Re: [PATCH 10/11] perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Stack buffer overflow in perf_pmu__for_each_event due to unchecked snprintf accumulation.
--

commit 6971cf80165017520e4fc2dbee2d01c9c2ff4efb
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf hists: Fix snprintf() in hists__scnprintf_title() UID filter path

This patch fixes a potential buffer overflow by switching an unchecked
snprintf call to scnprintf. The original code accumulated the return value
of snprintf, which could underflow the remaining size on subsequent calls.

> diff --git a/tools/perf/util/hist.c b/tools/perf/util/hist.c
> index 811d68fa6770c..df978c996b6c2 100644
> --- a/tools/perf/util/hist.c
> +++ b/tools/perf/util/hist.c
> @@ -2963,9 +2963,10 @@ int __hists__scnprintf_title(struct hists *hists, char *bf, size_t size, bool sh
>  			   ev_name, sample_freq_str, enable_ref ? ref : " ", nr_events);
>  
>  
> -	if (hists->uid_filter_str)
> -		printed += snprintf(bf + printed, size - printed,
> -				    ", UID: %s", hists->uid_filter_str);
> +	if (hists->uid_filter_str) {
> +		printed += scnprintf(bf + printed, size - printed,
> +				     ", UID: %s", hists->uid_filter_str);
> +	}

[Severity: High]
This is a pre-existing issue, but while you are fixing this unchecked
snprintf accumulation here, there appears to be another instance of the
exact same pattern in tools/perf/util/pmu.c:perf_pmu__for_each_event().

When accumulating buf_used across consecutive snprintf calls, if the first
formatted string is large enough:

tools/perf/util/pmu.c:perf_pmu__for_each_event() {
	...
	char buf[1024];
	...
	buf_used += snprintf(buf + buf_used, sizeof(buf) - buf_used,
			     "%G%s", event->scale, event->unit) + 1;
	...
	buf_used += snprintf(buf + buf_used, sizeof(buf) - buf_used,
			     "%.*s/%s/", (int)pmu_name_len, info.pmu_name,
			     event->terms) + 1;
	...
}

If the first snprintf returns a value causing buf_used to exceed
sizeof(buf), the second snprintf will execute with an underflowed limit
and an out-of-bounds destination pointer.

Could this write past the stack buffer if a crafted PMU sysfs entry is
encountered?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260608013057.1942953-1-acme@kernel.org?part=10