From: sashiko-bot@kernel.org
To: "Aaron Tomlin" <atomlin@atomlin.com>
Cc: linux-perf-users@vger.kernel.org
Subject: Re: [PATCH v2 perf-tools-next 1/6] perf trace: Add upper bound checks for augmented BTF struct printing
Date: Mon, 07 Sep 2026 02:02:19 +0000 [thread overview]
Message-ID: <20260907020219.9E1C61F00A3A@smtp.kernel.org> (raw)
In-Reply-To: <20260907015140.363076-2-atomlin@atomlin.com>
> When pretty-printing augmented struct payloads using BTF via
> btf_struct_scnprintf(), augmented_arg->size is currently only validated
> against values <= 0.
>
> However, several edge cases can result in size mismatches or buffer
> over-reads:
> 1. If arg->augmented.size is smaller than sizeof(*augmented_arg),
> dereferencing augmented_arg->size reads past the available
> buffer.
>
> 2. If augmented_arg->size exceeds arg->augmented.size -
> sizeof(*augmented_arg), calculating consumed =
> sizeof(*augmented_arg) + augmented_arg->size can overflow signed
> integer limits (e.g., with crafted INT_MAX values in an
> untrusted perf.data file) or cause arg->augmented.size to
> [ ... ]
> btf_dump__dump_type_data().
>
> Fixes: cb32035214b9 ("perf trace: Pretty print struct data")
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Signed-off-by: Aaron Tomlin <atomlin@atomlin.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260907015140.363076-1-atomlin@atomlin.com?part=1
next prev parent reply other threads:[~2026-09-07 2:02 UTC|newest]
Thread overview: 13+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-07 1:51 [PATCH v2 perf-tools-next 0/6] perf trace: Validate payload bounds across augmented argument beautifiers Aaron Tomlin
2026-09-07 1:51 ` [PATCH v2 perf-tools-next 1/6] perf trace: Add upper bound checks for augmented BTF struct printing Aaron Tomlin
2026-09-07 2:02 ` sashiko-bot [this message]
2026-09-07 1:51 ` [PATCH v2 perf-tools-next 2/6] perf trace: Validate payload bounds in augmented string beautifier Aaron Tomlin
2026-09-07 2:06 ` sashiko-bot
2026-09-07 1:51 ` [PATCH v2 perf-tools-next 3/6] perf trace: Validate payload bounds in augmented buffer beautifier Aaron Tomlin
2026-09-07 2:07 ` sashiko-bot
2026-09-07 1:51 ` [PATCH v2 perf-tools-next 4/6] perf trace beauty: Validate payload size in augmented timespec beautifier Aaron Tomlin
2026-09-07 2:05 ` sashiko-bot
2026-09-07 1:51 ` [PATCH v2 perf-tools-next 5/6] perf trace beauty: Validate payload size in augmented sockaddr beautifier Aaron Tomlin
2026-09-07 2:03 ` sashiko-bot
2026-09-07 1:51 ` [PATCH v2 perf-tools-next 6/6] perf trace beauty: Validate payload size in augmented perf_event_open beautifier Aaron Tomlin
2026-09-07 2:06 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260907020219.9E1C61F00A3A@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=atomlin@atomlin.com \
--cc=linux-perf-users@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.