From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pg1-f197.google.com (mail-pg1-f197.google.com [209.85.215.197]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 01C724499BC for ; Tue, 21 Jul 2026 23:10:04 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.215.197 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675407; cv=none; b=YHlPva1zbFrHj43irT9kLCeyhtH5ABHi4M2UJulr+Q/UJcx1GZad6/Yb4P6H1eyZxG+jMJhYFYJu9lsGBFhS1waouGue85uUcvVp9aMUwKRFuTdG8CFTUjoML9wccnvTBmth+4cjQxfO+JXTBsy3rD3gfzVI5Nt6KhnqkzdInn4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784675407; c=relaxed/simple; bh=Rhr9/VWiAOU2ysPViZ6y1/ZtZdHQlWxwu4lXWxiMujo=; h=Date:In-Reply-To:Mime-Version:References:Message-ID:Subject:From: To:Cc:Content-Type; b=VwICCiL30BNYRt9TCPJbT+dljmDDcyd6vpagJd3NHgK1x0+IaQW22YogrD4Jr3HslKpbVklXjy+Ie7ZGK6QEaSMYRfTG9XsI7oyhNHSxtAP7Z2Z3taMcGdX81KsE+LnxPp4dcceuHbIcEI/0ELio9ay/r73TxPEZ5KHHhx69kEE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=CxnRqwZ4; arc=none smtp.client-ip=209.85.215.197 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=flex--irogers.bounces.google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="CxnRqwZ4" Received: by mail-pg1-f197.google.com with SMTP id 41be03b00d2f7-cb5cc1e139bso2793358a12.3 for ; Tue, 21 Jul 2026 16:10:04 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20251104; t=1784675404; x=1785280204; darn=vger.kernel.org; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:from:to:cc:subject:date:message-id:reply-to :content-type; bh=WPc/SptN9OuaHPCuk46SdIx0RLVLfa1pOthKWdfhXgQ=; b=CxnRqwZ4PirDimVTmQYtDk/aQQhhmhAwPB/CL/E0lDnVmGypfOJrlyX8Gq6QySsQh+ vNZGpVyxh1QEezi0308Ytc8hTRZXTZ0J6UJmEIiv1F8jmRAkC3xmfYMsnRt1IFvlaRnc yMhT3td1bOlYNQih9qCDjjquIEyIZxJ8P6oenhP5d/l7k5tQyXyFrslWgeE3Nm+FjpKc DmmmFLZRx8jAdtELvoppKvw/6OaO8WZ5Sy7LwbqjgnqD7CfFbe39UCOaGi4tQV9WJBrO TiBO57da9gs6RoGXSw7NBegAarJgzNop5j70WV5RZo3DV5Chq0a2oE8x+REt+36JnsQG Nkvg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784675404; x=1785280204; h=content-type:cc:to:from:subject:message-id:references:mime-version :in-reply-to:date:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=WPc/SptN9OuaHPCuk46SdIx0RLVLfa1pOthKWdfhXgQ=; b=CDnWCW/WrRMOJ43ZDzuLT5AbDeyZBKZTVLCwC9JKpV3JsXlYxwceuhBeWQKbhMaLi2 Hm/XTt2nlTWZAsDNPy5HoIxNzOlsk+vY5AuXuBf8LcB58PBzXgdF8Y6w6r8Aic5PUaTi iSZMypIzZOwmt2vjwFMH1nYCkFXvOHTqpgXXnNIaTRmVXxCDF8ynOV655EK3ev+2f33r LKcvqn9sLMQkZeXgR2NfusnHDRdRwcTGF773LUqeDjRApO1GXrPwuAMDSRy45eaa0/QL 45lKbqskrBTkguBwR8ycYlZFTnm7qsgSGWD6JooffumoHvg7uqcucPNfz7H8dz4VQ5cV lN3A== X-Forwarded-Encrypted: i=1; AHgh+RoHmNlb2B9oIdRAr0IjpUqrgaZFIoWCU4CFl1oVBjrJsbQsA0HVEO668X5Eia3rZH+IHYYKJQ2M/t269Qc=@vger.kernel.org X-Gm-Message-State: AOJu0YxFGUMWmxETEI3f4VVBEtNswTDG/7aH/EXmy+qaCWvm+BvqYi2B zhm4+sYbafp8xoep5LPzh7gfi7XuC6DXfSb6WSOVQQXnrcGaK5MrV7NvRjC5Wkkphlqj7WipSqg V3lLHeH8QNQ== X-Received: from dldyq18-n1.prod.google.com ([2002:a05:701b:4552:10b0:13b:a0a0:3b98]) (user=irogers job=prod-delivery.src-stubby-dispatcher) by 2002:a05:6a21:7a96:b0:3c3:7cfe:b337 with SMTP id adf61e73a8af0-3c3ad7ad9e3mr18429814637.30.1784675403821; Tue, 21 Jul 2026 16:10:03 -0700 (PDT) Date: Tue, 21 Jul 2026 16:09:52 -0700 In-Reply-To: <20260721230952.267754-1-irogers@google.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: Mime-Version: 1.0 References: <20260721205746.183206-1-irogers@google.com> <20260721230952.267754-1-irogers@google.com> X-Mailer: git-send-email 2.55.0.229.g6434b31f56-goog Message-ID: <20260721230952.267754-5-irogers@google.com> Subject: [PATCH v6 4/4] perf synthetic-events: Fix bounds and union member access in mmap2 build_id synthesis From: Ian Rogers To: irogers@google.com, acme@kernel.org, namhyung@kernel.org Cc: adrian.hunter@intel.com, james.clark@linaro.org, jolsa@kernel.org, linux-kernel@vger.kernel.org, linux-perf-users@vger.kernel.org, mingo@redhat.com, peterz@infradead.org, ravi.bangoria@amd.com, swapnil.sapkal@amd.com Content-Type: text/plain; charset="UTF-8" Modify bounds and union member access in mmap2 build_id synthesis. Bound max_filename_len against the minimum of filename array capacity and the outer union stack layout minus sample ID trailers. This prevents both -E2BIG overruns and _FORTIFY_SOURCE array bounds aborts on strlcpy even if the enclosing union expands. Assisted-by: Antigravity:gemini-3.5-flash Signed-off-by: Ian Rogers --- tools/perf/util/synthetic-events.c | 20 ++++++++++++-------- 1 file changed, 12 insertions(+), 8 deletions(-) diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c index 4043d17a6140..704760e1dd5d 100644 --- a/tools/perf/util/synthetic-events.c +++ b/tools/perf/util/synthetic-events.c @@ -2450,13 +2450,18 @@ int perf_event__synthesize_mmap2_build_id(const struct perf_tool *tool, size_t filename_len = strlen(filename); size_t ev_len; u64 sample_type = sample->evsel ? sample->evsel->core.attr.sample_type : 0; - void *array; + void *array = &ev; int ret; + size_t max_filename_len; - if (filename_len >= sizeof(ev.mmap2.filename)) - return -EINVAL; + max_filename_len = min(sizeof(ev.mmap2.filename) - 1, + sizeof(ev) - (MAX_ID_HDR_ENTRIES * sizeof(__u64)) - + offsetof(struct perf_record_mmap2, filename) - 1); - ev_len = sizeof(ev.mmap2) - sizeof(ev.mmap2.filename) + filename_len + 1; + if (filename_len > max_filename_len) + filename_len = max_filename_len; + + ev_len = offsetof(struct perf_record_mmap2, filename) + filename_len + 1; ev_len = PERF_ALIGN(ev_len, sizeof(u64)); if (ev_len + MAX_ID_HDR_ENTRIES * sizeof(__u64) > sizeof(ev)) @@ -2476,16 +2481,15 @@ int perf_event__synthesize_mmap2_build_id(const struct perf_tool *tool, ev.mmap2.build_id_size = bid->size; if (ev.mmap2.build_id_size > sizeof(ev.mmap2.build_id)) - ev.build_id.size = sizeof(ev.mmap2.build_id); + ev.mmap2.build_id_size = sizeof(ev.mmap2.build_id); memcpy(ev.mmap2.build_id, bid->data, ev.mmap2.build_id_size); ev.mmap2.prot = prot; ev.mmap2.flags = flags; - memcpy(ev.mmap2.filename, filename, min(strlen(filename), sizeof(ev.mmap.filename))); + strlcpy(ev.mmap2.filename, filename, filename_len + 1); - array = &ev; - array += ev.header.size; + array = (void *)((char *)&ev + ev.header.size); ret = perf_event__synthesize_id_sample(array, sample_type, sample); if (ret < 0) return ret; -- 2.55.0.229.g6434b31f56-goog