Re: [PATCH 01/11] perf tools: Fix get_max_num() size_t underflow on empty sysfs file

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] size_t underflow in pmu_id() causing an out-of-bounds write when reading an empty sysfs identifier file.
--

commit 9effe935b669b19aeff861c043c4e4e8a534bfab
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf tools: Fix get_max_num() size_t underflow on empty sysfs file

This commit fixes a size_t underflow in get_max_num() that occurs when
reading an empty sysfs file. By adding an early return when the read
length is zero, it prevents the backward scanning loop from reading
out-of-bounds across the heap.

> diff --git a/tools/perf/util/cpumap.c b/tools/perf/util/cpumap.c
> index 21fa781b03cc7..1fab00ec4a59a 100644
> --- a/tools/perf/util/cpumap.c
> +++ b/tools/perf/util/cpumap.c
[ ... ]
> @@ -448,6 +448,12 @@ static int get_max_num(char *path, int *max)
>  
>  	buf[num] = '\0';
>  
> +	/* empty file — nothing to parse */
> +	if (num == 0) {
> +		err = -1;
> +		goto out;
> +	}
> +
>  	/* start on the right, to find highest node num */
>  	while (--num) {
>  		if ((buf[num] == ',') || (buf[num] == '-')) {

[Severity: High]
This isn't a bug introduced by this patch, but it appears there is another
instance of this exact same empty sysfs file underflow issue in pmu_id():

tools/perf/util/pmu.c:pmu_id() {
        ...
        if (filename__read_str(path, &str, &len) < 0)
                return NULL;

        str[len - 1] = 0; /* remove line feed */
        ...
}

Does this cause an out-of-bounds write? If the sysfs identifier file is
empty, filename__read_str() returns len = 0. The str[len - 1] = 0
assignment then underflows, writing a null byte to str[-1]. Could this
corrupt the malloc chunk metadata located immediately before the allocated
buffer?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260610165207.2077258-1-acme@kernel.org?part=1