Re: [PATCH v2 perf-tools-next 2/6] perf trace: Validate payload bounds in augmented string beautifier

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Failing to validate memory alignment of malformed payload sizes causes SIGBUS traps on subsequent arguments.
--

commit 2e5b760b204b32d343eb2501c4ff84ed16a4618a
Author: Aaron Tomlin <atomlin@atomlin.com>
Subject: perf trace: Validate payload bounds in augmented string beautifier

This commit adds bounds validation for augmented_arg->size when 
pretty-printing augmented string arguments in the perf trace tool. It 
ensures the payload size is within the remaining buffer bounds before 
calculating consumed bytes, preventing potential buffer over-reads and 
integer overflows.

> diff --git a/tools/perf/builtin-trace.c b/tools/perf/builtin-trace.c
> index 20fffc24507b5..91461ab927b63 100644
> --- a/tools/perf/builtin-trace.c
> +++ b/tools/perf/builtin-trace.c

[ ... ]

> @@ -1898,12 +1898,21 @@ static void thread__set_filename_pos(struct thread *thread, const char *bf,
>  static size_t syscall_arg__scnprintf_augmented_string(struct syscall_arg *arg, char *bf, size_t size)
>  {
>  	struct augmented_arg *augmented_arg = arg->augmented.args;
> -	size_t printed = scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmented_arg->value);
> +	size_t printed;
> +	int consumed;
> +
> +	if (arg->augmented.size < (int)sizeof(*augmented_arg))
> +		return 0;
> +
> +	if (augmented_arg->size <= 0 || augmented_arg->size > arg->augmented.size - (int)sizeof(*augmented_arg))
> +		return 0;
> +
> +	printed = scnprintf(bf, size, "\"%.*s\"", augmented_arg->size, augmented_arg->value);
>  	/*
>  	 * So that the next arg with a payload can consume its augmented arg, i.e. for rename* syscalls
>  	 * we would have two strings, each prefixed by its size.
>  	 */
> -	int consumed = sizeof(*augmented_arg) + augmented_arg->size;
> +	consumed = sizeof(*augmented_arg) + augmented_arg->size;
>  
>  	arg->augmented.args = ((void *)arg->augmented.args) + consumed;

[Severity: High]
This is a pre-existing issue, but does failing to validate the memory 
alignment of malformed payload sizes cause SIGBUS traps on subsequent
arguments?

If a user uses the perf trace tool to read a malformed or maliciously 
crafted perf.data file where augmented_arg->size is not naturally 
aligned, the tool advances the pointer by this unaligned size without 
correcting it. 

Can the next argument read dereference a misaligned pointer and crash 
the perf tool on architectures requiring strict memory alignment?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260907015140.363076-1-atomlin@atomlin.com?part=2