Re: [PATCH 09/13] perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [Medium] `prog_tags[sub_id]` is unconditionally accessed, allowing NULL or arbitrary pointer dereferences due to `perf.data` bitmask manipulation.
--

commit 78ed4be2586d28e75e2bc2be14dcd1813163bc05
Author: Arnaldo Carvalho de Melo <acme@redhat.com>

perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()

This commit adds bounds checking for func_info_rec_size and sub_id in
synthesize_bpf_prog_name() to prevent out-of-bounds reads when parsing
untrusted data from perf.data files.

> diff --git a/tools/perf/util/bpf-event.c b/tools/perf/util/bpf-event.c
> index c4594969d7677..fe6fbca508c51 100644
> --- a/tools/perf/util/bpf-event.c
> +++ b/tools/perf/util/bpf-event.c
> @@ -143,7 +143,9 @@ static int synthesize_bpf_prog_name(char *buf, int size,
>  	name_len = scnprintf(buf, size, "bpf_prog_");
>  	name_len += snprintf_hex(buf + name_len, size - name_len,
>  				 prog_tags[sub_id], BPF_TAG_SIZE);

[Severity: Medium]
This is a pre-existing issue, but since we are actively hardening this
function against untrusted perf.data input, should we also validate prog_tags
before dereferencing it here?

If an attacker crafts a perf.data file that clears the PERF_BPIL_PROG_TAGS
bit in info_linear->arrays but leaves info->prog_tags set to an arbitrary
64-bit value, the offset translation and bounds checking in
bpil_offs_to_addr() are skipped.

Because the translation is skipped, synthesize_bpf_prog_name() retains the
untrusted value, blindly casts info->prog_tags to a pointer, and dereferences
it unconditionally via prog_tags[sub_id].

Could this lead to an arbitrary memory read or a NULL pointer dereference
crash during parsing?

> -	if (btf) {
> +	if (btf &&
> +	    info->func_info_rec_size >= sizeof(*finfo) &&
> +	    sub_id < info->nr_func_info) {
>  		finfo = func_infos + sub_id * info->func_info_rec_size;
>  		t = btf__type_by_id(btf, finfo->type_id);
>  		if (t)

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260612222413.40791-1-acme@kernel.org?part=9