Re: [PATCH 1/5] perf thread-stack: Fix heap buffer overflow on branch stack wrap copy

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] Missing NULL pointer checks for `ts->br_stack_rb` cause deterministic crashes when processing events on a thread stack that lacks an allocated branch stack.
--

--- Patch [1]: [PATCH 1/5] perf thread-stack: Fix heap buffer overflow on branch stack wrap copy ---
commit 15a96772c52a6e753408d6e7f8ded1a5bb10c331
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf thread-stack: Fix heap buffer overflow on branch stack wrap copy

This commit fixes a heap buffer overflow in thread_stack__br_sample() where
the memcpy size for the wrap-around portion used an unbounded ts->br_stack_pos
instead of the bounded nr variable.

> diff --git a/tools/perf/util/thread-stack.c b/tools/perf/util/thread-stack.c
> index c5ce741b07446..1360f44421ef8 100644
> --- a/tools/perf/util/thread-stack.c
> +++ b/tools/perf/util/thread-stack.c
> @@ -642,7 +642,7 @@ void thread_stack__br_sample(struct thread *thread, int cpu,
>  		sz -= nr;
>  		be = &dst->entries[nr];
>  		nr = min(ts->br_stack_pos, sz);
> -		memcpy(be, &src->entries[0], bsz * ts->br_stack_pos);
> +		memcpy(be, &src->entries[0], bsz * nr);
>  	}
>  }

[Severity: Medium]
This is a pre-existing issue, but while looking at thread_stack__br_sample(),
is there a missing NULL pointer check for ts->br_stack_rb?

Earlier in this function, the code does:

	src = ts->br_stack_rb;
	if (!src->nr)
		return;

If thread_stack__process() supersedes an existing thread stack and allocates a
new one with a 0 branch stack size, or if the allocation for ts->br_stack_rb
fails during thread_stack__init(), ts->br_stack_rb can be NULL.

When thread_stack__br_sample() or thread_stack__update_br_stack() is
subsequently called, will this unconditionally dereference the NULL pointer
and cause the perf tool to crash?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260727161705.64807-1-acme@kernel.org?part=1