Re: [RFC PATCH 5/5] selftests/perf_events: add AUX kernel API selftest script

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 4 potential issue(s) to consider:
- [Medium] Selftest unconditionally fails in installed environments by expecting kernel source files to be present.
- [Medium] Userspace regression test is improperly skipped when the selftest is run from an installed location.
- [Medium] Selftest hardcodes `gcc` for runtime compilation, breaking cross-compilation environments.
- [Medium] Insecure predictable temporary directory name in `/tmp` allows local arbitrary file overwrite.
--

--- Patch [5]: [RFC PATCH 5/5] selftests/perf_events: add AUX kernel API selftest script ---
commit 3dec31f6b5ec09fc257a6fee2e10670ad1c14b3c
Author: Kunwu Chan <kunwu.chan@gmail.com>

selftests/perf_events: add AUX kernel API selftest script

Add a shell script that runs the perf_aux_kernel KUnit suite through
debugfs, builds and runs the userspace regression program, and
performs static-analysis checks on the source tree.

> diff --git a/tools/testing/selftests/perf_events/aux_kernel.sh b/tools/testing/selftests/perf_events/aux_kernel.sh
> new file mode 100755
> index 0000000000000..431f59ef02e7d
> --- /dev/null
> +++ b/tools/testing/selftests/perf_events/aux_kernel.sh
> @@ -0,0 +1,563 @@
> +#!/bin/bash
[ ... ]
> +RESULTS_DIR="/tmp/perf_aux_kernel_test_$$"
> +mkdir -p "$RESULTS_DIR"
> +exec > >(tee "$RESULTS_DIR/output.log") 2>&1

[Severity: Medium]
Does this predictable temporary directory name create a local file overwrite
vulnerability?

Since this selftest might be executed as root, a local unprivileged user could
pre-create a symlink with the target PID pointing to any system file (like
/etc/shadow). The tee command would then follow the symlink and overwrite the
target file.

[ ... ]
> +SRC_EVENTS="$ROOT/kernel/events"
> +for f in core.c ring_buffer.c internal.h; do
> +	if [[ -f "$SRC_EVENTS/$f" ]]; then
> +		pass "Source file: kernel/events/$f"
> +	else
> +		fail "Source file: kernel/events/$f missing"
> +	fi
> +done

[Severity: Medium]
Will this unconditionally fail in installed selftest environments?

When tests are run via make install on target CI systems, the kernel source
tree is typically not present. Checking for source files in kernel/events/ and
invoking fail() will cause false positive CI failures.

[ ... ]
> +# Build and run the C regression test program
> +UMODE_SRC="$SCRIPT_DIR/aux_kernel_usermode.c"
> +UMODE_BIN="$SCRIPT_DIR/aux_kernel_usermode"
> +
> +if [[ -f "$UMODE_SRC" ]]; then
> +	if [[ ! -x "$UMODE_BIN" ]] || [[ "$UMODE_SRC" -nt "$UMODE_BIN" ]]; then

[Severity: Medium]
Will this skip the userspace regression test when run from an installed
location?

Because source files are not installed by TEST_GEN_PROGS during make install,
the source file won't exist on the target system. This conditional causes
the script to skip executing the already compiled binary, reducing test
coverage in CI pipelines.

> +		echo "  Building aux_kernel_usermode..."
> +		gcc -o "$UMODE_BIN" "$UMODE_SRC" -Wall -Wextra -O2 2>&1 | \

[Severity: Medium]
Does hardcoding gcc break cross-compilation environments?

If the binary is missing and the script attempts to compile it dynamically,
using gcc ignores the CC and CROSS_COMPILE environment variables set by the
kernel build system. This can lead to compilation failures or building for
the wrong architecture.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814144927.489172-1-kunwu.chan@linux.dev?part=5