From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0232A3264F1; Wed, 10 Jun 2026 16:52:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781110348; cv=none; b=sm9Z3oPtaNBHM0n55/z4h2U3faE9mmcDyxrCWu5RyPFcXG3/tt1ggVB54T9sTguTd1BK2VJicAlZlfFDitMbZx31st8SzUIWttmsj5IznI3kSu86ba0dhEs8tlBxa0+BX57JqbaedYBSQ+XrTqhJrXQWwcSRyQlObqshFwVRDRQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781110348; c=relaxed/simple; bh=6E0jlwjo8dDiP2EqUUKHlNjQnr9XYwg9NEpdtvivBA0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=I8SPij6/SuU8IxoqZux9dsps+a/lgWEK4e4ciU04a9gCxGXQtbNrVVMpZXYpPIUqtCU6LGWdSXdfKEasH5NsLHMVk3R48OlUFnYumyHGmDlbZe3ybHApa7zIqB7sAsB7pRFqW0D0RIcsCf5DgSMEYbISy9Ie5HYaH9ABt5gZCpk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=MrVpf0R3; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="MrVpf0R3" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CCF361F00893; Wed, 10 Jun 2026 16:52:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1781110346; bh=k9BqWutRvw0+RkzNORm405vrBwlivKjfA199rTg8lc0=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=MrVpf0R3MSKAEU8VUWd+c2lJDVibERHTvt74akEsXr3H4mu8PEeXz1uaSlMqpZGq0 BQJzdVPFQINFLYN0O3w00enDVC2n3KF/6QNeLwdvwbLzD13lzQqwqsOU1EGbbJVjWe NOziHpyzM0Id4RdODEBcJCjTusKvLkQ+gCCcqEmX9j3ZY/UKhIKZr+D7L9R5raXCyv HPQ9UITMDN1POYJfgUx/t8TQUlc6sXhrJA4+tnCPYNtHZh2Qn13ZwHtTcSDBNnrJ4f 1qwADCEFgotOxSrwaE44EPfcjz83N7pY3COY3ysa/dzPCszCcUa3IR93EGjpoW+f7i 2MP/OVi2C2HOQ== From: Arnaldo Carvalho de Melo To: Namhyung Kim Cc: Ingo Molnar , Thomas Gleixner , James Clark , Jiri Olsa , Ian Rogers , Adrian Hunter , Clark Williams , linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, Arnaldo Carvalho de Melo , sashiko-bot , "Claude Opus 4.6" Subject: [PATCH 02/11] perf tools: Use scnprintf() in cpu_map__snprint() to prevent overflow Date: Wed, 10 Jun 2026 13:51:56 -0300 Message-ID: <20260610165207.2077258-3-acme@kernel.org> X-Mailer: git-send-email 2.54.0 In-Reply-To: <20260610165207.2077258-1-acme@kernel.org> References: <20260610165207.2077258-1-acme@kernel.org> Precedence: bulk X-Mailing-List: linux-perf-users@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Arnaldo Carvalho de Melo cpu_map__snprint() accumulates snprintf() return values in ret. snprintf() returns the number of characters that *would have been written* on truncation, not the actual count. When a fragmented CPU list exceeds the buffer, ret grows past size, causing `size - ret` to underflow (both are size_t), and subsequent snprintf() calls write past the end of the caller's stack buffer. Switch to scnprintf() which returns the actual number of characters written, making ret accumulation safe by construction. Fixes: a24020e6b7cf6eb8 ("perf tools: Change cpu_map__fprintf output") Reported-by: sashiko-bot Reviewed-by: Ian Rogers Cc: Jiri Olsa Cc: Ian Rogers Assisted-by: Claude Opus 4.6 Signed-off-by: Arnaldo Carvalho de Melo --- tools/perf/util/cpumap.c | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c index 1fab00ec4a59a0c7..23ebe9b97f8e58af 100644 --- a/tools/perf/util/cpumap.c +++ b/tools/perf/util/cpumap.c @@ -692,21 +692,21 @@ size_t cpu_map__snprint(struct perf_cpu_map *map, char *buf, size_t size) if (start == -1) { start = i; if (last) { - ret += snprintf(buf + ret, size - ret, - "%s%d", COMMA, - perf_cpu_map__cpu(map, i).cpu); + ret += scnprintf(buf + ret, size - ret, + "%s%d", COMMA, + perf_cpu_map__cpu(map, i).cpu); } } else if (((i - start) != (cpu.cpu - perf_cpu_map__cpu(map, start).cpu)) || last) { int end = i - 1; if (start == end) { - ret += snprintf(buf + ret, size - ret, - "%s%d", COMMA, - perf_cpu_map__cpu(map, start).cpu); + ret += scnprintf(buf + ret, size - ret, + "%s%d", COMMA, + perf_cpu_map__cpu(map, start).cpu); } else { - ret += snprintf(buf + ret, size - ret, - "%s%d-%d", COMMA, - perf_cpu_map__cpu(map, start).cpu, perf_cpu_map__cpu(map, end).cpu); + ret += scnprintf(buf + ret, size - ret, + "%s%d-%d", COMMA, + perf_cpu_map__cpu(map, start).cpu, perf_cpu_map__cpu(map, end).cpu); } first = false; start = i; -- 2.54.0