Re: [PATCH v2 10/14] perf test: Skip shebang and SPDX comments in shell test descriptions

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Critical] Buffer overflow vulnerability when resolving the script file path using readlink.
--

commit a792fd72a2438df9a3c43c3e30f07536ee6c563d
Author: Ian Rogers <irogers@google.com>

perf test: Skip shebang and SPDX comments in shell test descriptions

The parser incorrectly read SPDX tags or shebangs as shell test descriptions.
This refactors shell_test__description to use io__getline to correctly skip
them, preventing test description extraction breakage. This allows shell
tests to include standard SPDX headers without issues.

> diff --git a/tools/perf/tests/tests-scripts.c b/tools/perf/tests/tests-scripts.c
> index f18c4cd337c8f..48a2624da6438 100644
> --- a/tools/perf/tests/tests-scripts.c
> +++ b/tools/perf/tests/tests-scripts.c

[ ... ]

[Severity: Critical]
This isn't a bug introduced by this patch, but while reviewing I noticed a
potential buffer overflow in append_script().

tools/perf/tests/tests-scripts.c:append_script() {
    ...
	char filename[PATH_MAX], link[128];
    ...
	len = readlink(link, filename, sizeof(filename));
	if (len < 0) {
		pr_err("Failed to readlink %s", link);
		return;
	}
	filename[len++] = '/';
	strcpy(&filename[len], name);
    ...
}

If readlink() fills the buffer and returns PATH_MAX, does writing a slash at
filename[len++] write out of bounds on the stack?

Furthermore, if the combined length of the symlink target, the slash, and the
name string exceeds PATH_MAX, could strcpy() blindly write past the end of
the filename array and corrupt the stack?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260531052740.796087-1-irogers@google.com?part=10