Re: [PATCH v3 perf-tools-next 5/7] perf trace beauty: Validate payload size in augmented timespec beautifier

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] perf: Silently disables nanosleep augmentation on 64-bit due to BPF size mismatch
--

commit d5a8c844e701a29578b91e18d924a25e7e3167e6
Author: Aaron Tomlin <atomlin@atomlin.com>

perf trace beauty: Validate payload size in augmented timespec beautifier

This commit introduces bounds checking in the timespec beautifier to prevent
reading past the end of the available buffer if a malformed or truncated
perf.data record is provided.

> diff --git a/tools/perf/trace/beauty/timespec.c b/tools/perf/trace/beauty/timespec.c
> index b14ab72a2738e..84755d8d2c87f 100644
> --- a/tools/perf/trace/beauty/timespec.c
> +++ b/tools/perf/trace/beauty/timespec.c
> @@ -7,15 +7,24 @@
>  
>  static size_t syscall_arg__scnprintf_augmented_timespec(struct syscall_arg *arg, char *bf, size_t size)
>  {
> -	struct timespec *ts = (struct timespec *)arg->augmented.args->value;
> +	struct augmented_arg *augmented_arg = arg->augmented.args;
> +	struct timespec *ts;
>  
> +	if (arg->augmented.size < (int)(sizeof(*augmented_arg) + sizeof(*ts)))
> +		return 0;

[Severity: High]
Does this bounds check deterministically fail for the nanosleep syscall on
64-bit platforms?

When tracing the nanosleep syscall using perf trace, the BPF script
sys_enter_nanosleep incorrectly calculates its output length by omitting
sizeof(u64) for the augmented_arg header, outputting exactly 16 bytes.

The bounds check introduced here requires sizeof(*augmented_arg) + sizeof(*ts),
which is 24 bytes on 64-bit systems. Since 16 < 24, the check deterministically
fails and silently returns 0.

This disables the nanosleep augmentation feature on 64-bit systems, falling
back to raw pointer printing instead of showing the timespec structure.

> +
> +	ts = (struct timespec *)augmented_arg->value;
>  	return scnprintf(bf, size, "{ .tv_sec: %" PRIu64 ", .tv_nsec: %" PRIu64 " }", ts->tv_sec, ts->tv_nsec);
>  }

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260919005530.728615-1-atomlin@atomlin.com?part=5