Re: [PATCH 5/5] perf dso: Replace assert with runtime check in dso__read_symbol()

[sashiko-bot@kernel.org]

> From: Arnaldo Carvalho de Melo <acme@redhat.com>
> 
> dso__read_symbol() asserts that len <= jited_prog_len, where len comes
> from sym->end - sym->start (parsed from PERF_RECORD_KSYMBOL in
> perf.data).  Both values originate from untrusted file input.
> 
> With NDEBUG (production builds), the assert is compiled out, allowing
> an out-of-bounds heap read when the BPF program buffer is accessed.
> Without NDEBUG, a crafted perf.data crashes perf with an assertion
> failure.
> 
> Replace the assert with a runtime bounds check that returns NULL with
> an appropriate error code, matching the existing error handling
> pattern in this function.
> 
> Fixes: aa04707f507e ("perf dso: Support BPF programs in dso__read_symbol()")
> Reported-by: sashiko-bot <sashiko-bot@kernel.org>
> Cc: Ian Rogers <irogers@google.com>
> Cc: Song Liu <song@kernel.org>
> Assisted-by: Claude:claude-opus-4.6
> Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260813004927.16738-1-acme@kernel.org?part=5