Re: [PATCH v1 7/7] perf test: Add BPF JIT annotation test coverage for all disassemblers

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Removing a securely created temporary file before reusing its path creates a Time-Of-Check to Time-Of-Use (TOCTOU) race condition, allowing a local attacker to overwrite arbitrary system files or steal system-wide profiling data.
--

commit cc2ff8c9b984e996a4b88b05049833c644d20227
Author: Ian Rogers <irogers@google.com>

perf test: Add BPF JIT annotation test coverage for all disassemblers
    
This commit expands the annotate.sh shell test to verify BPF JIT disassembly. 
It captures system BPF programs and validates the temporary ELF generation 
using various supported disassembler backends.

> diff --git a/tools/perf/tests/shell/annotate.sh b/tools/perf/tests/shell/annotate.sh
> index d3bafa7e3db55..d8c710470c528 100755
> --- a/tools/perf/tests/shell/annotate.sh
> +++ b/tools/perf/tests/shell/annotate.sh
[ ... ]
> +test_bpf() {
> +  echo "Test annotate with BPF JIT output"
> +
> +  if ! perf check -q feature libbpf-strings ; then
> +    echo "BPF annotation test [Skipped - libbpf-strings not supported]"
> +    return 0
> +  fi
> +
> +  rm -f "${perfdata}"
> +
> +  if ! perf record -a -e cycles -F 4000 -o "${perfdata}" -- sleep 1 2> /dev/null

[Severity: High]
Does removing this securely created temporary file before reusing its path
create a Time-Of-Check to Time-Of-Use (TOCTOU) race condition?

By deleting the file explicitly and then allowing perf record to create it
again, it appears to open a window where a local attacker could place a
symlink at this path. Since perf record does not use O_EXCL when opening
output files, couldn't this result in overwriting arbitrary system files or
leaking system-wide profiling data if the test is run with privileges?

> +  then
> +    echo "BPF annotation test [Skipped - perf record -a failed, probably no privileges]"
> +    return 0
> +  fi

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260609051759.405027-1-irogers@google.com?part=7