From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E65DD28E0; Sat, 12 Sep 2026 16:31:13 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789230675; cv=none; b=eAZuNWC9Nz0QZxHQ13y/6uDSh+IrCdsatY7qaoBt+OVNrxGrfVPZiaTLJw9SAfcFItpqv0ijJhoeaNiDhJZ+lVLEYFMHiCFn9c8/HbNvz6IPceARAvX8xNlgt3eacijqgiieY9VhW/ihLWSFhmv5k84rh+FD1mQ7kkYMbFetAQ0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789230675; c=relaxed/simple; bh=B7e80TAxxSsmA24zE4Qbc1QF8ET4eCfhKNUKyg89B9g=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=tx5SdpZY95axOPnrFB0gdkoI+hIR46EGWs/0mO+KEipy+SXpyCcAdtPT0RQhQAdZFI4E97BmK3BynnuqfBk03oLEL+lQXlXQ9rWWxmCkCzZtTvJaR5EpNZLGaC7tUUPEv2JoD4B3dIEyeoc+vg7sp/IMmTxzj8otN6g/LXbZnCU= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=XPAMoffU; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="XPAMoffU" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 3F5C81F000FF; Sat, 12 Sep 2026 16:31:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789230673; bh=Xx1yMlEg96tqB3cVHHnKFf0jyWM5uqnh3o/BOvwVUqA=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=XPAMoffUI3HqIcur6EtII+P6uK/n3qEavG8wKzJNRpv3DnWr9dHUkcYeGDCN0z5iS IBTeKm9vkKZeWvq83J23HFA2Px9x7NebhtmjT6UUfPVf7s3WV8BQJl6blJBRNnt53p fV2G2cU07o3oJAYTQwPJZ3WG/JUcwvjd94FV5SCU= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, sashiko-bot , Arnaldo Carvalho de Melo , James Clark , Adrian Hunter , Namhyung Kim , Sasha Levin Subject: [PATCH 6.1 0843/1191] perf thread-stack: Fix heap buffer overflow on branch stack wrap copy Date: Sat, 12 Sep 2026 08:59:31 +0200 Message-ID: <20260912065607.192638115@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065548.086904252@linuxfoundation.org> References: <20260912065548.086904252@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnaldo Carvalho de Melo [ Upstream commit ab9c84d1cd59e6b3b73de34982a35a76e3a9b032 ] thread_stack__br_sample() copies the wrap-around portion of the branch stack ring buffer with: nr = min(ts->br_stack_pos, sz); memcpy(be, &src->entries[0], bsz * ts->br_stack_pos); 'nr' is correctly bounded to min(br_stack_pos, sz) but the memcpy uses the unbounded ts->br_stack_pos directly. When br_stack_pos exceeds the remaining destination space 'sz', this writes past the destination buffer. Use 'nr' (the bounded value) in the memcpy size, matching the pattern of the first memcpy in the same function. Fixes: 86d67180b920 ("perf thread-stack: Add branch stack support") Reported-by: sashiko-bot Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo Reviewed-by: James Clark Reviewed-by: Adrian Hunter Signed-off-by: Namhyung Kim Signed-off-by: Sasha Levin --- tools/perf/util/thread-stack.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/perf/util/thread-stack.c b/tools/perf/util/thread-stack.c index 1b992bbba4e8e..b1766d62eb718 100644 --- a/tools/perf/util/thread-stack.c +++ b/tools/perf/util/thread-stack.c @@ -641,7 +641,7 @@ void thread_stack__br_sample(struct thread *thread, int cpu, sz -= nr; be = &dst->entries[nr]; nr = min(ts->br_stack_pos, sz); - memcpy(be, &src->entries[0], bsz * ts->br_stack_pos); + memcpy(be, &src->entries[0], bsz * nr); } } -- 2.53.0