Re: [PATCH v2 06/12] perf tests: Fix Python JIT dump profiling test failure

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] Predictable temporary file name allows an attacker to perform a symlink attack leading to arbitrary file overwrite.
--

commit 5cc8bb6cfd6331b267045e9aa8e8f0e141a7441e
Author: Ian Rogers <irogers@google.com>

perf tests: Fix Python JIT dump profiling test failure

This commit fixes PID parsing in the Python JIT dump profiling test by
resolving duplicate space-separated values. It also introduces a retry loop
that scales from 1M to 100M iterations to ensure JIT stack trampoline
samples are successfully captured.

> diff --git a/tools/perf/tests/shell/jitdump-python.sh b/tools/perf/tests/shell/jitdump-python.sh
> index ae86203b14a22..dd4a401cd2455 100755
> --- a/tools/perf/tests/shell/jitdump-python.sh
> +++ b/tools/perf/tests/shell/jitdump-python.sh
[ ... ]
> @@ -33,9 +36,16 @@ trap_cleanup() {
>  
>  trap trap_cleanup EXIT TERM INT
>  
> -echo "Run python with -Xperf_jit"
> -cat <<EOF | perf record -k 1 -g --call-graph dwarf -o "${PERF_DATA}" \
> -		 -- ${PYTHON} -Xperf_jit
> +ALL_PIDS=""
> +NUM=0
> +for iterations in 1000000 10000000 50000000 100000000; do
> +    echo "Running with $iterations iterations..."
> +    rm -f "${PERF_DATA}.pid"
> +    cat <<EOF | perf record -k 1 -g --call-graph dwarf -o "${PERF_DATA}" -- ${PYTHON} -Xperf_jit
> +import os
> +with open("${PERF_DATA}.pid", "w") as f:

[Severity: Medium]
Could this create a time-of-check to time-of-use race condition?

While the main perf data file is securely created using mktemp, this uses
a predictable filename in a shared directory for the PID file. Even though
the file is removed right before the python script runs:

    rm -f "${PERF_DATA}.pid"

Is there a risk that a malicious symlink could be recreated at the
predictable path in the window between the removal and the python open()
call?

If the symlink is recreated and followed during the python script execution:

    with open("${PERF_DATA}.pid", "w") as f:
        f.write(str(os.getpid()))

Does this allow arbitrary file overwrites with the python process PID?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260616061404.41929-1-irogers@google.com?part=6