Re: [PATCH v2 2/4] perf synthetic-events: Fix line synchronization, bounds, and truncation bugs in proc maps reader

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] `io__drain_line()` fails to drain the remainder of the line when `ch == -2` is passed, causing parsing synchronization failure.
--

--- Patch [2]: [PATCH v2 2/4] perf synthetic-events: Fix line synchronization, bounds, and truncation bugs in proc maps reader ---
commit f1400c3fd8b406d3bc0aa09991216359f2f3eb18
Author: Ian Rogers <irogers@google.com>
Subject: perf synthetic-events: Fix line synchronization, bounds, and truncation bugs in proc maps reader

This commit addresses logic and boundary issues in the proc maps reader. It
adds explicit line drainage to handle mid-line parsing failures and introduces
timeout handling for truncated map entries.

> diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> index 5307d707711d8..059dd558a564c 100644
> --- a/tools/perf/util/synthetic-events.c
> +++ b/tools/perf/util/synthetic-events.c
[ ... ]
> @@ -291,6 +291,17 @@ static int perf_event__synthesize_fork(const struct perf_tool *tool,
[ ... ]
> +static void io__drain_line(struct io *io, int ch)
> +{
> +	if (ch == '\n')
> +		return;
> +	if (ch == -2 && io->data > io->buf && io->data[-1] == '\n')
> +		return;
> +
> +	while (ch >= 0 && ch != '\n')
> +		ch = io__get_char(io);

[Severity: Medium]
Will this loop properly drain the line if ch is initially passed as -2?

When read_proc_maps_line() encounters a malformed line where io__get_hex()
or io__get_dec() fails immediately, they return the error code -2. This
value is passed into io__drain_line() as the ch argument.

Because the loop condition requires ch >= 0, passing -2 causes the loop to
be skipped entirely without reading any characters from io__get_char(io).
This appears to leave the stream positioned mid-line, potentially causing
the parser to repeatedly fail character-by-character on the exact same
line, defeating the line synchronization mechanism.

> +}
> +
>  static bool read_proc_maps_line(struct io *io, __u64 *start, __u64 *end,

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260720225200.3810501-1-irogers@google.com?part=2