Re: [PATCH v6 2/4] perf synthetic-events: Fix line synchronization, bounds, and truncation bugs in proc maps reader

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Stack buffer overflow in `perf_event__synthesize_cgroup` due to out-of-bounds null byte padding.
--

--- Patch [2]: [PATCH v6 2/4] perf synthetic-events: Fix line synchronization, bounds, and truncation bugs in proc maps reader ---
commit 23e7a3b35e7f0fff60a5a4e566945538124d1c0f
Author: Ian Rogers <irogers@google.com>

perf synthetic-events: Fix line synchronization, bounds, and truncation bugs in proc maps reader

This commit addresses logic and boundary bugs in read_proc_maps_line() and
its caller. It handles parsing failures by draining lines appropriately and
secures truncated entries by extracting pathnames within safe bounds.

> diff --git a/tools/perf/util/synthetic-events.c b/tools/perf/util/synthetic-events.c
> index 5307d707711d8..e9952c27b3bc0 100644
> --- a/tools/perf/util/synthetic-events.c
> +++ b/tools/perf/util/synthetic-events.c
[ ... ]
> @@ -579,7 +658,8 @@ static int perf_event__synthesize_cgroup(const struct perf_tool *tool,
>  
>  	event->cgroup.id = handle.cgroup_id;
>  	strncpy(event->cgroup.path, path + mount_len, path_len);
> -	memset(event->cgroup.path + path_len, 0, machine->id_hdr_size);
> +	memset((char *)event + offsetof(struct perf_record_cgroup, path) + path_len,
> +	       0, machine->id_hdr_size);
>  
>  	if (perf_tool__process_synth_event(tool, event, machine, process) < 0) {
>  		pr_debug("process synth event failed\n");

[Severity: High]
This is a pre-existing issue, but can this code path trigger a stack buffer
overflow when aligning the path string?

In perf_event__synthesize_cgroups(), the path buffer is allocated on the stack:

tools/perf/util/synthetic-events.c:perf_event__synthesize_cgroups() {
	...
	char cgrp_root[PATH_MAX];
	...
}

This buffer is passed as path and recursively appended to in
perf_event__walk_cgroup_tree(), which allows the length to reach
PATH_MAX - 1:

tools/perf/util/synthetic-events.c:perf_event__walk_cgroup_tree() {
	...
		/* any sane path should be less than PATH_MAX */
		if (strlen(path) + strlen(dent->d_name) + 1 >= PATH_MAX)
			continue;
	...
}

When this path is then passed into perf_event__synthesize_cgroup(), the
following loop aligns path_len to an 8-byte boundary:

tools/perf/util/synthetic-events.c:perf_event__synthesize_cgroup() {
	...
	while (path_len % sizeof(u64))
		path[mount_len + path_len++] = '\0';
	...
}

If strlen(path) is exactly PATH_MAX - 1, and path_len is not a multiple of 8,
will this loop write null bytes past the end of the cgrp_root stack buffer?

It appears that an attacker with permissions to create nested cgroups could
create a directory path of exactly the required length. When an administrator
runs perf with cgroup synthesis enabled, could this overflow trigger and
potentially overwrite adjacent stack variables or control data, providing a
vector for local privilege escalation?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260721230952.267754-1-irogers@google.com?part=2