From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from pdx-out-015.esa.us-west-2.outbound.mail-perimeter.amazon.com (pdx-out-015.esa.us-west-2.outbound.mail-perimeter.amazon.com [50.112.246.219]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 14C1D3C584A for ; Wed, 9 Sep 2026 21:05:19 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=50.112.246.219 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788987921; cv=none; b=ArSP9RUy1oxHEoxYAEfCP315jjl7iQMz0oIpRaM7yLSAG/rYkbf7Dd2777SQ9umfaWGOBpHfNqIdSWbyr8UsXpH0JTW3pBm0vFOTlPY2wqBKn7n+nMI0pVlcMMaeetcG5g7WFvaDB+gtOUjxOr2it7oTSPr13XMQaTVGAoFfgLs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788987921; c=relaxed/simple; bh=aYtbOV9TWdZBdE+mBF9zbY12lM9MnV4Q2Tp7N6nxdxA=; h=From:To:CC:Subject:Date:Message-ID:MIME-Version:Content-Type; b=bUaMg9YoFzEmEo7XtKvI9qbrQcAO6+4IagZpc/A+XEz3oyHZBx7VvI328XuHHo0ip+v49Ld1t1vS4w56PeE6jL3EFNIJGXf5mZamCk/J0LAztE3UTAGNHlD/IVG5LWbRVdOsHTCV0WMH0IWMuscy+4UAnMjJtJ0wKFglCHlTdH0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.de; spf=pass smtp.mailfrom=amazon.de; dkim=pass (2048-bit key) header.d=amazon.de header.i=@amazon.de header.b=Lb9LHdRK; arc=none smtp.client-ip=50.112.246.219 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.de Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.de Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=amazon.de header.i=@amazon.de header.b="Lb9LHdRK" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.de; i=@amazon.de; q=dns/txt; s=amazoncorp2; t=1788987920; x=1820523920; h=from:to:cc:subject:date:message-id:mime-version: content-transfer-encoding; bh=1YQCcxcOrNN4lNpumJNNZlouCYqarXID5h9vk1zAlSs=; b=Lb9LHdRKKmc19sZ/FSeFvOBUkb380LPNNJESQJ6HEXDiIu/69aj5QqJ/ kwnimz4PXU7qSbkqigDGW12Oe0rOB8dgyVO2FzcMrFwoTEHRN3D2Y/O/m ETl4fovURkBAY9i+OnYojuz9a4zNjiC5yZ6HCVmREESJRCXDHY13JOQGN yVhTY3EeOeaWkHl2I/31rLpiCAJzgFQ7yU/zodV04ae9gZ5a8GGoc8ny3 bYzfkfUgyIMm9fSDwCzxS2HkhG2imy2UkAGBa6ZSb3Y5OeHDnCVsDH2mK LufQXEeX+DPKMk4wmwMJ6rML9Xz6+Yqj79WYjbiwucPf/tZTgr1ZOM/X4 g==; X-CSE-ConnectionGUID: Zcb70jhxQwy/PzPvMNNzmg== X-CSE-MsgGUID: T/KhFYXlSqaUYNLrOSWxwQ== X-IronPort-AV: E=Sophos;i="6.25,271,1779148800"; d="scan'208";a="28045604" Received: from ip-10-5-0-115.us-west-2.compute.internal (HELO smtpout.naws.us-west-2.prod.farcaster.email.amazon.dev) ([10.5.0.115]) by internal-pdx-out-015.esa.us-west-2.outbound.mail-perimeter.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 09 Sep 2026 21:05:16 +0000 Received: from EX19MTAUWA001.ant.amazon.com [205.251.233.236:8133] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.37.160:2525] with esmtp (Farcaster) id 53a96411-a890-493c-87fb-c6524f0e3cc8; Wed, 9 Sep 2026 21:05:16 +0000 (UTC) X-Farcaster-Flow-ID: 53a96411-a890-493c-87fb-c6524f0e3cc8 Received: from EX19D001UWA001.ant.amazon.com (10.13.138.214) by EX19MTAUWA001.ant.amazon.com (10.250.64.218) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.45; Wed, 9 Sep 2026 21:05:16 +0000 Received: from dev-dsk-doebel-1a-7b355d76.us-east-1.amazon.com (10.169.119.5) by EX19D001UWA001.ant.amazon.com (10.13.138.214) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.2562.46; Wed, 9 Sep 2026 21:05:15 +0000 From: Bjoern Doebel To: CC: Arnaldo Carvalho de Melo , Subject: [PATCH 5.15.y] perf sched: Fix register_pid() overflow, strcpy, and BUG_ON Date: Wed, 9 Sep 2026 21:05:00 +0000 Message-ID: <20260909210503.199459-2-doebel@amazon.de> X-Mailer: git-send-email 2.50.1 Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit X-ClientProxiedBy: EX19D037UWC002.ant.amazon.com (10.13.139.250) To EX19D001UWA001.ant.amazon.com (10.13.138.214) From: Arnaldo Carvalho de Melo commit 5949d339f5ec98752d56dcd4e36f619a59d513a5 upstream. register_pid() has several issues when processing untrusted perf.data: 1. Integer overflow: (pid + 1) * sizeof(struct task_desc *) can wrap to a small value on 32-bit systems when pid is large (e.g. 0x40000000), causing realloc to return a tiny buffer followed by out-of-bounds writes in the initialization loop. 2. Heap buffer overflow: strcpy(task->comm, comm) copies the untrusted comm string into a fixed 20-byte COMM_LEN buffer with no length check. 3. BUG_ON on allocation failure: perf.data is untrusted input, so allocation failures should be handled gracefully rather than killing the process. 4. Realloc of sched->tasks assigned directly back, leaking the old pointer on failure; nr_tasks incremented before the realloc, leaving corrupted state on failure. Cap pid at PID_MAX_LIMIT (4194304, matching the kernel's maximum on 64-bit), replace strcpy with strlcpy, guard against NULL comm, replace BUG_ON with NULL returns using safe realloc patterns, and add NULL checks in callers that dereference the result. Fixes: ec156764d424 ("perf sched: Import schedbench.c") Reported-by: sashiko-bot Cc: Ingo Molnar Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo [doebel: context adjustment for 5.15] Signed-off-by: Bjoern Doebel --- diff --git a/tools/perf/builtin-sched.c b/tools/perf/builtin-sched.c index 95a549fdabe0..ecf2e01ab4e7 100644 --- a/tools/perf/builtin-sched.c +++ b/tools/perf/builtin-sched.c @@ -50,6 +50,7 @@ #define COMM_LEN 20 #define SYM_LEN 129 #define MAX_PID 1024000 +#define PID_MAX_LIMIT 4194304 /* kernel limit on 64-bit */ static const char *cpu_list; static DECLARE_BITMAP(cpu_bitmap, MAX_NR_CPUS); @@ -446,17 +447,28 @@ static void add_sched_event_sleep(struct perf_sched *sched, struct task_desc *ta static struct task_desc *register_pid(struct perf_sched *sched, unsigned long pid, const char *comm) { - struct task_desc *task; + struct task_desc *task, **tasks_p; static int pid_max; + /* perf.data is untrusted — cap pid to prevent overflow in size calculations */ + if (pid >= PID_MAX_LIMIT) { + pr_err("pid %lu exceeds limit %d, skipping\n", pid, PID_MAX_LIMIT); + return NULL; + } + if (sched->pid_to_task == NULL) { if (sysctl__read_int("kernel/pid_max", &pid_max) < 0) pid_max = MAX_PID; - BUG_ON((sched->pid_to_task = calloc(pid_max, sizeof(struct task_desc *))) == NULL); + sched->pid_to_task = calloc(pid_max, sizeof(struct task_desc *)); + if (sched->pid_to_task == NULL) + return NULL; } if (pid >= (unsigned long)pid_max) { - BUG_ON((sched->pid_to_task = realloc(sched->pid_to_task, (pid + 1) * - sizeof(struct task_desc *))) == NULL); + void *p = realloc(sched->pid_to_task, (pid + 1) * sizeof(struct task_desc *)); + + if (p == NULL) + return NULL; + sched->pid_to_task = p; while (pid >= (unsigned long)pid_max) sched->pid_to_task[pid_max++] = NULL; } @@ -467,9 +479,11 @@ static struct task_desc *register_pid(struct perf_sched *sched, return task; task = zalloc(sizeof(*task)); + if (task == NULL) + return NULL; task->pid = pid; - task->nr = sched->nr_tasks; - strcpy(task->comm, comm); + if (comm) + strlcpy(task->comm, comm, sizeof(task->comm)); /* * every task starts in sleeping state - this gets ignored * if there's no wakeup pointing to this sleep state: @@ -477,10 +491,12 @@ static struct task_desc *register_pid(struct perf_sched *sched, add_sched_event_sleep(sched, task, 0, 0); sched->pid_to_task[pid] = task; - sched->nr_tasks++; - sched->tasks = realloc(sched->tasks, sched->nr_tasks * sizeof(struct task_desc *)); - BUG_ON(!sched->tasks); - sched->tasks[task->nr] = task; + tasks_p = realloc(sched->tasks, (sched->nr_tasks + 1) * sizeof(struct task_desc *)); + if (!tasks_p) + return NULL; + sched->tasks = tasks_p; + sched->tasks[sched->nr_tasks] = task; + task->nr = sched->nr_tasks++; if (verbose > 0) printf("registered task #%ld, PID %ld (%s)\n", sched->nr_tasks, pid, comm); @@ -824,6 +840,8 @@ replay_wakeup_event(struct perf_sched *sched, waker = register_pid(sched, sample->tid, ""); wakee = register_pid(sched, pid, comm); + if (waker == NULL || wakee == NULL) + return -1; add_sched_event_wakeup(sched, waker, sample->time, wakee); return 0; @@ -866,6 +884,8 @@ static int replay_switch_event(struct perf_sched *sched, prev = register_pid(sched, prev_pid, prev_comm); next = register_pid(sched, next_pid, next_comm); + if (prev == NULL || next == NULL) + return -1; sched->cpu_last_switched[cpu] = timestamp; -- 2.50.1