Re: [RFC PATCH 1/4] tools/tracing: Add fetcharg performance micro-benchmark

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 2 potential issue(s) to consider:
- [High] Divide by zero in benchmark calculation causing a kernel panic
- [Medium] Buffer Overflow / User-Space Out-of-Bounds Write due to ignored `count` in `fetcharg_bench_read`
--

commit e30ac26f087c17e4a2160772405d441b6e416abd
Author: Masami Hiramatsu (Google) <mhiramat@kernel.org>

tools/tracing: Add fetcharg performance micro-benchmark

This commit adds a benchmark test module and a shell script to measure the
execution overhead of fetchargs across kprobe, fprobe, and eprobe
configurations.

> diff --git a/tools/tracing/benchmark/fetcharg_bench.c b/tools/tracing/benchmark/fetcharg_bench.c
> new file mode 100644
> index 0000000000000..af18183c1f5d5
> --- /dev/null
> +++ b/tools/tracing/benchmark/fetcharg_bench.c
[ ... ]
> +static ssize_t fetcharg_bench_read(struct file *file, char __user *user_buf,
> +				   size_t count, loff_t *ppos)
> +{
> +	char buf[64];
> +	int len;
> +	u64 start, current_time;
> +	u64 elapsed;
> +	u64 loops_per_sec;
[ ... ]
> +	start = ktime_get_ns();
> +	for (i = 0; i < BENCH_ITERATIONS; i++)
> +		dummy += bench_func_ptr(a, b, c);
> +	current_time = ktime_get_ns();
> +
> +	elapsed = current_time - start;
> +	loops_per_sec = ((u64)BENCH_ITERATIONS * NSEC_PER_SEC) / elapsed;

[Severity: High]
Could this result in a divide by zero? If the system lacks high-resolution
timers or if the loop completes within the same timer tick, elapsed could
evaluate to 0 and cause a kernel panic.

> +
> +	len = snprintf(buf, sizeof(buf), "%llu\n", loops_per_sec);
> +	if (len < 0)
> +		return len;
> +
> +	if (copy_to_user(user_buf, buf, len))

[Severity: Medium]
Does this code ignore the user-provided count parameter?

If a user program calls read() on the debugfs file with a count parameter
smaller than the formatted string length len, it appears we could write beyond
the bounds of the user-provided buffer by copying len bytes instead of
honoring the count.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/178291352217.1566898.14481561093843379745.stgit@devnote2?part=1