+Za4ooSzBJrpbrGs0CGqvsJaNQeHFDadDXiZBuNzHmC4rZt5+F3KeM1C+jxVC6hcyhdmo/tTZHAwnasTiR1H98W1YSEchCFKcQ006o/pPxL1gkjr2uybjdFzUV1x6+7W+bbol0Hic1Eta3xFY2A9YXA+pPDo9OhbYVe38LbfiZDA2oZYL5U0lidysn3Mujh91ML6Lpa3aJrEho9TDjyeeFQ1StkSwE3//RKAd2yA8WMsojUEPHqsyGW8VPrZ+ObF2uVS2RUdnrFyA/+3nA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB2769.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:55::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.14; Sat, 19 Sep 2026 00:55:41 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0428.011; Sat, 19 Sep 2026 00:55:41 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 perf-tools-next 2/7] perf trace: Validate payload bounds in augmented string beautifier Date: Fri, 18 Sep 2026 20:55:25 -0400 Message-ID: <20260919005530.728615-3-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919005530.728615-1-atomlin@atomlin.com> References: <20260919005530.728615-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN1PR12CA0023.namprd12.prod.outlook.com (2603:10b6:408:e1::28) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB2769:EE_ X-MS-Office365-Filtering-Correlation-Id: f3aa404a-6b4e-4e30-916c-08df15e8ba45 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|23010399003|366016|10067099003|56012099006|6133799003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: L08boMZzsgzONsz6h9U82dmayq1XfgG+u4C1BgFeRQ0iyh1lVFPb56xuXu3vZ2ToT6l8gmZEEZEpHNYAXTkd1xNqbe7tePLDx9wfEcAZE4R7K+25lqNoL1bMVJgs1txVwFYp/jhroTP1z1Lb90zfVW8ExdIOLB2MGOl9bxTMtG3zjFRdQaLJdVm/726EcSJZdLfpdYO/jvUGu/xCwjkI7+wvoeI6yZ5ySsE2FXJKJgTxo2x5HMXfjn2U4iIOkDSHOpZHl7T69vKcDFrJ++39CBDunKstPa+Zx9q61hkMy6/BxQ6ga+d0EcqqXxHvad3hQ2kyntNgOXEU+I2ypLgx9ivpExkjSCz3EI2RH52hWsuW45vQbTapg1dyi6IoK8vUt8QAFFr6BEU5XhlJdARTv+8gu8YpmGPjSixO87aUyKKeKIigD3xKaS4fzPJv4a6soNtxOxnhYKUz8jFDtkdP0BdSiDSLFewGEbz1sSu+bhcqNGaIFgMkmc80c05Q3I5awEUSTXWglbNbRFiRYmgGz2AwRGc2QrU5KhMgqxoel6Lr1pyFpnV+suUmgFLF2Zxo13k/yTz9c2rLpWJ5IfoDsGkNwMKeYYsBznTONk5OXh/DIy04sCesSZTu4qOr0PQsPHh3y3qy7nL1ijFXiML1eJBZcGN/ZXPuEqVGcxQjITA= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(23010399003)(366016)(10067099003)(56012099006)(6133799003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+9sjpX+sqqrVEHoIYI47qC0FbyfGql4egaBVPDW2Ma3WuOxcrJZku9CbXCu9?= =?us-ascii?Q?HtyFJKSjwF+WUwnWeMXOGENXYAr3pjyjB1g3X7uBOIsrP1nf/vm5ZHR8tAQD?= =?us-ascii?Q?MW5+eah6g2Wmhs+g+Vb9wfZuY9bcJ3Yy5znfEnt6i9Gz91Am3+BeaAdrzBvf?= =?us-ascii?Q?vMrHqbs6n3t0IxJwhJpnujlRYLCWC6ZCEPbPXjHbbmefuG4lnxua+Ha78cE+?= =?us-ascii?Q?j7rFH4//VsgYzr4dmpwhiU8OhG05pNSplwJplBnwCO/dVyRJmt7NJpAIls6H?= =?us-ascii?Q?iWNWUmsMENaV5Q1VgQKmsMf4yswaoZQN2Udqd84r7xcNAkFe+BgH/pzryBRZ?= =?us-ascii?Q?tPSUNzuc5TORxp1agEitTa+jCJPifjKKbYaQiSXIN8VutknTiPy7C8sHTjyY?= =?us-ascii?Q?yn+vLrgb/LY5yoFJJi4YkpbbNUyrBAHbnjPt5Hmf06UHO2bAyE7VAS1TSbzC?= =?us-ascii?Q?u1L4iZj7/LqwyZ86sTObF+lYeHIDmZmRyxRH1GlcCly2Iul3ziOE2NvVaeRx?= =?us-ascii?Q?efGWzi/Avv3d8ETIVXrPneB2Q5kcgyTVGxhetnzvu+0QJkSjRRSkwvOkLxeP?= =?us-ascii?Q?vAC/5jTHg3ytrlkQLAjACDfo4dEOqimIVmrJgX1jWeA2xQLQ9ZML7J8XXB5g?= =?us-ascii?Q?3bvT34XYE2N1XZndhWsRL7m2Qk8CS51zj8qCQwVF+f6YFDOj+BnK4Zbo5T8m?= =?us-ascii?Q?8uF0qsovlSUbGNKPqh9ROYqxgdRChIcVhic8dVdH48AUCi86xc1cQ1a+VIFe?= =?us-ascii?Q?I+lzSPCz/AfkJZ2yIf7tV+2cPgh/cYVOVPMtpNkj+kqvcFMu7fIFipGv3Py9?= =?us-ascii?Q?/rJa4jzoWJ9Rq+KXDJQjtjqxHGaCTaE6O6FRTinvIGpqjApC8WiT0jBOckCZ?= =?us-ascii?Q?MPR81NQ8hTQWq5VyL//I0cDC4g4myMozByg88/6DIkBL8UVK2q/pgqo4HOYS?= =?us-ascii?Q?CvckOCEB6eJqK5I87EXMLiAE7HPo2Xnwn/m4Tp0NoFPI5M/LivWzG5UffbBS?= =?us-ascii?Q?rz/7MpLfaOm8roH/u21CAXsPh9hWwCwLlrBpZFKZNm9uWhWSkE6ewSWXJZsH?= =?us-ascii?Q?7DOHDfhBn+QsCvqoxXiUFklBwOB/qep+U+4N1J+Y3xU9C1aTIkBQFKJhBfUS?= =?us-ascii?Q?SyXQ6GXZNuo91NoOMAbZIxJP6B5ceZApestqhvo0OHmupwNdCEcYEnr+jxS4?= =?us-ascii?Q?7JFsRdjzHuDcJsvHenzdD2RW0LGfOFQoCVlmpyO59zJUTKap7s2iQkPWB8qK?= =?us-ascii?Q?ryHLp2bqEzLXkVJbs8J9BBwaxwNIvCkky1r+Dj6+NE6beon6rbASsnxIE3RK?= =?us-ascii?Q?GjLw2utk6iheQQo8SgdeKC8Z5Qn833s7VY3WWWlaVJNqOzYNAN3FGbp/e1vH?= =?us-ascii?Q?b2BfTJcQVdxe34GGGeNxmP/NBOZIEfKtKulRWRPtE8D3BVr2M5RjvlmgtO6/?= =?us-ascii?Q?FNXq/CyANbi6mEaq2nJX7MxVJWLZRHGoUCL0rHatALBQH/ZNYnu0oBRbv0h3?= =?us-ascii?Q?lWmINV5po9iuk4XTaxrTe9KPAvz/oTG3u+XOgoX2+ZQf3hgA4NzoiBJiz9cI?= =?us-ascii?Q?EXVL4K+LYNFR50oCetk3OxHibZxNOGJJr8PyNiVLKsf703oFsIfzet2AV05I?= =?us-ascii?Q?Esnq2/RzZJkIVIbL7YywL0/4F/KZmHEFnPtwf1SysbiborcAYnDJ4sRF5Mpe?= =?us-ascii?Q?Syo77QYNirAhaezw5+ujrUYQlkFV0zbHyoLCXWTVd0M+UuZpwJE2je3GJ37W?= =?us-ascii?Q?HqmWX83iXg=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: f3aa404a-6b4e-4e30-916c-08df15e8ba45 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2026 00:55:41.3222 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: rXKILzDSQWPtokIS7F+mU60y8o8dXDtVPcuq5PMpXhh6C8xLv5jWoLVrTn4NNP64ChlNE2efbajRNRw0bTx/9A== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB2769 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented string arguments via syscall_arg__scnprintf_augmented_string(), augmented_arg->size is not validated against the remaining buffer size (arg->augmented.size). If a malformed or truncated perf.data record provides an invalid or excessively large augmented_arg->size: 1. If arg->augmented.size is smaller than sizeof(*augmented_arg), dereferencing augmented_arg->size reads past the available buffer. 2. Calculating consumed =3D sizeof(*augmented_arg) + augmented_arg->size can overflow signed integer bounds or cause arg->augmented.size to underflow, advancing arg->augmented.args out of bounds and corrupting the parsing state for subsequent arguments in multi-argument syscalls. Validate that arg->augmented.size is large enough to hold sizeof(*augmented_arg) and that augmented_arg->size is within the bounds of the remaining buffer before printing or calculating consumed bytes. If validation fails, fall back to printing the raw pointer value. Fixes: 8195168e8779 ("perf trace: Consume the augmented_raw_syscalls payloa= d") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/builtin-trace.c | 21 +++++++++++++++++---- 1 file changed, 17 insertions(+), 4 deletions(-) diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c index 20fffc24507b..91461ab927b6 100644 --- a/tools/perf/builtin-trace.c +++ b/tools/perf/builtin-trace.c @@ -1898,12 +1898,21 @@ static void thread__set_filename_pos(struct thread = *thread, const char *bf, static size_t syscall_arg__scnprintf_augmented_string(struct syscall_arg *= arg, char *bf, size_t size) { struct augmented_arg *augmented_arg =3D arg->augmented.args; - size_t printed =3D scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, a= ugmented_arg->value); + size_t printed; + int consumed; + + if (arg->augmented.size < (int)sizeof(*augmented_arg)) + return 0; + + if (augmented_arg->size <=3D 0 || augmented_arg->size > arg->augmented.si= ze - (int)sizeof(*augmented_arg)) + return 0; + + printed =3D scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmente= d_arg->value); /* * So that the next arg with a payload can consume its augmented arg, i.e= . for rename* syscalls * we would have two strings, each prefixed by its size. */ - int consumed =3D sizeof(*augmented_arg) + augmented_arg->size; + consumed =3D sizeof(*augmented_arg) + augmented_arg->size; =20 arg->augmented.args =3D ((void *)arg->augmented.args) + consumed; arg->augmented.size -=3D consumed; @@ -1916,8 +1925,12 @@ static size_t syscall_arg__scnprintf_filename(char *= bf, size_t size, { unsigned long ptr =3D arg->val; =20 - if (arg->augmented.args) - return syscall_arg__scnprintf_augmented_string(arg, bf, size); + if (arg->augmented.args) { + size_t printed =3D syscall_arg__scnprintf_augmented_string(arg, bf, size= ); + + if (printed) + return printed; + } =20 if (!arg->trace->vfs_getname) return scnprintf(bf, size, "%#x", ptr); --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022113.outbound.protection.outlook.com [52.101.101.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0B296379EF0; Sat, 19 Sep 2026 00:56:07 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.101.113 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779376; cv=fail; b=KJV/YXCJSbFZO5pETVPQvfg3HmFhihMsIgI0gsikRhTYOAhxRgi/EtttxKH+xgO4NvYyMPG5SIrjK72U4z+oCL3EQTEz3t0P1PR9yQQo4T2a8l2gCAoHIkE3XcoSq/Js1kiS6F1vRqEZEmXAcXSQkK1Mi7Yar/7dXVDSU3UEajc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779376; c=relaxed/simple; bh=8FzfVZiSK95kQ3iGwU5eIpymwJus/HUeRyPFSVyFI60=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=GcJc7GVEknOKTAbkc05l8Oy6SVWk+z/r5PoSWXo+JSYTO6LJn3vY/oM89ywDVi31VcAqXV+Jdd3DO5WTnWauLGl7WY5pJQnDuiZE8eRuiWqhn92x3Ic0bmMi4mMZwMOvpOwSe9FrsV6eu3rvFuZX6cy9SW5OXXA/uoS7xXnUBNE= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.101.113 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=Mo67u3/HSDH0UppsQjVnPwLPoe2iqgiI7JenIx/S6boBdQb8r9i4HHmVtlNfa5VDbm6dIRh/ISKoBHwcJnTeex3w+MezoGLevx/+UDwJFgbE/HK+FVT021TzQo+rpe2hpFEaqGbhR6xSU9RpYc32zv8kBYuioJovfHL66/GHSg4RIMyse/yxFvA1jK55QOtfjRreKe/MkEzoY9HkbGPEZ4qMa1C/Nrzvmhj1iVsFJ29MJemZ3HLPokVf0zt74MpEcI4P8C2NFh1RN76G6gdFIzLGPoP4kGnBOlOmxBXYpzbZxkzRScoSWRdSSRZhBoJh8BEhRZVtdJ74+NxDhPOiMw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=vFmUu4WU+UjHQ12N5OLB7qxHkankLDp0G69UXGk6Go0=; b=dlXTmaaUhQifmYmz/IV2IpBqLBAKx7LJ0Qt/kvqCgw8O/oF0K87gnbFyzBeeXI5Yb1W57STww1glAG0TBqUFL+M3NEotRy85ZiI41XT2WIg3NHTg8RRPWUnnQvE//095UiIr14uXsDMceJcVMsIlpjSnT6BY3jAIi9Cmac2AiTVTDxLJlHaEJh2X5znXyYqYHZDa31gBK1HG7dCqQj4jqkzsKCPgpSO2l4yGNa+tDD7Jme7P3qjhLtm6ydWLpCvHgdwKUhELuuzcFFrnQH7drL7orY34RFQTllrjyDb+6pysxX4cWvU/B3d1PrG5IyK9zaAI6cC/YgfCwWb0urJZlw== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB2769.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:55::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.14; Sat, 19 Sep 2026 00:55:45 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0428.011; Sat, 19 Sep 2026 00:55:45 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 perf-tools-next 3/7] perf trace: Align pointer advance in augmented string beautifier Date: Fri, 18 Sep 2026 20:55:26 -0400 Message-ID: <20260919005530.728615-4-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919005530.728615-1-atomlin@atomlin.com> References: <20260919005530.728615-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0096.namprd03.prod.outlook.com (2603:10b6:408:fd::11) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB2769:EE_ X-MS-Office365-Filtering-Correlation-Id: 9bb95fd9-eae2-462d-4e3b-08df15e8bc6e X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|23010399003|366016|10067099003|56012099006|6133799003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: vUo4sEBMzUUeqBp5K54MrWheTbYGrqjC6qX9+Rf1RAA6ItniXRrSKR6tv/LfP29ZR6j6zPFSalxYsmRybwxI40D5ssIV9YdKgJ6M9FZy2Kf4p/otpbYtlXmxJDb3NojZfRv7B244IRbDPiPeukz4M4Ni//LBXMmYzzc6w/JFAdq9Nwwkt8ObQ7CFPrrgMBTyxOHqLyOahQZiSBquWLs51NvE2DIA8U4KvHeROXNF3bUOumFcCAr7jB6vfe8HcSAJsJxvLD/cb3FtjgAh7jkl1D4MtCcL6XUE5UGNXQXoRO/BXt6XA2rCnHM5Hmhd2Oz5P3yaxte42UDD6ILQ2t04jER+4h2Aifo0Dw5iL0Cm4/O4JmCD0BzpTBosWRHTSa3Tb8Lj1i2DWZBnnGufYGF2uN9XsKxiObUxozhlqKT7FzIaj7E0MMmoa/yYcKkdvEQkS6zE+56APQIqtthbQH0ZiZ3niJ/eW23WdzR9txMi4Ic/9nSxJ2bFtTiBfr0YWy+siiFspoGrYWnSIT3xnCPk4fnKWua1XpcY50M8HHI5C9aN+0uY8cM6fFO3dwOxUEWl6E2XkF1fVCh8N8nuufKmVNks00vVJpyBsdHh96i2LI8evSg35OhhIJXgTZy6tbJ6ZfFUsZMeBQlkjIQQ6EyKsfdPYhSvvXE1xuY6Km9VQ+o= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(23010399003)(366016)(10067099003)(56012099006)(6133799003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?GVNl/s+/vTqNuqAnkTs7xMwS4OLcAD9sLl/NlaEIbGJU3MwVzpYw1BsRXfhH?= =?us-ascii?Q?+N87VICf2POY7Wa+qZdL1Nr6J5OIid5nASH8wNS6pA6mUz0hjZgWDtWl+6lC?= =?us-ascii?Q?wpuVrqlkUeR1XoVPwCV4N6PGSJ3Ehcrsw9qgGNNyWtYLp0ouE0Sfo5GEQrc3?= =?us-ascii?Q?I87NJEnxDbBbHjZxSDE9bjMXrv1NrWaNxTD59eRilRwMSNiUDwyrKM5o5CbC?= =?us-ascii?Q?JTndueSoliyM59xLp+lY7eg24y4/X6qOikwTEFglcagro/fQmQYfxMmEorRh?= =?us-ascii?Q?AqnTIJZEJgNxu8xu5SviFkKTsfqyCSKVUO7lCVWL0X6wUHa6DlJMNfYM70gV?= =?us-ascii?Q?nJ6yZxg8Rid4acQb++ZwlONGPCnQzuNL/MKaFnnHHYv+TXkFfQp4hkZS1Ci6?= =?us-ascii?Q?MCa3Y2uqdQhvLWXEOMA72gn8NTuyF41zLcXqAtktKwQLnjJE+nSR7fALS02l?= =?us-ascii?Q?IGUdzMFU2/Aw6tYh1QPC1ZakO5XTzkIEQHQ59vxwZ6KsieeESa06rFM/KEvL?= =?us-ascii?Q?YAUeI29tBYa+EYzrk61bne0DNQ6QOa1WO+dX8Cw0HFTjy0QFtkazGwXcenlw?= =?us-ascii?Q?Geyd+LGzJHZQN4ZsdBqEjAo2LncX2fVIORXehS/n/nYrLxzlrDwy4K8SnkES?= =?us-ascii?Q?fru5pB54Yu/dsa5RX6n6NoiWlTVxi5NjsPGOxRGYVzFd6NW1gLb3jE/D7+mA?= =?us-ascii?Q?FvedSOZJ+pS4rFa/KJU35cdrP7N7rSsVMFU6PwLqNjB3Y6lo94iE1YQ3OEY+?= =?us-ascii?Q?Ez66g/qcLF24EHkpwwGn7PGpq6/VZ+qJaAuJn4JWzbHE9W8dxoVvruuTUbPR?= =?us-ascii?Q?1ZKqaEg4OawQkRSC/SaIu3pdfsur4y9difsYWPcdfC/sa2ij/VmFcnatbs2L?= =?us-ascii?Q?+Nikt68XTTC8hs889pnp8XDG4DSKM/dwfx9zvzgckCXqWxm2ocnI78Tso/wP?= =?us-ascii?Q?hxOIcY1H64v7qXzG3YieF/tDG3+O4eC1XBcEDwQaL20B9BJPhxeY0YahOz9/?= =?us-ascii?Q?FOmb7czmbzGfy/tpAs+Xf8EAFLaQZK1pcwGvV1zsu7ep7Dkdmd9OzAVHfR4u?= =?us-ascii?Q?WKwPxmzddtRIkqXINF8dmReHnsDfE/Xi7dU/I7wfbFwMy0vYbx3MWpvRt3fb?= =?us-ascii?Q?Ald/+4N7ubSzCn+Z2BXmI9h+IV4TDYVG10dFtcU7Ir753Lac7AvslkwDG4Io?= =?us-ascii?Q?ogyqM9fBUjCaRVnGYQvKKflXFeOeGRVjO8m1mHbd6TwzuobKC96gn1AssRNx?= =?us-ascii?Q?WopmcxuCoHk3Vn+Y/rGO/MxW4juayMDSZfGzk2izC3YDwArkU5bbB1jIvupG?= =?us-ascii?Q?ZKLeqWBJxZ6eVhPZSZ3E3/nnHeN5SWXdeT/naazEwN1LcEFBHZmgUJy1nNvQ?= =?us-ascii?Q?AcBNta8UxEycGZzIjjxCdVLzh7b+nq9kgdQY+hcmBovNEKRx0oAGeTlDR3sF?= =?us-ascii?Q?PW6lOVNJVFLMDFZGisP91cLTZOKPf4AEobarnJ0T45XEuYQs7FdB+gVj8v2W?= =?us-ascii?Q?lLX8WfUmJc+j7hvz0CHsCx9EdnHAdaGm4rRYhRVTJI5PRxDHS8NNNvuekXLA?= =?us-ascii?Q?sP8maKG2HYLlpevIsubJgPQA+SqfNfLPG76Cxo8d3vGX9iXHrgXf6sKDUn3R?= =?us-ascii?Q?K5Jm4uPkwrHXlqSSjVvsfXEfpVew+oFs+0lEdsCMgzLG+Mul4xIwRyQHo4ie?= =?us-ascii?Q?CR4Q7EDXT6BXr4fuwx5ERH4zqBrYq2sXIEnZnaQrKU3MYkIVGbW2IEV3Hcdo?= =?us-ascii?Q?8SCd7Mnqdw=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 9bb95fd9-eae2-462d-4e3b-08df15e8bc6e X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2026 00:55:44.9176 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: UeVTrQ+CgXVrK4TDLgms2N808cw7qo5M9E0bpBh+HEww+BMofubt7tfNq/l1VJ2RIGF9dyUntHJZLeVEFGfggQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB2769 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented string arguments via syscall_arg__scnprintf_augmented_string(), the offset to advance to the next augmented argument is computed as: consumed =3D sizeof(*augmented_arg) + augmented_arg->size; Because sizeof(*augmented_arg) is 8 bytes, if augmented_arg->size is not a multiple of 8 (e.g. from an unpadded capture or a malformed perf.data file), arg->augmented.args is advanced to an unaligned memory address. Round up the consumed payload bytes to a 64-bit boundary using PERF_ALIGN(), matching the alignment produced by the BPF tracepoint programs sys_enter_rename() and sys_enter_renameat2() (attached to tp/syscalls/sys_enter_rename and tp/syscalls/sys_enter_renameat2). If the aligned consumed offset exceeds the remaining buffer, reset arg->augmented to prevent reading out of bounds on subsequent arguments. Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/builtin-trace.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c index 91461ab927b6..21c16e4c163a 100644 --- a/tools/perf/builtin-trace.c +++ b/tools/perf/builtin-trace.c @@ -1912,10 +1912,15 @@ static size_t syscall_arg__scnprintf_augmented_stri= ng(struct syscall_arg *arg, c * So that the next arg with a payload can consume its augmented arg, i.e= . for rename* syscalls * we would have two strings, each prefixed by its size. */ - consumed =3D sizeof(*augmented_arg) + augmented_arg->size; + consumed =3D sizeof(*augmented_arg) + PERF_ALIGN(augmented_arg->size, siz= eof(u64)); =20 - arg->augmented.args =3D ((void *)arg->augmented.args) + consumed; - arg->augmented.size -=3D consumed; + if (consumed > arg->augmented.size) { + arg->augmented.args =3D NULL; + arg->augmented.size =3D 0; + } else { + arg->augmented.args =3D ((void *)arg->augmented.args) + consumed; + arg->augmented.size -=3D consumed; + } =20 return printed; } --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022136.outbound.protection.outlook.com [52.101.101.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 06B36373C1A; Sat, 19 Sep 2026 00:56:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.101.136 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779370; cv=fail; b=a1CS1JTEvbGyV3y3jXIgz5a4HqEdiuEM00VMcRHqyhndxGLBRCA22O5CIr2ZKwAkEUCTFc8Qb7+Yzk2pI9VXBE07M03EFQaHl/+KciifXPwsVMBUBh3VDkwCxNK5Y5mwYy+UVUWYKztXIN0JAH6tFkMoY2DHgF+0dChvJYKlmxI= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779370; c=relaxed/simple; bh=0f2tTg/Z1iGoWsori+kZwwS09pHPZ5TCcUw6IvXwWww=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=K8WyXwS+ufr6mHqXkpnI5Nc9+8bB0/+Bd6k6shtKZmAtbGBCTklMomjpmfGy2+cE4Y27uwDCX4AZLWYOGgC3x2xxvocsnCUncQqlEMymgvnmi+5cn3fGyoQCuOb2AQDOQ+7zpsaDMXkOkHubXXtz2/D994wHW/D0aRWKXf7rrnA= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.101.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=pjes6srvXQP4CK7xheQRdfiS6+rXeEQJUKTH/tNLv3Lk8e+z/50OoIthLpsAOrmKdxAugS+n5GJV47c0DgjISNGDq4z/Piz7vkvkGJmzcwJn+Sx7OFpxPz3XswL+xCH+9xvkJwLN0TFxdC4XVPmnsGynpCvYCkP9+UYu6sZhp6so9o3svxlWcnF6EZBFOSi/HBh6+AwLO+r2JfilEBPyCkgoD6HJiQYKWgBUTaPtdU+ts51u/DcXhC0Hc2c2dL70Q8syJePt+XBImeUMltH0G71M9u82X1Zc6Khue2XTvJocvtRv8qgTKjrtUIewaouvvHk79lxFA/0s2eAD9LMQJw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=iUxT8Ui2ScMhBW/NABaE6eq5P0rcyo/zVZMZA2qeOTI=; b=O0XhnNLpIEJtZDM7BSwPa+FWadTOV4HnO+ySaTJwSDtdrFupiy24VFQtGGh1Pz0/WI+zr0+hVcYXlswyywkfWKa7W9WT8MWvGDE4BJFpVrgGpEysfk5NnGrq+VO2zfEtowjd3BN5Cbomw3syK+pDEiLV2YNh8+k8cR+bSe3xvE08rFIaKlFngaPn/WnocWYNX4xZbNulmNpooZmKntXmRvFsmAgPFvTaYakSN4tjx0dowZb+nRGMnZNPJcqig28xj1yfr8B28ZreMSXTky0lIp5lT7S9tKtN0T2+IEYa16EybY2XHC8bB0LOMFdGAt89kPIMPEgnzWFi+slXidjY9A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB2769.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:55::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.14; Sat, 19 Sep 2026 00:55:48 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0428.011; Sat, 19 Sep 2026 00:55:48 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 perf-tools-next 4/7] perf trace: Validate payload bounds in augmented buffer beautifier Date: Fri, 18 Sep 2026 20:55:27 -0400 Message-ID: <20260919005530.728615-5-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919005530.728615-1-atomlin@atomlin.com> References: <20260919005530.728615-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0664.namprd03.prod.outlook.com (2603:10b6:408:10e::9) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB2769:EE_ X-MS-Office365-Filtering-Correlation-Id: b1cf73be-f693-4a8a-2c58-08df15e8be62 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|23010399003|366016|10067099003|56012099006|6133799003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: /TPCyzaecJOMLCnsnmQW+WCAxcViRTaNEfYTyT6ulXSm6MLHAw+3qbiGU8xkY7gZvCShwlk1NvM+uyRxCJFwco39qtHk0BhpuXBS/6S9iAoAPHV+sho4e9NX+SrvZIUoJlVde0qX93dtMxmRIRrGk/kA/qX1Fb8SG184wKC1HyW7REgv/YAbSQDqGz+i3SY8tVKCwd5rEqQ9PsxCSe8TGORr8ixu+cYP+xMRBTPlC22/uOya04V3Gt2bfaH8kQadhyjlKls5WIpsCgswPvGj/CPBs0fVWCR6sDF7BHr905Zh9VYOd/p6vPx79MqoTQuc2Tvb3uTdPvw+KWyNjyUwHS7hYXqI559qKfdb/TLMXSXI61au02cEgP5HuCqeZbMBuHkeDSLBVoBvpd4kzams5GYDDGtypnbdkObm441FMOisdkmL8r1iaSTz0peUkIGkhJlxuRQyCtbq+dajYdVycFK7wwHrLKs7PixZReWPZO8OfGChPRNJ9ZQbg9zY+hdYUkZsFmG834m0FZ+jUr5TGzBDOznk3B3w2QX9GC9Ys2hLVmmbZl2/oAUqmNI3gxyrzIZ7JzX5cR5ZN9JdKBTpF4abGWahxmm1t/Kb3zdK8J2p3jxT+mNioe8J7eCqp/b6xJ8Wvqp7RXQP2RfOh5draeLZGfgdrJSj6nZHJjuMIKE= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(23010399003)(366016)(10067099003)(56012099006)(6133799003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?+k02vgO4zJmtE6zeOMJ+4YvyJUVDSDY8opoKRd3+pZcI7YHGK8l9nFeynS73?= =?us-ascii?Q?OfwPWKDAmtQL1jCEwFit3lPtCcyU3YeWzzXh7rhn69GHLzJwskFrPtA6xDgt?= =?us-ascii?Q?ljQAdub3LvBODJp9stoszet3V5dA/G75q2eWx48sdjkQBf1+r/RXHnNYu05G?= =?us-ascii?Q?p2xXpkQGoylZh5FFB1Pu5PWRo5l4PiGOdaTtskbcT4UruYzESu/tIpb1HoSv?= =?us-ascii?Q?mK+ShSGN3gxyjbm8DNwIk6l2e/R2PqEcZLAnPQELo9zPkrItq8CHoQFFPxXU?= =?us-ascii?Q?nzUtZgB/bC/gKVqjzNtwcjMm/PWQDBhA1IDR2DimaPdbRGUXOJxZ4kTbXIq/?= =?us-ascii?Q?ZJl1U9gYYZCH6kVFKlM849NKBwCibKlCxxQeiptbJUT98LxsU6w1LcnEaR7+?= =?us-ascii?Q?2/5lQNIMbO4y1OXRWbhnokT/sksWO9akmCM54WFhE3U3qmaRAQjYYrxFrd2J?= =?us-ascii?Q?x3ULfWN2BHV7HVIu6Frq1ajeH9AcftDQBJIVFNY3FySjXNWs4mNR/Uumsbzi?= =?us-ascii?Q?PrnUVar8Lt6u7ovHq+Gi2r/nMeCo5TPOUmcZep2mlkqdoU7EL1h7dKVtS/iZ?= =?us-ascii?Q?LRmr62wITZlb4BOGaHkuOq2f+YP3+BxgpaYOSc3Xd2YV0BhuOSNGJFWsIzyk?= =?us-ascii?Q?ASDw3/VHCRiBzLIjIW56aQhIYJ2O9crOxas3/H83e7XpqwWH5ELA5a/AtFHL?= =?us-ascii?Q?LYTAT8qTH1LnwFhdz4g4oB1nLITkVAIIOJHJeTDqCM5dawC8jZVvgbazfmg2?= =?us-ascii?Q?mBpydCFt60bIRQDdglfv9wPKF3/dciKtjvDn9eclrWi3NWVwpU7C1/Hwh82h?= =?us-ascii?Q?k9zRT2Rck7TBjUL94BOHpil/O1lMekQ56JWWhwG60/4YPl3fRiUz8xe1mvLQ?= =?us-ascii?Q?7E5drRsXF5LV2OmO+7ttnU1c3yMvO1Z5lI2HGU+15Fg3XCDorOL2v78t1j/h?= =?us-ascii?Q?b+zVvgFDAkWPhoQaKq7xbsakP1PCCQ7uVSkLCOp3w+Y6RBdYAe9hE5qlb5fM?= =?us-ascii?Q?CrlamE4E63yyR+wW+v2a5WLR66eAEG6STo+BBeWIYaUIbJy0K/r4bJegK7ZT?= =?us-ascii?Q?hdEobkaEbIA+s4NwHFvvjz9WG44oPk7lBanqVMch6j5u/RnXTlh0YwKQBBI8?= =?us-ascii?Q?X4mayXGxbex0lpeqI7V6giy8PUt+m/Ok+RQtyf57QUyea7z6KzU2fx6AS7I4?= =?us-ascii?Q?IuyIXKc812SjSkdzVghld5i4SguPiQRASnMf+ehIP0OasYTi7Lc6gRlfgXLX?= =?us-ascii?Q?oYl6UAnVKnJ0ZawQOppFM1ZxOoNgi5J7e8w9t2szHy1Hw1T5iBr9vTmbcFqb?= =?us-ascii?Q?Q5lp/NcV36zJDYiVv0nMWa0FQ6ugoNPblQSSN8tDIoX3tU1OgxS+FY3bVzj0?= =?us-ascii?Q?u+2D3oVNFU/XFnfH7k21ySpMeGawW+GbPJ8zHmr7T3tYaMNRdqyYDI8mY6qC?= =?us-ascii?Q?zz3enqHtcPqhHKCsysesw5/D2jWuvprzKe/V1tDElTvxz2fLhwQPhUKN9zUb?= =?us-ascii?Q?f1olFIv4tAnl7vITU+aSAWpJ2dfmxziFHmak0Tg9L6jmKtBLE2jqCMAdQi0E?= =?us-ascii?Q?AreW4/OhkHCF7xS2wk5YWaHS8smIBE4jCvKDpxm2xC3v4iKnnnLJ3cQXHLxU?= =?us-ascii?Q?VXji6WK2yvL2zlpkH8zUq2cATcBAtrUpBvx/VSpkaqOl0a96g2SdBesl9Je3?= =?us-ascii?Q?I06tzjlLLXUd12dEfC2C70Kq4UA30ls+Nhr8mJNwarMeAEn15Z2MIYkeQKOt?= =?us-ascii?Q?JyNJ6U62Rw=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: b1cf73be-f693-4a8a-2c58-08df15e8be62 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2026 00:55:48.1923 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: 2gOk3C/47bGkH3hNYVt993FegZk76/1jkLnDyfQ4KRylFja6vYAk6NAE+H6/51D62UgXWb2crsIhG0mXXk8snw== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB2769 Content-Type: text/plain; charset="utf-8" When pretty-printing non-string augmented buffers via syscall_arg__scnprintf_buf(), augmented_arg->size is not validated against the remaining buffer size (arg->augmented.size). If a malformed or truncated perf.data record provides an invalid or excessively large augmented_arg->size: 1. If arg->augmented.size is smaller than sizeof(*augmented_arg), dereferencing augmented_arg->size reads past the available buffer. 2. The loop reads up to augmented_arg->size bytes from augmented_arg->value without verifying that they exist within the buffer, leading to buffer over-reads. 3. Calculating consumed =3D sizeof(*augmented_arg) + augmented_arg->size can overflow signed integer bounds or cause arg->augmented.size to underflow, advancing arg->augmented.args out of bounds and corrupting the parsing state for subsequent arguments in multi-argument syscalls. Validate that arg->augmented.size is large enough to hold sizeof(*augmented_arg) and that augmented_arg->size is within the bounds of the remaining buffer before iterating or calculating consumed bytes. If validation fails, fall back to printing the raw pointer value. Fixes: b257fac12f38 ("perf trace: Pretty print buffer data") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/builtin-trace.c | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c index 21c16e4c163a..af1ca4c02a57 100644 --- a/tools/perf/builtin-trace.c +++ b/tools/perf/builtin-trace.c @@ -1950,13 +1950,17 @@ static size_t syscall_arg__scnprintf_filename(char = *bf, size_t size, static size_t syscall_arg__scnprintf_buf(char *bf, size_t size, struct sys= call_arg *arg) { struct augmented_arg *augmented_arg =3D arg->augmented.args; - unsigned char *orig =3D (unsigned char *)augmented_arg->value; + unsigned char *orig; size_t printed =3D 0; int consumed; =20 - if (augmented_arg =3D=3D NULL) - return 0; + if (augmented_arg =3D=3D NULL || arg->augmented.size < (int)sizeof(*augme= nted_arg)) + return scnprintf(bf, size, "%#lx", arg->val); + + if (augmented_arg->size <=3D 0 || augmented_arg->size > arg->augmented.si= ze - (int)sizeof(*augmented_arg)) + return scnprintf(bf, size, "%#lx", arg->val); =20 + orig =3D (unsigned char *)augmented_arg->value; for (int j =3D 0; j < augmented_arg->size; ++j) { bool control_char =3D orig[j] <=3D MAX_CONTROL_CHAR || orig[j] >=3D MAX_= ASCII; /* print control characters (0~31 and 127), and non-ascii characters in = \(digits) */ --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022136.outbound.protection.outlook.com [52.101.101.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A121379C55; Sat, 19 Sep 2026 00:56:11 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.101.136 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779378; cv=fail; b=q8xuVYHx5eKK7mdRGZ9gUVVtng/7azBIoupDuDo0RlF7ixI0dqbd94/rR8oJKy5buUguhE7Mh9/w/8griHip0qbnA1eLjHnszxO4fzVpW5LW/1TsElgUUbh7nRTOxsrxM/Ld5sx09521mkKWSm6HsBSkq91ziDIGKTlKkV1Bods= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779378; c=relaxed/simple; bh=FmUO7YhiAdEki5ymZ1uW5FJ0WUSiX1RjN1LzM9IQ9WY=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=HuBnDMAOTzWVAp7g53oN9wquClpzo0JclZYr8lj8UhcZjBY3HFLeOxb0797GbIMcOnPsWGnPxuei5Vu9m8Cmz3fShNEja7rjH0Oz1pGD1+ENcrzDGcFRE5B1yMHtmbCulKmGdAfHw8FGuG5o7eYNmwr1cQl9ZVazIN5hy3YHiXQ= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.101.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=SY6pcghQAuzb1in2wHhgrKhOh7MsOg8qmYCQQdmgFvYbQNZYFSJPcVSMlhxeI6df06LCdvcN7H8f4/glxqOfphM3bgiNLhtasebihoWXwKeXOcHYsQlr8pJNHPCfaq8vsq6d3jbWvfTaa785a3TvtJxTiJJGiApSG70vvgYyd6Axwrxt5xCPEZFV0oSlC8XRoDC3oCecITR+gtGRIm9fSwJBZj8YiNludUCXM73HUn+pz4IMdkYx3D09YN/6vYNzcp8SfLPi2zeI6nNlQrMttjQnDuGmfg5s0i+H+8N42ABrq99DfILqjV9b2Y9CDMt7jQNJ+pCs4IDMqYepLbIkwA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=boTounzmg+TdIbEc04SlE7JJCkP0C52jwcdoCuwScsg=; b=hGLLCzrkFlyDO5+z4r+V87Hs6+dnpYE28GZP2sxbSAArjU8sMQ6jEolDZoggweSbgj5CgE9GIYDOBjSJKANMC6vdnRP6XXr7XmXSap5Fcq28XVe82psnj7TbEyKxbFvtZVedj0j3dd5cMZw/Q2TbhAle66EF6W7Gb2e+f3jkXO/7UBnrYF2Bc/orAtpA700WMIgBJLJO+6YYJp9rRbWDOvNH2qL2VUFolZ6mJFMOeJv1IitiQMNudl0nABLfbyY4NwEhK84e+NYzsLNDVGA2ROlFjn+L/C076Cqn63fPwCW97D9n6NEEXIWylZcRiS0cBKWXVPJBhkqdY7ayJXbS+A== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB2769.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:55::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.14; Sat, 19 Sep 2026 00:55:52 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0428.011; Sat, 19 Sep 2026 00:55:52 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 perf-tools-next 5/7] perf trace beauty: Validate payload size in augmented timespec beautifier Date: Fri, 18 Sep 2026 20:55:28 -0400 Message-ID: <20260919005530.728615-6-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919005530.728615-1-atomlin@atomlin.com> References: <20260919005530.728615-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN0PR10CA0029.namprd10.prod.outlook.com (2603:10b6:408:143::7) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB2769:EE_ X-MS-Office365-Filtering-Correlation-Id: 154c753f-dc75-4828-2dd8-08df15e8c0d3 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|23010399003|366016|10067099003|56012099006|6133799003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: AbQmtzwawgFdn5HdlX4F6lGmXAwVlNvTONZ2x7JzDjDzXkF4iMh/tjWe1tdq/tlLVyoMtsxLAQHnoVjmb8tW4X8OcKdtQcsOA2b37tGl+Ge93vNZgh9OYEmOYigPE5/pXGKAKR5cisBBYf1obwPU+OKh4vzhOqhVgsKoNdgGuWxPa1PSoXsqwwEFeJ7jnQuVIZFL+/F2GVjoq+ipQi1eh9oFe3yADlg0sKFjTx7todPyCeOK6s9NURMMFbA7F2dysgi7aXW4Egjb2RRiEpxDK64BxKMdaa7A84tZFQ6ZplLD8JzLNdMJZqdBfDDE4yYI5okEZnxOjlOsyz3rQD88CTUxhpI3+gMbfvx8kKvAB3PL0eExHZiB10lyvyWTHZgkKniaKmJpVO20lLSWmoey0WI6t8g9PIWFadXNGQa13YW05wwhm+eu44+IUbhQ7h5jGMODx5ukPjSqGIDmIddH50I2AvuU5S7C00OEdJTBS5x9R3yNIlqFmRT1V9/Fl20WagPjveAIwT485JKYJaWMiNP1Smse7wMQbGHrFNsbZzZE/NLXZ0DTKsqc9JnJgbcOPDgjBxcbXC+cszkY4NYD46Gi93sT01lJSA6YIzNx1iZNupFIpDeKTdsnDMBMy36RfoZUNwE8DZoThMN0lo3hRSGGMbn8Q7loqOZXBPGpfrQ= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(23010399003)(366016)(10067099003)(56012099006)(6133799003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?J81UPu3TxeAlGKnhCVWpUNwbvo1usFCYcND8tI7GVn36bpUPcPjrvSvgGuCT?= =?us-ascii?Q?aWYF07zrj69EnDAmumVDte8AYGpb+Yj5Kw8qIfgJ73vkyMxd4AQkgq7qTswf?= =?us-ascii?Q?EEhVEjGEC5OcXWqB1FU6s5bVyW34Bg1+m+yQLIEIy9mUVDP06PAxFOcDBfZo?= =?us-ascii?Q?hXgynKCQ/cxxxQsSYAVdT5H8hYVnrBJvSBg/iYbaMPMREKssLIGzhs8dWvAR?= =?us-ascii?Q?Z95Ws1VLwYQ3ixZLBF60VFqeGcqGX21oFvKMazid9e7eCC24yEBVX6M6RHWK?= =?us-ascii?Q?Is98yfHi6mWWwAe5j8G/7K2vTG5IWpGpB00WsFwDfzoR+4JwWVAgxdXTfbdU?= =?us-ascii?Q?u1Pz3+6DCMUO0Pm4DKIxLK+DF3bovj9Ajeh81s5R7WDdMm+rhUeSenKL4sLx?= =?us-ascii?Q?72+OjZFiob5t2yIgzcBlfCPuNGX096k8a8FtJQJ3TsTuHHeUutCUoc1n3Z+D?= =?us-ascii?Q?MpMkxHuwtaGJ+9u95Pe9ssnrtqt6i4pVESoXkpgUO2pIHyI0QVlcbMqxm9z9?= =?us-ascii?Q?6+GZ7n9MZMF0ghtEE8apvDhXg3tBllUO/bDAbFVmFKZnYls9fV8pAttEhyAv?= =?us-ascii?Q?+ubYhwqjWEncjJeYWfaiHo945gcJuvKCmFxK580L9tyaqoMxylXj0DwnADah?= =?us-ascii?Q?+WUc0bJfZlm6KnVKDhzO378+9S+3K9WTf8vjyoFZU9lQKmfgPIuruRyejUTF?= =?us-ascii?Q?VRC2icCuFOQ4BGKWidqLSZv+KU87HgXLOdI2EBy5flQkGwyhSkYOCtsKqd2i?= =?us-ascii?Q?wEADPe0Pv/AW8XYSytMbGRtX/qdg0ieAQ5YTdkGM9EpwUoDINqjbse0kavgR?= =?us-ascii?Q?U9q3nZ5HA4+TboAc+oCsfUuZpRazgLo+Qu3WPrcitcd0dpddowbUNNV5RtW2?= =?us-ascii?Q?b2WrLD2O/BfYvv96iroOmKLZrjypx/bunPHWVul8yr3I+Yo3z96fi97JcSA+?= =?us-ascii?Q?sZ7cxyMif4Co0gyY6NUoPqvM27bl9brQmb2qQZeEBhy39T9+PxsUQp2HsS3i?= =?us-ascii?Q?IK2YLzKi7g+XIxRa1vr2A3JpEaPEOI2BWL1Kl1hdA24eyF1Cvd+2qmtSmg+X?= =?us-ascii?Q?UuTiAmevUBjPDLvNK8oJpjqgYPBQDRK1dZg8bUdN4+5aEzJHznN7iU0tYFnW?= =?us-ascii?Q?BY82BlwWZvupFnKiyCY3XEC7x8XccPIHLzXmqQlORR1J7d73NbtwuQ1BuD04?= =?us-ascii?Q?VSNMvXY/1GXS4pMyPOUbWvAQA2pj3kp0688HUC+ShDqSIx7hilwfsPwQhCTl?= =?us-ascii?Q?h18y7Eoaf6HYwN3VYA7l5hqH/b7AT8D2xtil00Mrnd4Qr4CnDOQjqcxceQmO?= =?us-ascii?Q?ZmUfFbX3981ixfgL3r2s04C43j+Sj/Nhz4cw8awvsrzKgzuR5Wp+Pqo3+fzu?= =?us-ascii?Q?f5wx57uWTinc7ScZ4Fvjp6JWxHLL5hRp13miieTOZBgqH/k8gRC5xbX/wvWU?= =?us-ascii?Q?bBUDU9jxCV6OLAnyGzRM/tDwpqfYv0wsClgwLwMNMnWaeVKzQK9bUAxWg+1b?= =?us-ascii?Q?7gqGFcqZzYUPPB/uhjpXMy/4z3B7gx2FrCJDiyr3mXGvLKxDbCkZys3EXG4g?= =?us-ascii?Q?P4Y3xtk0kNiMVWt1b89qyT9TVazHPCwAc9h/i1kkSj5rZa4LYwRMB8gEArOF?= =?us-ascii?Q?9yDQYP4GlyucQhIskQxCltnos/LupQIeG1OeUfGKj5tbKRbzb1UNsZI6TRNF?= =?us-ascii?Q?FmUy3SyGxze1eHnE8SLtDefzWMw0+0KcqRWdBU6bZSIZO9rom/Y2I15xnkwK?= =?us-ascii?Q?fodLadOMWQ=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 154c753f-dc75-4828-2dd8-08df15e8c0d3 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2026 00:55:52.2573 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: uGHFtQjZok/ksgrrNMzlbA0mDXi0wga5px0Kx6nqSkmg00O6T3IYlfe983ieIKL+PZcWwk0Vsj+jQHs85JLZDQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB2769 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented timespec arguments via syscall_arg__scnprintf_augmented_timespec(), arg->augmented.args->value is cast to struct timespec without verifying that the captured payload is large enough to hold the structure. If a malformed or truncated perf.data record provides an augmented payload smaller than sizeof(struct timespec), accessing ts->tv_sec or ts->tv_nsec reads memory past the end of the available buffer. Validate that arg->augmented.size contains at least sizeof(struct augmented_arg) + sizeof(struct timespec) bytes before dereferencing ts->tv_sec and ts->tv_nsec. If validation fails, fall back to printing the raw pointer value. Fixes: 6ac73820993c ("perf trace: Add augmenter for clock_gettime's rqtp ti= mespec arg") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/trace/beauty/timespec.c | 15 ++++++++++++--- 1 file changed, 12 insertions(+), 3 deletions(-) diff --git a/tools/perf/trace/beauty/timespec.c b/tools/perf/trace/beauty/t= imespec.c index b14ab72a2738..84755d8d2c87 100644 --- a/tools/perf/trace/beauty/timespec.c +++ b/tools/perf/trace/beauty/timespec.c @@ -7,15 +7,24 @@ =20 static size_t syscall_arg__scnprintf_augmented_timespec(struct syscall_arg= *arg, char *bf, size_t size) { - struct timespec *ts =3D (struct timespec *)arg->augmented.args->value; + struct augmented_arg *augmented_arg =3D arg->augmented.args; + struct timespec *ts; =20 + if (arg->augmented.size < (int)(sizeof(*augmented_arg) + sizeof(*ts))) + return 0; + + ts =3D (struct timespec *)augmented_arg->value; return scnprintf(bf, size, "{ .tv_sec: %" PRIu64 ", .tv_nsec: %" PRIu64 "= }", ts->tv_sec, ts->tv_nsec); } =20 size_t syscall_arg__scnprintf_timespec(char *bf, size_t size, struct sysca= ll_arg *arg) { - if (arg->augmented.args) - return syscall_arg__scnprintf_augmented_timespec(arg, bf, size); + if (arg->augmented.args) { + size_t printed =3D syscall_arg__scnprintf_augmented_timespec(arg, bf, si= ze); + + if (printed) + return printed; + } =20 return scnprintf(bf, size, "%#lx", arg->val); } --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022113.outbound.protection.outlook.com [52.101.101.113]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 11F3727B340; Sat, 19 Sep 2026 00:56:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.101.113 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779388; cv=fail; b=aEbajrq+yOmRBMoIBFkWteqGaX1GBQM8nN+dNSWmltWAxFWJnAi6ljn068Svtb/GpdrtymkWwyHcahlLkmUu/0HFLoBBGHsNKEpum9e5vO8CN0jnby6pIyihenWWAIsxoa6ubLnmjBNXPYIDYv1eFw2SPXRwMQM4pJeTGLXkhLc= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779388; c=relaxed/simple; bh=jH3qu7d9Mx7cVb1ScVvACgqBRYhx5hgZpsmJx4fnbKk=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=uUiGo0a9TwrDcmCGIDA0t17/rH01AmhHYzUJqC5KnGjoC4hx+Il0cKMDQHI9/fUMONavbqG+5Zz/IheG23ULLHPkoxWvtbZAOoR76GUvMCbCqJbf/pDCEHXzkAeaZnLuCo72kCx6bAyo4SXfNbbY5wR6o6n+fVNy+ShPWsrWsXg= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.101.113 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=h+eotpsnjrVzDSaFZrqp3xxqvFIbI2Gx59UQnjiJrPQ0kDn2kS7bOxR960Bq6AW1kGQzn4++mSJthDQJcv3H2bCweQ4Lqr6Da5pJQnlJ7GZnwt3vvQyoYxlDZZLEuzGvAXE5Ipl14/hylajx5eMZknCn6igddLCrhm/xuXZGwL5cUmHB3AOAOor+ZlWaMLRvVmZs0CRYfdfuIEBE4v9+zEgxUTODJGvgZVohARHycQ46a4muPhz3N6o4LbanV9ZaAb6xxz84COlOLbr7YKcYvTjFhwn6/lVmHa8QocdnD3oFlu9zXH7sMTfH08Qd++t2wD6f+zo49jBQ/ovORbe5/A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=50kc43NtRWXrmpy4u4b8XBnRbirG4XW3xv1AkHnPBnA=; b=fp5/wwZ964dhW0DCwKvb9gq+dCHBHW1if+5rSgHMbWAfwnIKThJSA3WYcRetwv5biPNzNZczdbiVpfQUk6stVYjaL6/u7+Xy6HxGsZN/z2Ut9ON7EDuCt4SzEj83tKZagYyAAMhDY97Cwf7GgIiwpRYhcPCAsvKUgr1IghJfCbjBIhUggtKV38NBT514KqmPi9pC1TMQLY22oJSW5bsSOi87DUqvkmhXy8GcHUaEGh2MmyZmF8B86N9iNnHSBipMX6MFXL4ibvFm5baZJi0JJmLpO4V973ibw5Rcne7Mzap1GoSvBx09zIP9CpD0jllaSyjL5TmhH456pgNO5rj/ng== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB2769.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:55::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.14; Sat, 19 Sep 2026 00:55:56 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0428.011; Sat, 19 Sep 2026 00:55:56 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 perf-tools-next 6/7] perf trace beauty: Validate payload size in augmented sockaddr beautifier Date: Fri, 18 Sep 2026 20:55:29 -0400 Message-ID: <20260919005530.728615-7-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919005530.728615-1-atomlin@atomlin.com> References: <20260919005530.728615-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0956.namprd03.prod.outlook.com (2603:10b6:408:108::31) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB2769:EE_ X-MS-Office365-Filtering-Correlation-Id: 551a547e-fa41-4c3f-d276-08df15e8c301 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|23010399003|366016|10067099003|56012099006|6133799003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: CyDoFgccy1tDL6EDb8S+QpsXZbjIH9rZ3HuJmpFRC0K5q76Vqz+Vtq+qyHIPI8rUAXZGIrH+kXX3QFBDq2RTnoKg0Nmode7RpvLBVRL0Sj66B94DaMU4AwSuQ21XT1whiCRn1fbfygRB58D3VdLvxFAsL1u0vilRqiquBb4Y6kCfh+I2uD1+UENzdzlQvlx3RsTM3pkdHScFnQXBeGkqjH6vEwS0wy4pMKXGW0grPevyVJx+HgBoCARtfoQc+NVdCMGOXiWOcb2mUZjDvgqOmGEr7EM1iKp+eVjeGxaY6bq3eJsWvlCKTuWeSfPsjletAdI+jSjFrsdgqy6SvaUigFYMU9jhLXnJukl2Y+4a1687thQu70eaA+5G8jQywTXtRyz4Hdudxq1m6pnNrvgrbPTkTwr8X+uZtUYydN5Yxz6fz7/RqKjt7N0Tug4BVsAj+SD5HH7vobQSAw7jHWPBDNn01wRYhZs5VXttCi9WlBFcLJrM9ZyWkQ11RyvkrP8u+Ig7Z2WFw8Z9t9262cU7dOUusl9oNz/3qwBVM8192haRuYB8/J3mPkjI5n+vSLf9IuT8LnH/jDWPZAnp9WP0VXR+Ctct69Y4DxTTtoY9cvIYBnFvLBLFI7o6yrPlQ4vRN9t+Uw4z/WShZtMY6uyuIj5jZ7ZkNt9WZfLeoyP/NMM= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(23010399003)(366016)(10067099003)(56012099006)(6133799003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?X9b+ZIDveOCL+1FRv2eoqspquu8cPeB10HVZIWgTq+LpAwQDVeA31kagIWnJ?= =?us-ascii?Q?UBkxXabjhWojCnGidG1XhDaAWSFfy689VMqNWMvLevAgDS6KIUX2ny6TDKoa?= =?us-ascii?Q?R2raBPK3odw0BYlIPdZfswSAT9D4CfF67MtzCy5i1n8l9RXrzdQsoI5+0aOH?= =?us-ascii?Q?ducuxG4oJJh9QWZe3LHfNpUFI1u8iPF/r6JXXILDGpHxyxHqBipLB+NrrtTo?= =?us-ascii?Q?mzLpjCt05dMxHQ9jbiJ1/u2G6JVGKWJuMNO9GekSj/VdyqnRhG2GV27jX6Dq?= =?us-ascii?Q?hA7ja8NOkZsC8Z1WLEApVK4v9oM0Ok6Mqyo6BAf4LTcsqwJgJeJBxj/L/gHR?= =?us-ascii?Q?1wYkywOusICGuq3cwPlJygu372DrJZ0ud/T7+cGOnBaxy27erQACW7Uht1dO?= =?us-ascii?Q?M6mrG59/Q/rmnonQdpN7ADGSK2dgByPsQh64o2KHJiaGehquS+fJEShSXFoz?= =?us-ascii?Q?aULrFUHNKiI4N3+aG9RhgPDuZaO8I6SPknH+/RyKpY45rh5HX/TWt2hDvuBl?= =?us-ascii?Q?/eWSv/Fj2xBiDDaxBON4B+VuJwJgfJFEQni+ZFLq4cceE1xchqPiar9BFO4S?= =?us-ascii?Q?ExE2FzauaTbAiwGsA4gzi9TG8Nk4RNJmolyRa5ki0hyl3iNfJFdooc11yNxg?= =?us-ascii?Q?LJZAjYHJNviHXkTp+ep/IvPiw5FBtNKjqo8uCyp9p39NO65PKoxbDGMJKOfB?= =?us-ascii?Q?AdlUbHMIN1P8EMipSrBOerwblEW7MMY30nz0qO6VvMtrcqd56nNhCrIR7Wgm?= =?us-ascii?Q?ow8coAsiHZ8CYhx9T5LxmDcoEzu9/vjMQlokrcZaaYcnqGmESnq8gFFlIImo?= =?us-ascii?Q?iBuvXZv38DuFhrs+7xmVxzURY/2hRNZv7SsUpfQigm6k69jLOefV5ZFvf1ym?= =?us-ascii?Q?3AIzfmvpP/9Z43HSJPOtUvNIc2dsn1AZrUaZBgKbhqxwsR8d0cQtXwuxzth5?= =?us-ascii?Q?JxDHXE3VPxn9lHIKRwlc7cDILpvaJb16/AMSymvfrFl7qx09uPp6WIq58aKM?= =?us-ascii?Q?LQPPaQ12seFt3DZXoAD7VICoi3lU801O0lZqJGx8bDyUhUQC7otJnD1dtWO7?= =?us-ascii?Q?ibwXCF29yezDSWQdBB2ClOxxAMuoUsZ9YUJC6yl0vcwk3EA9w3UzwFbnwDEE?= =?us-ascii?Q?GMe4vpPhZJsJeXk2JwZWPE/AJggZNqNItX2zoiFia9GkwikFssXqmOoLwjEZ?= =?us-ascii?Q?qmnAeSONWX7hgkvW4z9wdxGJscCyR0X6zbgELRhELlFQY8juuS2XcdXej2BO?= =?us-ascii?Q?RQwjkO8huTCAFMaxv3VPd7S8r0fZgSn5URk4nLvYYdrbZ8FX6oDtYqq3TPuS?= =?us-ascii?Q?1YdQn3HLf66zw6qU9n0jG81k4aUqcBbBvctLOmzv823lblaMEDBPJa9d5iVx?= =?us-ascii?Q?+8vF22bDsu2RnuB7Zp/3mFo35PVYLfB4x1vwwrWyiSlvh4Q3CPfiCTmms9ws?= =?us-ascii?Q?aXSWlWqD8aMYvD2VB7oV9HvInzsTLbVFL8eLTdcsvsXDnUsgkFoa2l1IvQcx?= =?us-ascii?Q?ncjIHnqqIRyjQ/9WLzoKEcTbFtlS8xZg2Le1aERsLEURL/2VqwTT2N8Vmra6?= =?us-ascii?Q?7WzKoaHv4jHpqjN8g9+CuZEzqZ6kLw8UOI1vWL9Y/QsEdvmsZpI699ov6lWX?= =?us-ascii?Q?i5pRrxeMcU5pTJak6WCPUZiP0eLXtW6LGcXTZmL09sxjsBbFVxTyDhhlYWSE?= =?us-ascii?Q?y1FufxRCzFMiixU+BmU1mZwMOA7xA/H0fLZw+XxFWGr7krqmOgyIdyqZBlFM?= =?us-ascii?Q?anZuz3eG7g=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 551a547e-fa41-4c3f-d276-08df15e8c301 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2026 00:55:56.0226 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: hf2qkCqrG3f/uhA3ILXi9Y7MMapUGeKp76Ph1KaZMtMbGYorJAPgpokpIrfdrKLKKNMypyl6rdC8rI6Ccb3BTA== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB2769 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented sockaddr arguments via syscall_arg__scnprintf_augmented_sockaddr(), &arg->augmented.args->value is cast to struct sockaddr without checking whether the captured payload is large enough to hold the socket address. If a malformed or truncated perf.data record provides an augmented payload smaller than sizeof(sa->sa_family), accessing sa->sa_family or dereferencing family-specific fields (e.g. struct sockaddr_in, sockaddr_in6, or sockaddr_un) reads memory past the available buffer. Validate that arg->augmented.size contains at least sizeof(struct augmented_arg) + sizeof(sa->sa_family) bytes before accessing sa->sa_family. Associate each address family formatter in af_scnprintfs with its minimum required payload size, and ensure that the captured payload contains sufficient bytes before invoking the family-specific formatter. If validation fails, fall back to printing the raw pointer value. Fixes: d5a7e6613b00 ("perf trace augmented_syscalls: Augment connect's 'soc= kaddr' arg") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/trace/beauty/sockaddr.c | 35 ++++++++++++++++++++++-------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/tools/perf/trace/beauty/sockaddr.c b/tools/perf/trace/beauty/s= ockaddr.c index a17a27ac2a6f..98fdabc99781 100644 --- a/tools/perf/trace/beauty/sockaddr.c +++ b/tools/perf/trace/beauty/sockaddr.c @@ -39,31 +39,48 @@ static size_t af_local__scnprintf(struct sockaddr *sa, = char *bf, size_t size) return scnprintf(bf, size, ", path: %s", sun->sun_path); } =20 -static size_t (*af_scnprintfs[])(struct sockaddr *sa, char *bf, size_t siz= e) =3D { - [AF_LOCAL] =3D af_local__scnprintf, - [AF_INET] =3D af_inet__scnprintf, - [AF_INET6] =3D af_inet6__scnprintf, +static const struct af_scnprintf { + size_t (*scnprintf)(struct sockaddr *sa, char *bf, size_t size); + size_t min_size; +} af_scnprintfs[] =3D { + [AF_LOCAL] =3D { af_local__scnprintf, offsetof(struct sockaddr_un, sun_pa= th) + 1 }, + [AF_INET] =3D { af_inet__scnprintf, sizeof(struct sockaddr_in) }, + [AF_INET6] =3D { af_inet6__scnprintf, sizeof(struct sockaddr_in6) }, }; =20 static size_t syscall_arg__scnprintf_augmented_sockaddr(struct syscall_arg= *arg, char *bf, size_t size) { - struct sockaddr *sa =3D (struct sockaddr *)&arg->augmented.args->value; + struct augmented_arg *augmented_arg =3D arg->augmented.args; + size_t payload_size; + struct sockaddr *sa; char family[32]; size_t printed; =20 + if (arg->augmented.size < (int)(sizeof(*augmented_arg) + sizeof(sa->sa_fa= mily))) + return 0; + + sa =3D (struct sockaddr *)augmented_arg->value; + payload_size =3D arg->augmented.size - sizeof(*augmented_arg); + strarray__scnprintf(&strarray__socket_families, family, sizeof(family), "= %d", arg->show_string_prefix, sa->sa_family); printed =3D scnprintf(bf, size, "{ .family: %s", family); =20 - if (sa->sa_family < ARRAY_SIZE(af_scnprintfs) && af_scnprintfs[sa->sa_fam= ily]) - printed +=3D af_scnprintfs[sa->sa_family](sa, bf + printed, size - print= ed); + if (sa->sa_family < ARRAY_SIZE(af_scnprintfs) && af_scnprintfs[sa->sa_fam= ily].scnprintf && + payload_size >=3D af_scnprintfs[sa->sa_family].min_size) + printed +=3D af_scnprintfs[sa->sa_family].scnprintf(sa, bf + printed, + size - printed); =20 return printed + scnprintf(bf + printed, size - printed, " }"); } =20 size_t syscall_arg__scnprintf_sockaddr(char *bf, size_t size, struct sysca= ll_arg *arg) { - if (arg->augmented.args) - return syscall_arg__scnprintf_augmented_sockaddr(arg, bf, size); + if (arg->augmented.args) { + size_t printed =3D syscall_arg__scnprintf_augmented_sockaddr(arg, bf, si= ze); + + if (printed) + return printed; + } =20 return scnprintf(bf, size, "%#lx", arg->val); } --=20 2.55.0 From nobody Sat Sep 26 01:03:41 2026 Received: from CWXP265CU010.outbound.protection.outlook.com (mail-ukwestazon11022136.outbound.protection.outlook.com [52.101.101.136]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E7169379C24; Sat, 19 Sep 2026 00:56:18 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=fail smtp.client-ip=52.101.101.136 ARC-Seal: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779392; cv=fail; b=GSqxwghuVxByg/npyZaVJd4A7J9GtL4fis22icAHW4az9NiIQ6aT4dBEs2e+IMCdx2NcFSndYy73rWcVC74SX2PgByJ6htCMaT+Db9P5MlvqxmfTAuPBwYCojjA+lFSAoz+6oC3J/RF4NYVnIuZApCiy7RJskGRQ03Ko2nnZpt4= ARC-Message-Signature: i=2; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789779392; c=relaxed/simple; bh=JyUe/cdWvtx932N7URigtThCoVHDuEQQD3jM8HoCjto=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: Content-Type:MIME-Version; b=EnPy4qrMxUZlMIMfl8mPnp33p8cZt968sP8XPqLYHtlXEnWzQOocbD2oupZ64fGOO5bjFX3KyWiYs0Rg1xIjr1CDymPUM7DnhW0YyQT+ehUbv9004escpkYuPRlGFnSiKRz4ueBzzbqIW19zBkp+BDnrkWtiE9Nobwk5UtazH4g= ARC-Authentication-Results: i=2; smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com; spf=pass smtp.mailfrom=atomlin.com; arc=fail smtp.client-ip=52.101.101.136 Authentication-Results: smtp.subspace.kernel.org; dmarc=none (p=none dis=none) header.from=atomlin.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=atomlin.com ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=a4OmC9LKbrNzk5ZlYc4xrFDo2x7VgUHuKW3HrRQowr1xL4DaiExK4LJqxeQCPRatzrPc/NpuFPqLwQA83xQbQorzEICZoCFuM5mN2fSeqvePNJcASZtzlpOPRDG5qBRW7NhFBVJCkQ19Z4Cp0yPJVuUDNDsvL4gnogxkVyz5NG+Sy/rswqeCbk+8u1VnbIil2JCh1iVv+7dVkGqb4O7XP4J6lkVvXhJRYKIciQ4KAE9pgBms8K5lik0Q3EDSlE9swaH7WqYcZjWp0pDGHPtyoLktV4BjnF8+As1I4zahSj4Vyik9hwnM6Jn1IxkTtwqajA2kVWk4WgDaim/liuQlNA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:MIME-Version; bh=RR5oXheggDIpsmaDMDkko1nkDJoyPp2gocpNBXOybJw=; b=NZNJe/Dase2uDtlz7nuWRWtG8S523/AsEbUdwfDzpoBFDLPcgoNBaavzD1IEkE11YDvZn0z3EZ+xVBnnNFHtCIfviC1gqAVe2982x6ECcHbibItwlZBUHcpjiCLLqWxp/Ix2Li+yOfEFCdyHKJ/SiqP/JufAYVbg8c4j/H+U4UjBCQDkbqeApGnqhFUR1knB1PdQSIMpbRChLR6VvF72WfPbGJBulVX4QG2+L0sg1dLe/5YhUOGzvh8u7Di7ZBB89dKn+NYWMrAvLWx9zonMEae173DMn5CaNn4+N082pg3NPwJfmPP/0IpQIDQMcHdLm0JtIJhNGwyBpBAzlJqivA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=atomlin.com; dmarc=pass action=none header.from=atomlin.com; dkim=pass header.d=atomlin.com; arc=none Authentication-Results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=atomlin.com; Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) by CWLP123MB2769.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:55::9) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.428.14; Sat, 19 Sep 2026 00:55:59 +0000 Received: from CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230]) by CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM ([fe80::cec4:77ab:262e:d230%4]) with mapi id 15.21.0428.011; Sat, 19 Sep 2026 00:55:59 +0000 From: Aaron Tomlin To: peterz@infradead.org, mingo@redhat.com, acme@kernel.org, namhyung@kernel.org Cc: mark.rutland@arm.com, alexander.shishkin@linux.intel.com, jolsa@kernel.org, irogers@google.com, adrian.hunter@intel.com, james.clark@linaro.org, howardchu95@gmail.com, atomlin@atomlin.com, neelx@suse.com, chjohnst@mail.com, sean@ashe.io, steve@abita.co, rishil1999@outlook.com, linux-perf-users@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH v3 perf-tools-next 7/7] perf trace beauty: Validate payload size in augmented perf_event_open beautifier Date: Fri, 18 Sep 2026 20:55:30 -0400 Message-ID: <20260919005530.728615-8-atomlin@atomlin.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260919005530.728615-1-atomlin@atomlin.com> References: <20260919005530.728615-1-atomlin@atomlin.com> Content-Transfer-Encoding: quoted-printable X-ClientProxiedBy: BN9PR03CA0661.namprd03.prod.outlook.com (2603:10b6:408:10e::6) To CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM (2603:10a6:400:183::5) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: CWLP123MB6607:EE_|CWLP123MB2769:EE_ X-MS-Office365-Filtering-Correlation-Id: 1b8ce5d7-307d-4d58-695d-08df15e8c515 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|376014|7416014|1800799024|23010399003|366016|10067099003|56012099006|6133799003|18002099003|22082099003; X-Microsoft-Antispam-Message-Info: HQFFFk3zz4l7wxQd+m5XtG66uYm+ymt/ZFfj/qjPvwttHZrinCZmeG/gq897vqgkB+qi9RnjiQIOe/1g7v2WJwNfxyXwwjvVPAQZNOqHjSgkN2sbVvjK/ojNprg9zudbh8/yzkAL/mpDPZVi1vludYE7EolWX/7+arHpDTjWBppJQRBSPgtOc0xOvQZ60oLMsc8eHOojJci2467z/b/+lv+RfikpODb+ERJHf1qLQCfR8oLoRJfe1PAlcnXEdNT3wMUoA3m+Ll2GZf0SZg72Z7NaW5hSKJbvPtlzzHbxwqA9BCk/SB+OoU7F+bmFjQb3SqfMIet0rxQMsTzaLsIPz2evLiZUdqw9htvBHmYAFOe4lYMtTwCTi+e8e7UNlzHueyRHYzEIMg8Uz1TKa8fTe61v314treC+dM6pp2F5Bu/AdV73F1sMVOoAbcdwCwvlc6946BjZJjXZVKR0hj0X347T6Euoe1MsI9u8Boo2TO798qbifakphaY38vtF9MpVURhpwROWLVpLxKZM2zGHaV/NsMMLkHNg6WHKv5OvUSlHsQA0Pg8rCZ7Oaxk6i8+AikEAY7zFF4z5tGzyzemK0fZ3VhFZtoU7r+T6uvl7E5YeFEj6xyE1DRsTAYxlbcc/XoyrXmI8sinli1b+TdDI6unMv1PRj3pifXtpZW+2ZrY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM;PTR:;CAT:NONE;SFS:(13230040)(376014)(7416014)(1800799024)(23010399003)(366016)(10067099003)(56012099006)(6133799003)(18002099003)(22082099003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?gWVoZ3RGD/5CANwA7ii+nDz7zp+ltFAfUDAHVWTpUeL8Na9KStLokeio8CsL?= =?us-ascii?Q?qg0OfHmXNIWeO3FYsQLwrMvjc9dfzhRZtciNnyF4txcgEdfOHS3K7na90XOF?= =?us-ascii?Q?ZxkOr5bxXAVdHJLdielzBPUTewPIrM+FjW7F5Og3hzp1Aaa9DbqIwg5swTeN?= =?us-ascii?Q?VUmzEeRJCRjq92hUdMvN0uRpy3SZbC1L/FD11XG9tZaK2SaegmVEMwmCPQFU?= =?us-ascii?Q?fAZJ0g4idoKKU5k9sZ5GTnxkkc3gnfxsIAKSwN0cJLqgU7fA9s1L8WbCarZL?= =?us-ascii?Q?8zsR5aDKVpkBLtPU8CfG43/KufDAeUO3ThiEztKZg9q5LuYn/L4gADwywmop?= =?us-ascii?Q?BzACCqcRh84ak92W4fLsXiMQ5M+LRTea5OoBsJa5MJ0VzIHl7RcNDRsAHRPw?= =?us-ascii?Q?kWaphmZ2ChXxP5b9urzEzrWNvFW1azTTzFrqncygHaQZ7D4CdHkGVfwtemUF?= =?us-ascii?Q?nmWjuc5GnvTt7FC//k4rpqsq6a8KwQEhoU6SJ2fZ+cvQfHeVZr2t3K70M/9J?= =?us-ascii?Q?c40h9Hrqar1Q6jZJQzFq1m9dVqDYuN3glQS4Pei3V9k0I9Dq3UPa7B6xn9kB?= =?us-ascii?Q?tYRhkIB7i57tSSIz1kUMBKL3D6hDS24xrakpO6BmjLb3/W3IzOHDrt7Egh63?= =?us-ascii?Q?Jh/9CyTq+CR83yfnAUAGK/siCRk+TPxlceou4HzZx4hi0gWmPVqEkyimH7pc?= =?us-ascii?Q?OtzIxuMfduC9SU+zHQ+vaXrTJX43wvjynjqdE1Ep12O1i71+y6yhqr1TfrCd?= =?us-ascii?Q?U2VeR3NM5Sv84lKsdHU8OzAlL8ayeHKkTGE/d9/h33yMxi1YMjKeWBFm0ine?= =?us-ascii?Q?3w1tfTGTtngW5thdMXpjRX0wK61Bs6x4D20APAXADG1is4sZIwaJ2CYvTBc4?= =?us-ascii?Q?b6NmbjIfEXJqvUuKJ37URg33wk5EsJBJ03tu1n2opv+qBNFgyAN3huo16DD0?= =?us-ascii?Q?CKDldA3t+c8Vl7L2Nchd3SuGGVprtf3itsA046bZOpmkwDHceSUBfEH8oAU4?= =?us-ascii?Q?YGnWwPuvw3do88dvMwJ+9VGRggYwO9qpZXnFZma6G3pfZDGK6RnVZS0SA7tG?= =?us-ascii?Q?WXylKviaaXWGtcgxJ7Vjf1BFKvqOjwk88M08tSzvihk0X7GqA2/YpBX6FVNQ?= =?us-ascii?Q?euDs/C/6i42KH68PZmynurODRuFAMR/VqAKvU6pl3cQKRcsbCR88516ujW4V?= =?us-ascii?Q?HNoITw+XjvN65Ccuhvn+10HebjVGOSLnoKM33orYVVu6LsTtSU1gBZGtWrHb?= =?us-ascii?Q?bIaCEcinCqEb/CT9l0ae/TYq4b09JRTRbYewysyuf0bpQRipe45qQNZFZQFQ?= =?us-ascii?Q?uSni/ZJwg+F/U5P9qzG56sIB4XCGpfYiEXLVA6/XZdG46Llya9k07yuV0E9M?= =?us-ascii?Q?6ZIkD3s8UFhbLqWmVlKzRlFv391rUwoK8esiFOkPHbMIwpZNJqdulf08uaSe?= =?us-ascii?Q?o6trePKWr/jRFweixX26TCq45R1YD3B0mRmzXS+f+5qWnvQ9JMDuMGcwOslz?= =?us-ascii?Q?Ikni4M+uc3Khy6tsBxIpc9rgPvAByN3frAnEvbVsA42w0xNU0jb0PDzV+PGg?= =?us-ascii?Q?2SiPdI7PeCxpAOP5Xtd4bAeXeJ1UqwS5bWdRC6sz2kwYNyTu1QBBeioVqMiO?= =?us-ascii?Q?FwW3tICQLbs8HPcl+ZMDXExZlynb3bmXJmjKuig6mB35p80j9jHhyXVAumws?= =?us-ascii?Q?oDuyurUdQ0iNYsexbwUgr1rDpTfktFLEDHLWgI7YEwaICyfZLaSeOLGG/A7U?= =?us-ascii?Q?2nXzidtX7Q=3D=3D?= X-OriginatorOrg: atomlin.com X-MS-Exchange-CrossTenant-Network-Message-Id: 1b8ce5d7-307d-4d58-695d-08df15e8c515 X-MS-Exchange-CrossTenant-AuthSource: CWLP123MB6607.GBRP123.PROD.OUTLOOK.COM X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 19 Sep 2026 00:55:59.5000 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: e6a32402-7d7b-4830-9a2b-76945bbbcb57 X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: a07m34zq/N3DYDHsHKYK0YsbyYdVB2pJcI5l3s9M2c7yoNtNUY4SCJDxgwfe8GzR2LeZ1ZI/T22FxO6b2sSMYQ== X-MS-Exchange-Transport-CrossTenantHeadersStamped: CWLP123MB2769 Content-Type: text/plain; charset="utf-8" When pretty-printing augmented perf_event_attr arguments via syscall_arg__scnprintf_augmented_perf_event_attr(), arg->augmented.args->value is cast to struct perf_event_attr and read without verifying that the captured payload is large enough to contain at least PERF_ATTR_SIZE_VER0 bytes. If a malformed or truncated perf.data record provides an augmented payload smaller than PERF_ATTR_SIZE_VER0, accessing attr->size or executing memcpy(&local_attr, attr, PERF_ATTR_SIZE_VER0) reads memory past the end of the available buffer. Furthermore, when attr->size is specified, accessing fields up to attr->size without verifying that the captured payload contains at least that many bytes risks out-of-bounds reads. Validate that arg->augmented.size is at least sizeof(struct augmented_arg) + PERF_ATTR_SIZE_VER0. If attr->size is non-zero, verify that it is at least PERF_ATTR_SIZE_VER0 and that the captured payload contains sufficient bytes before proceeding with pretty-printing. If validation fails, fall back to printing the raw pointer value. Fixes: a9cd6c676685 ("perf trace: Add BPF augmenter to perf_event_open()'s = 'struct perf_event_attr' arg") Reported-by: sashiko-bot Signed-off-by: Aaron Tomlin --- tools/perf/trace/beauty/perf_event_open.c | 23 +++++++++++++++++++---- 1 file changed, 19 insertions(+), 4 deletions(-) diff --git a/tools/perf/trace/beauty/perf_event_open.c b/tools/perf/trace/b= eauty/perf_event_open.c index 6315b46bcdf0..92f84472e7fd 100644 --- a/tools/perf/trace/beauty/perf_event_open.c +++ b/tools/perf/trace/beauty/perf_event_open.c @@ -81,8 +81,16 @@ static size_t perf_event_attr___scnprintf(struct perf_ev= ent_attr *attr, char *bf =20 static size_t syscall_arg__scnprintf_augmented_perf_event_attr(struct sysc= all_arg *arg, char *bf, size_t size) { - struct perf_event_attr *attr =3D (void *)arg->augmented.args->value; + struct augmented_arg *augmented_arg =3D arg->augmented.args; + struct perf_event_attr *attr; struct perf_event_attr local_attr; + size_t payload_size; + + if (arg->augmented.size < (int)(sizeof(*augmented_arg) + PERF_ATTR_SIZE_V= ER0)) + return 0; + + attr =3D (void *)augmented_arg->value; + payload_size =3D arg->augmented.size - sizeof(*augmented_arg); =20 /* * augmented_raw_syscalls.bpf.c (shipped with perf) copies @@ -93,7 +101,10 @@ static size_t syscall_arg__scnprintf_augmented_perf_eve= nt_attr(struct syscall_ar * without writing to the potentially read-only augmented * args buffer. */ - if (!attr->size) { + if (attr->size) { + if (attr->size < PERF_ATTR_SIZE_VER0 || payload_size < attr->size) + return 0; + } else { memcpy(&local_attr, attr, PERF_ATTR_SIZE_VER0); memset((void *)&local_attr + PERF_ATTR_SIZE_VER0, 0, sizeof(local_attr) - PERF_ATTR_SIZE_VER0); @@ -107,8 +118,12 @@ static size_t syscall_arg__scnprintf_augmented_perf_ev= ent_attr(struct syscall_ar =20 size_t syscall_arg__scnprintf_perf_event_attr(char *bf, size_t size, struc= t syscall_arg *arg) { - if (arg->augmented.args) - return syscall_arg__scnprintf_augmented_perf_event_attr(arg, bf, size); + if (arg->augmented.args) { + size_t printed =3D syscall_arg__scnprintf_augmented_perf_event_attr(arg,= bf, size); + + if (printed) + return printed; + } =20 return scnprintf(bf, size, "%#lx", arg->val); } --=20 2.55.0